There has been a lot of discussion on the new Protection of Personal Information Bill (“the Bill”) in the media over the past few months, with many writers hailing the Bill as a long-awaited saving grace for the protection of personal information in South Africa. It cannot be argued, with the advent of social-media and the ease in which personal information may be collected and processed, that such legislation is not overdue. However, certain provisions of the Bill raise the question: does the Bill really protect you to the extent required in South Africa?

In this regard, when the Bill was drafted, some interpretation difficulties were adopted in order to keep it in line with international personal information and data protection standards. One such difficulty is a requirement in the Bill that manual data be part of a ‘filing system’ for the protection in the Bill to apply.

In simple terms, the Bill differentiates between two different forms of data which it protects: manual data and automatic data. Manual data is typically data contained in paper-documentation handled by hand or which can be physically stored of filed whereas automatic data is typically in the form of electronically stored/processed data. In this regard, the protection mechanisms offered in the Bill will only protect manual personal data if it forms part of a ‘filing system’ or is intended to form part thereof.

This means that the Bill does not, in fact, protect against various invasions of personal information. Take for instance, identity theft and theft of personal documents or information. Should an individual steal a manual document, for example printed bank account statement or a printed document containing your contact and address details, such an attack on your personal information will only be protected against if the thief stores or intendeds to store  the stolen information in a ‘filing system’.

This also impacts on another scenario that many business people are exposed to, being the ‘fish-bowl’ method of collecting business cards at expos and conferences, where dropping your business card or personal contact details into the bowl or box entitles you to a chance to win a prize. Similarly, this concern will also apply to convenience store competitions where details are provided on the back of a till-slip or receipt. Under normal circumstances, where such information is collected or stored electronically or manually in a filing system, the collectors would be prohibited from using such information for any reason other than that which you consented to. However, the Bill will not protect such manual information, so long as it is never organized or put into a filing system (e.g. if it is kept in the fish bowl). Due to this risk, caution will still need to be exercised in handing out such personal information, as the Bill does not cover such scenarios. This is important because, with just your telephone number and the appropriate tools or software, it is possible for a person to look up your previous and other telephone numbers, credit-history, physical address, previous addresses, employer details, civil and criminal judgments against you, martial status and much more.

It is essential to also recognize that South Africa does not have any other legislation strictly dedicated to the protection of personal information, and gaps in the current Bill will ultimately fall to common law or a piecemeal application of the privacy provisions in our Constitution, the use of which has proven to be difficult. It should also not be forgotten that South Africa is still a developing country, with many organizations struggling through dishevelled and disorganised file management systems, and with many more still utilizing paper-based systems. The question should therefore be asked: should the protection of your personal information really be subject to how organized data collectors are?
Our courts will have to carefully consider the implications of a narrow interpretation of the Bill in order to avoid limiting a person’s rights, on the basis of purely mechanical requirements.
The Bill will likely be promulgated into law sometime in 2013.

Written by Ashlin Perumall
Candidate Attorney – Corporate and Commercial Department – Adams & Adams

Checked by Danie Strachan
Partner – Corporate and Commercial Department – Adams & Adams