Purpose and application of the Protection of Personal Information Act, No 4 of 2013 (Act)

The Act regulates how anyone who processes personal information must handle, keep and secure that information. If an individual or a
company processes personal information relating to a person, that individual or company must comply with the Act. Failure to comply with the Act may lead to the imposition of certain penalties under the Act.

Punishable offences in terms of the Act The following offences are, if committed, punishable with either a fine (not exceeding R10 million), or imprisonment (for a period not exceeding 10 years), or both:

• Obstruction of a Regulator - a person will  be guilty of an offence if they hinder, obstruct  or unlawfully influence the Regulator or any person acting on behalf of or under the  direction of the Regulator;
• Failure to comply with enforcement or  information notices - if a responsible party  fails to comply with an enforcement notice,  they will be guilty of an offence;
• Offences by witnesses - a person will  be guilty of an offence where such a person  is summoned to give or produce evidence  before the Regulator and that person, after  being sworn in, gives false evidence before  the Regulator on any matter;
• Unlawful acts by a responsible party in  connection with an account number - if a  responsible party contravenes s8 of the Act,  subject to certain exceptions, that responsible  party will be guilty of an offence. The  responsible party, in terms of s8 of the Act, must  ensure conditions for lawful processing; and
• Unlawful acts by third parties in connection  with an account number - a person who  knowingly or recklessly obtains or discloses an account number of a data subject, or who  procures the disclosure of an account number  of a data subject to another person, is guilty of an offence. In addition, if that person sells  or offers to sell an account number obtained  illegally, they will be guilty of an offence.

The following offences are, if committed, punishable with either a fine (not exceeding R10 million), or imprisonment (for a period not exceeding 12 months),  or both:

• Failure to notify the Regulator that processing  is subject to prior authorisation – if a  responsible party fails to notify the Regulator  that processing, which is about to be  embarked upon, is subject to prior  authorisation from the Regulator, that person  will be guilty of an offence;
• Breach of confidentiality - any person who  breaches the provisions of s54 of the Act,  which states that a person acting on behalf  of or under the direction of the Regulator must  treat all personal information they come across  as confidential, will be guilty of an offence;
• Obstruction of the execution of a warrant - a  person who obstructs or fails to give assistance  to a person executing a warrant in terms of the  Act will be guilty of an offence;
• Failure to comply with enforcement or  information notices - if a responsible party in  purported compliance with an information notice served on it, makes a false statement,  it will be guilty of an offence; and
• Offences by witnesses - a person will be guilty  of an offence where such a person is  summoned to give or produce evidence before the Regulator and that person either (i) does  not attend; (ii) fails to remain in attendance;  (iii) refuses to be sworn in or to make an affirmation; (iv) does not answer fully and  satisfactorily; or (v) does not produce any item  that they have been summoned to produce.

Conclusion

Despite the fact that the Act is quite onerous on Employers, there is a one year grace period from the date on which the Act commences to allow for compliance. If a responsible party acquaints itself with the provisions of the Act timeously and puts in place the necessary measures, the penalties mentioned can easily be avoided.

Written by Johan Botes, Director, Lauren Salt, Associate,  and Tracy Robbins, Candidate Attorney, Employment practice, Cliffe Dekker Hofmeyr