South Africa POPIA: Various deadline extensions and Guidance Note published by Information Regulator

Information Regulator confirms deadline for registering Information Officers no longer 30 June 2021, releases a guidance note on exemptions from conditions for lawful processing, and extends the commencement date of the application of section 58(2) of the Protection of Personal Information Act, 4 of 2013 (“POPIA”).

The Information Regulator has recently released a flurry of media statements, guidance notes and amendment notices ahead of the much anticipated commencement date of POPIA on 1 July 2021. We summarise the most recent developments below.

Deadline for registration of Information Officers no longer 30 June 2021

On 22 June 2021, the Information Regulator announced that there will be no deadline for responsible persons to register Information Officers, and that responsible parties will not be held liable for failing to register their Information Officers and Deputy Information Officers by 30 June 2021. The decision follows technical problems being experienced on the dedicated portal for registering information officers and concerns raised around the registration process. The announcement can be accessed here. The Information Regulator has advised that it will communicate alternative registration processes in due course (and we expect a new registration deadline).

Notwithstanding the fact that there is no deadline for registration of Information Officers currently in place, POPIA will still come into effect on 1 July 2021.

Guidance Note on Exemptions and Invitation for Applications for Exemptions from a Condition for Lawful Processing

On 21 June 2021 the Information Regulator published the Guidance Note on Exemptions from the Conditions for Lawful Processing of Personal Information (“Guidance Note”), a copy of which can be accessed here.

The purpose of the  Guidance Note is to provide guidance to responsible parties who (i) intend to apply for exemption in terms of section 37 of POPIA; or (ii) are exempt from certain provisions relating to the processing of personal information in respect of certain functions in terms of section 38 of POPIA.

On 22 June 2021 the Information Regulator issued an invitation to responsible parties who wish to apply for exemptions from a condition for lawful processing of personal information in terms of section 37 of POPIA. The invitation can be accessed here.

Responsible parties have been urged to carefully read the Guidance Note before submitting an application for exemption from a conditions for lawful processing of personal information to the Information Regulator.

Of import, the Guidance Note provides that:

• Exemptions granted pursuant to an application in terms of section 37 and where processing is in accordance with section 38 of POPIA should not be routinely relied on and will be considered on a case-by-case basis;
• Exemption applications in terms of section 37(1) of POPIA may not be for an exemption from all 8 of the conditions for the lawful processing of personal information, but may be granted for one or some of the conditions for the lawful processing of personal information where the applicant satisfies the Information Regulator that the processing is in the public interest or involves a clear benefit to the data subject;
• The Information Regulator may impose reasonable conditions in respect of any exemption granted in terms of section 37(1) of POPIA, including, inter alia, the requirement for a responsible party to implement certain appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information; and
• The Information Regulator will, upon granting an exemption, publish a notice in the Government Gazette in terms of section 37(1) of POPIA, and the exemption granted will only come into operation on the date of publication in the Government Gazette.

Commencement Date for Section 58(2) of POPIA Extended to 1 February 2022

The Information Regulator also recently published an amendment notice in terms of section 114(3) of POPIA (“Amendment Notice”), amending the initial notice published in Government Gazette No. 297 on 1 April 2021, which Amendment Notice extends the commencement date of the application of section 58(2) of the Protection of Personal Information Act, 4 of 2013 (“POPIA”) from 1 July 2021 to 1 February 2022.

Section 58(2) of POPIA prohibits responsible parties from processing personal information that is subject to prior authorisation of the Regulator in terms of section 57(1) of POPIA, where such processing activity has been notified to the Information Regulator and is awaiting a decision by the Information Regulator.

The applicable processing activities which require prior authorisation from the Information Regulator include:

• Processing unique identifiers (e.g. identify number) of data subjects for a purpose other than the purpose for which the identifier was specifically intended at collection, with the aim of linking the information together with information processed by other parties;
• Processing of information relating to criminal behaviour or illegal, objectionable conduct on behalf of the third parties; 
• Processing information for credit reporting; and
• Transferring special personal information or personal information of children to a third party in a foreign country that does provide an adequate level of protection as required in terms of section 72 of POPIA.

The Amendment Notice provides welcome relief to organisations who will no longer be required to suspend any of their activities that are subject to prior authorisation from the Information Regulator in terms of section 57(1) of POPIA on 1 July 2021.

Important takeaways:

• The Amendment Notice does not seek to extend the grace period provided in terms of section 114(1) of POPIA in relation to the enforcement of the remaining provisions of POPIA;
• Only the prohibition against carrying out or continuing any activities that have to be notified to the Information Regulator in terms of section 58(2) will only become effective on 1 February 2022; and
• Organisations would still be required to submit a notification to the Information Regulator where such activities are subject to prior authorisation in terms of section 57(1).

For more information about the notification and application process for prior authorisation and what these activities entail refer to the link to our Guidance Note here. Further we attach a link to the initial notice in Government Gazette No. 297 on 1 April 2021 here and the latest Amendment Notice here.

If you need any assistance with understanding the implications of POPIA to your business, assistance with exemptions from the conditions for lawful processing of personal information or any POPIA related training, please reach out to Ernie van der Vyver, Nicole Britton and Kate Swart.