Protection of Personal Information

There is nobody who has a cell-phone that has not been the victim of a constant stream of telephone calls from businesses marketing themselves and their products as “the next big thing”.  Many of us find ourselves constantly explaining to the person on the other end of the line – whose job it is to harass the list of potential clients they are given on a piece of paper on a daily basis –  that we do not require the product they are offering. The question we often end up asking ourselves (and sometimes the telemarketer)  is: How did you get my number?

Recently, I have been asked about whether this type of marketing is legal, and how the company who phones you got your details. The two main pieces of legislation which protect consumers in this regard is the Protection of Personal Information Act 4 of 2013 (“PoPI Act”)  and the Consumer Protection Act 68 of 2008 (“CPA”).

Section 11 of the CPA states that every person has the right to refuse to accept, discontinue or pre-emptively  block any approach or communication to that person, if the approach or communication is primarily for the purpose of direct marketing.

The CPA goes further and states that to facilitate the realisation of each consumer’s right to privacy, and to enable consumers to efficiently protect themselves against the activities contemplated in subsection (1), a person who has been approached for the purpose of direct marketing may demand that the person responsible for initiating the communication desist from initiating any further communication.

In simple terms, the purpose of the PoPI Act is to ensure that all South African institutions conduct themselves in a responsible manner when collecting, processing, storing and sharing another entity’s personal information by holding them accountable should they abuse or compromise your personal information in any way. The PoPI legislation basically considers your personal information to be “precious goods” and therefore aims to bestow upon you, as the owner of your personal information, certain rights of protection and the ability to exercise control over:

• when and how you choose to share your information (requires your consent)
• the type and extent of information you choose to share (must be collected for valid reasons)
• transparency and accountability on how your data will be used (limited to the purpose) and notification if/when the data is compromised
• providing you with access to your own information as well as the right to have your data removed and/or destroyed should you so wish
• who has access to your information, i.e. there must be adequate measures and controls in place to track access and prevent unauthorised people, even within the same company, from accessing your information
• how and where your information is stored (there must be adequate measures and controls in place to safeguard your information to protect it from theft, or being compromised)
• the integrity and continued accuracy of your information (i.e. your information must be captured correctly and once collected, the institution is responsible to maintain it).

We have to accept that we now live in an information age and along with this progress comes the responsibility for each person to take care of and protect their own information. Do not accuse someone else of sharing or compromising your personal information when you publish the very same information on public services like Facebook, LinkedIn, Google+ or public directories.  Modern technology makes it easy to access, collect and process high volumes of data at high speeds. This information can then be sold, used for further processing and/or applied towards other ends. In the wrong hands such an ability can cause irreparable harm to individuals and companies. To protect your right to privacy and abuse of your information, data protection legislation is necessary even if it means imposing some social limits on society to balance the technological progress. So remember:  The PoPI Act cannot protect you if you do not take care to protect yourself.

Remember that the next time somebody calls you to sell you something you did not sign up for, you have the right to request how they got your personal information, and that they desist from continuing to call you.

For quality legal assistance contact our Litigation Department on 041 501 9800.