Protection of Personal Information Bill: Technical team's clause by clause deliberations

Meeting report

Protection of Personal Information Bill [B9 2009]: Clause by Clause Deliberations
The technical team proceeded with a clause-by-clause deliberation on the Protection of Personal Information Bill (the Bill).

Definitions
The Chairperson requested that the optional wording proposed in respect of a “Filing System” should used as an amendment. He asked for the opinion of the State Law Advisor’s opinion on the submission on “blocking” made in the public submissions.

Ms Ananda Louw, Researcher, South African Law Reform Commission, said that she did not have any problems with the submission from DMASA, which was correct, it should be remembered that ‘blocking’ was part of processing. It should be considered that ‘blocking’ was already dealt with in the Consumer Protection Act.

Mr Henk Du Preez, State Law Advisor, Department of Justice and Constitutional Development, said that the DMASA submission provided technical examples which were not clearly defined.

Dr M Oriani-Ambrosini (IFP) suggested the following wording for the definition of consent: “And includes the failure on the side of the data subject to object to or opt out when given a reasonable opportunity to do so.” This would mean that a person would be deemed to have consented, for instance, where that person had not unchecked a box that was already ticked for consent. He pointed out that this was the standard common practice when it came to transactions.

Mr Jeffery said that he was not convinced that this wide definition was appropriate.

Ms Louw agreed. She added that the definition as suggested would cause problems in terms of the way the Bill was structured, because the Bill was drafted to include opting out. Consent was akin to opting in.

Ms M Smuts (DA) appealed to Dr Oriani-Ambrosini on the wording, saying that the entire world used the word “consent” rather than “assent”.

Dr Oriani-Ambrosini said that he was driven by common sense and this was the way the world operated. There should not be a reason to legislate against a world-wide practice unless there was a good reason for it.

The Chairperson said that he did not want a long debate about this. The issue of consent and assent could be raised before the full Committee.

Ms Louw added that what Dr Oriani-Ambrosini was advocating for was already in the Bill. From a technical perspective the Bill referred to opt in consent.

The Chairperson said that there were a lot of political differences between Members on the Bill. However Dr Oriani-Ambrosini had a far greater libertarian approach of limiting the Bill as much as possible. The technical Committee was not voting on the matter and any Member of the Technical Team could propose an option in for consideration by the full Portfolio Committee.

Clause 3
Dr Oriani-Ambrosini suggested the following wording: “Should be domiciled in the Republic and the information is processed in the Republic.” Information processed outside of the Republic by a company domiciled in the Republic seemed to be beyond what the Bill was intended to do.

The Chairperson asked what had been the position in other countries with protection of personal information regimes.

Ms Louw said that Clause 3(1)(b)(ii) dealt with this aspect of the Bill.

The Chairperson interjected and said that Dr Oriani-Ambrosini’s question was whether a company that was based in South Africa (SA) , but was processing information in another country, be subject to the Bill insofar as its foreign operations were concerned.

Ms Louw said that all international jurisdictions were trying to protect as much personal information as possible. The problem would thus be addressed in the country where the individual data subject was domiciled.

The Chairperson said that the way the clause was worded meant that wherever in the world a company that was domiciled in SA had its operations, these operations would be subject to the provisions of the Bill. He asked if this was the intention.

Ms Louw said that in regard to transferring of information, the Bill prohibited this if it was to a country where there was no adequate protection.

The Chairperson said that there were a number of European Union (EU) based countries in SA. He asked what their law said about the processing of information in other countries.

Ms Louw said that the formulation in the clause was standard practice. The better protection was always the best option.

Dr Oriani-Ambrosini said that it should be noted that as soon as something was processed from a foreign based operation for a company domiciled in SA, then that processing would be considered as having occurred in SA.

The Chairperson said that further research was needed on this issue.

Clause 6
The Chairperson said that he could not understand why the Special Investigations Unit (SIU) was not covered under 6(1)(c)(ii).However it may be that this issue could not be taken forward because it could still request an exemption from the Information Regulator (IR).

Ms Louw said that it was possible that a decision would have to be made on whether the Bill would be applicable, or whether the legislation specifically applicable to other entities would apply instead of the Bill. It was important to note that, for purposes of determining adequate safeguards, it was not a requirement that an entity’s own legislation must mirror the provisions in the Bill. As long as an entity’s legislation was in harmony with the Bill then this would be enough. If it was found that the SIU’s legislation was not adequate, then the IR would declare that the Bill would apply to the SIU. If the latter did not agree, the matter would proceed to Court for a determination.

Ms Smuts asked if Ms Louw had had meetings with intelligence departments, and when this had happened.

Ms Louw replied she had, when the legislation was drafted.

Dr Oriani-Ambrosini said that if the IR had the final say on whether the Bill applied or not then surely this body should also determine exemptions.

Ms Louw said that a lot of this was about self regulation.

Dr Oriani-Ambrosini said that often matters was deemed to be adequate until somebody from outside said that they were in fact not so. The IR should be responsible for keeping up standards and determining adequacy. This should not be left up to entities to decide for themselves, so that action would only be taken after there might have been a complaint.

Mr Du Preez said that one of the IR’s functions were to advise the relevant Minister.

The Chairperson said that the wording under 6(1)(c) should be left as it was, with the option to delete.

The Chairperson moved on to say that at the least there should be three options for exclusions for journalists. At the moment there were five, but less would be preferable.

Mr Du Preez said that he was confused by the South African National Editor’s Forum (SANEF) input at the last meeting. It was not clear whether an indication had in fact been given as to whether SANEF preferred any of the five options in the Bill.

Ms Smuts agreed that SANEF had not indicated a preference in the last meeting. At the end, however, the representatives had indicated that they accepted that there would be a provision that would deal with their own code of conduct.

The Chairperson said that SANEF was quite divided, from what he recalled. He suggested that option one was probably not necessary.

Mr Du Preez said that it may be more technically correct to rather word this as: “To the extent that someone who has been exempted from one or more conditions under clause 6(1)(g)”. He suggested that it should be flagged for further consideration.

The Chairperson said that he thought the issue was whether clause 6(1)(g) should be there at all.

Clause 6B
Ms Smuts said that she did not understand Clause 6B(1)(b).

Dr Oriani-Ambrosini agreed with Ms Smuts. He gave the example that a person who was writing a book would have to strike a balance between competing interests, such as the right to privacy, national interest and freedom of expression. The Committee had to focus on what the application of the Bill would actually be, and to what it applied, instead of focusing on the exclusions. The Bill applied to commercial transactions only.

The Chairperson said that the Committee had already been through this debate.

Dr Oriani-Ambrosini said that he would like to stress that it was very difficult to have a piece of legislation that specified that information in the hands of writers must be destroyed or not kept, unless it was necessary for literary and artistic purposes.

The Chairperson said that clause 6B was not in the introduced Bill and was inserted at the request of the Technical Committee. However, the current wording of this clause was too complicated as it involved the balancing of rights, which a court would do in a defamation challenge. There should be an exclusion in respect of genuine artistic and literary work, with the IR could ascertain whether it was genuine or not.

Dr Oriani-Ambrosini said that what the Chairperson had said was that an organ of state would determine what was art or literature or journalism.

The Chairperson said that he agreed that there were problems, but questioned what the other options might be. The Technical Committee did not want the Bill to apply to literary or artistic expressions. Other countries had used a mere reference to “literary or artistic expression” and just left it at that.

Ms Louw agreed that other countries had not gone into detail.

The Chairperson requested that ‘bona fide’ should be included in the clause, but it was not necessary for the clause to specify who would determine whether something was ‘bona fide’ or not. The courts or IR could regulate disputes.

Ms Louw said that in the United Kingdom (UK),there was a bundling of literary and artistic works together with journalism.

Dr Oriani-Ambrosini said that there was no such thing as ‘bona fide’ art or literary expression.

Ms Smuts said that there were several provisions in the Film and Publications Act that safeguarded free speech, and used a reference to ‘bona fide’.

Clause 11
Dr Oriani-Ambrosini wished to propose new wording for clause 11(g) as follows: “Information in a data bank operating in terms of a code of conduct”. This would allow the transfer of information from one data bank to another as they would all subscribe to a code of conduct.

Ms Louw said that the Bill was driven by purpose and transparency. The information had to be collected for a specific purpose and then it could only be distributed for that same purpose.

The Chairperson asked what Ms Louw thought of the amendment.

Ms Louw replied that the purpose and concept was covered elsewhere.
 
Dr Oriani-Ambrosini said that he did not think it was covered elsewhere. Information and the trade of information was important and as long as there were sufficient safeguards, then it would make sense to transfer data without consent.

The Chairperson said that he was not entirely comfortable with the proposal and felt it should be left as an option for moment. He also commented that the proposal also seemed to be out of context, because transferring information fell under further processing.

Dr Oriani-Ambrosini said he understood the point, but reiterated that transferring data was not provided for here.

Clause 15
Dr Oriani-Ambrosini said he had made a proposal which had been omitted from the draft. He suggested that, under clause 15(1), the following words should be added at the beginning of the clause: “Before personal information may be used for the intended purpose, the responsible party must take reasonable and practical steps to ensure that such information is complete”.

Ms Louw said that the retention principle specified that the data should be kept for as long as it was needed.

Clause 25
Ms Smuts said she was not sure if children should be included under this clause. The IR may be given the specific task of looking at this policy area, or may create regulations.

Dr Oriani-Ambrosini agreed with Ms Smuts.

The Chairperson said that he did not like the lowering of the age of children to three, saying that this sounded to be an arbitrary figure and he did not think that it had been thought through enough. A restriction on the processing of information relating to children should be included, and perhaps it could be a standalone section. The appropriate age in the Bill for “a child” should remain at 18. The Committee had to look at a law that was implementable, and it was not possible simply to ban children from using MIXIT.

Dr Oriani-Ambrosini said that he was in favour of the age for “children” to be 13 for the purposes of this Bill.

The Chairperson said that this could be an option under the definition of child. The drafters should consider a separate section for children, and not include these references under Clause 25. There would basically be a prohibition on the processing of personal information of children in circumstances where the child was not legally competent without the assistance of a competent person. There should also be a proviso that, notwithstanding the afore-mentioned, the Regulator could consider exemptions on application.

Ms Smuts said that the Regulator could conduct an enquiry and then regulate.

The Chairperson said that the Bill should set out what functions the Regulator would have to balance.

Ms Smuts said that there were provisions around a contract with a minor until the parent stepped in, and asked if it was really the intention that the Bill should prohibit these.

The Chairperson said that he preferred a blanket prohibition that would apply to everything but that could be lifted in specific cases.

Dr Oriani-Ambrosini said that his fear was that the Bill would be too cumbersome and would not be in line with what was being done in the rest of the world, with the result that big companies would cut SA out.

Mr Du Preez pointed out that since the beginning of this process, the State Law Advisors had pointed out that there were problems with these provisions. The concern with the Chairperson’s proposal was that there should not be a general prohibition on each and every single person who was under the age of 18 on the day of implementation. Even if Clause 25 was not included, there were still hurdles in clause 10, which provided for a parent to submit a complaint to the Regulator.

Clause 36
Ms Smuts said that under Clause 36(1)(g(ii) public servants should be able to be eligible for appointment, as long as the civil servant resigned from the public service upon appointment.

The Chairperson said that he did not know if the proposal was necessary at this stage, because of the time of appointment. If the restriction was kept in a person could still resign and be appointed.

Ms Smuts said that it had to be made clear, and in writing.

The Chairperson said that what Members were proposing should be kept as options, including that to allow public servants to serve on the Regulator. This should include part time members.

Ms Smuts said that part time members should not be appointed.

The Chairperson asked why three months was specified as the period for written notice when a member of the Regulator resigned.

Mr Du Preez said that this was to prevent the situation where a crisis could be created by a sudden resignation with immediate effect.

Dr Oriani-Ambrosini said that he did not think that there was such a requirement even for Director-Generals (DG).

Mr Du Preez said that he would leave this up to the Committee. Immediate resignation in the public service was not possible, as it was subject to approval by the DG or Minister. Even if immediate resignation was allowed, there would be a lot of experienced staff that would be holding acting appointments.

The Chairperson asked which other boards and commissions had the three month requirement.

Ms Smuts said they all did, including the South African Broadcasting Corporation (SABC).

Mr Du Preez agreed.

The Chairperson asked if Mr Du Preez could double check on this. He also thought that it was necessary to provide for the situation where a person wanted to leave. What should also be provided for was for when a person wanted to leave, or where there might be a personality clash.

Clause 37
Ms Smuts referred to Clause 37(2)(b) and said that it should include the words: “Unless the President, upon the recommendation of the National Assembly appoints that member for a longer period...” The whole idea was for the National Assembly to appoint, not the President. The President merely signed to confirm.

The Chairperson said that the persons referred to in the clause Ms Smuts was talking about fell under Clause 36(3). He agreed with Ms Smuts’ point, but added that the end of the clause should also read: “unless the member holds the office for a longer period, but that period may not exceed five years.”

Clause 38
Ms Smuts said that Clause 38(1)(b) was strange in that it made the Chairperson accountable to the Regulator. She asked where it was stated that the Regulator was accountable to Parliament.

Mr Du Preez said that the Regulator was a juristic person, and all its members were accountable to that juristic person.

The Chairperson referred to Clause 35, that dealt with accountability. However the accountability that Ms Smuts was referring to was more administrative. He asked the drafters to look at the wording used for the Chapter 9 institutions, and asked how they accounted to Parliament.

Clause 41
Ms Smuts and Dr Oriani-Ambrosini said that they did not understand why there was a provision for part time staff.

Mr Du Preez said that the clause merely provided that if a person was not subject to the provision of the Public Service Act then that person would be entitled to benefits in the performance of his or her functions.

The Chairperson said that the reason for the provision for part timers was because of funding constraints. It was only an option.

Dr Oriani-Ambrosini said that the problem that he had with this analogy was that the private sector was not as regimented and regulated at the same level, nor as holistically, as the public sector. The public sector had more uniform rules and regulations and this meant that full time regulators would be subject to the same regime.

The Chairperson said that this was only an option. He asked Members to respect the process of the Technical Committee and reiterated that no final decisions were being taken as yet.

Clause 42
Ms Smuts referred to Clause 42(6) and asked how a public servant could be “seconded”.

Dr Oriani-Ambrosini said that this was a new job that was technically demanding, and he agreed with Ms Smuts.

The Chairperson asked if the two options for the Members could be reflected.

Clause 43
Ms Smuts referred to Clause 43(b) and asked for clarity as to whether a Chief Executive Officer (CEO) would normally appoint his/her staff.

The Chairperson said that this was not unusual for the public service, and the clause provided for acting appointments. This was the same for Directors General.

Clause 45
Mr Du Preez suggested that the Enforcement Committee should be comprised of a small number – say three – members.

Ms Smuts agreed that three to five should be enough.

The Chairperson said that the Committee had to know what the cost increases would be as the powers and functions of the Regulator were increased. No maximum should be specified at this stage, until a costing exercise had been conducted on the salaries.

Clause 54
Mr Du Preez said that he was concerned about the format of clause 54(1) but he would come back to the Committee on this.

Dr Oriani-Ambrosini said that his previous concerns and views on this clause should be reflected.

The Chairperson said that this could be in the form of a footnote.

Clause 65
Dr Oriani-Ambrosini asked if this clause was necessary. When legislation was revoked the effect was the same as if that legislation had never existed. He suggested that the proper wording for Clause 65(3) would be: “When repealing a code the Regulator may decide whether or not the new Code would apply to pending matters”.

The Chairperson said that the law applied as it happened. He wondered if it would not be better to have the Regulator sort this out on a case by case basis.

Mr Du Preez said that he would follow up on this

Clause 69
Mr Du Preez said that the State Law Advisors had proposed inserting “responsible party” under clause 69(3).

Ms Smuts said that she supported this.

Clause 70
The Chairperson asked what the effect of this provision was and what it meant.

Mr Du Preez replied that it provided for a person to submit a complaint to the Regulator or institute a civil action.

The Chairperson asked if this could be specified.

Mr Du Preez said that it was specified later on in the Bill, in the part dealing with civil claims.

Clause 80
Dr Oriani-Ambrosini asked if there were provisions for a person against whom a complaint was laid to interact with the Regulator through Counsel, and also to be informed of the alleged misconduct.

Ms Smuts said that notification was covered.

Mr Du Preez said that he would have to look up the specific provision.

Dr Oriani-Ambrosini said that the Committee had to be careful not to take away basic rights from a person found guilty of misconduct by the Regulator. It was also important not to provide for the same compliance requirements that were expected in respect of police requirements when conducting criminal investigations.

The Chairperson asked if there should not be any reference to the Enforcement Committee in this entire Chapter 10.

Ms Louw said that this was a decision that the Committee had to make. So far there was no procedure set up for the handling of complaints whilst they were with the Regulator.

The Chairperson said that there was no link between the Regulator and Enforcement Committee, although the procedure for handling complaints was provided for.

Clause 88
The Chairperson referred back to the definition of “legal adviser” and said that he was worried that it would allow for a legal adviser who did other things besides this, merely giving the odd legal opinion for which they charged. He thought that the previous definition was preferable.

Dr Oriani-Ambrosini said that the attorney-client privilege would exist even where the person was purported to be a lawyer and or they had told the client that they were a lawyer. He thought that the current legal definition was better than the one previously provided under clause 88.

The Chairperson said he preferred the following wording: “A legally qualified person, who may be in private practice, who lawfully provides a client with independent, confidential legal advice.” He pointed out that the common-law attorney and client privilege had been widened under Clause 88, which was why the previous definition was preferable. He said that it would be undesirable to have a situation where a person claimed privilege as a way of stopping information from getting out. The options should remain for decision by the full Committee.

Clause 97
The Chairperson said that orders and decisions of the Regulator should surely be done as quickly as possible.

Dr Oriani-Ambrosini said that it was likely that a data processor who was found guilty would probably at first comply with an enforcement notice, only to realise later that this was not fair, or that compliance was impossible. In such as case he believed that person should be afforded 180 days to appeal, as set out in the court in the Brummer case.

The Chairperson said that he preferred a time period of 30 days. However, he asked that both options be drafted and included.

Clause 103
Mr Du Preez said that the wording in the clause was different from that of the Commissions Act and referred the Committee to footnote 91.

The Chairperson asked what the difference was.

Mr Du Preez said that it was mostly in the style, and there was now reference to “the Regulator” as opposed to “the Commission”. The question was raised whether there should be any reference to the Enforcement Committee.

The Chairperson said that the Commissions Act was very old, and he did not have any problems with the provision.

Clause 104 and 105
The Chairperson said that he had been giving further consideration to administrative fines. They were a quick and easy process. However, he did not think that they were suitable for every situation. Those offenders who stole people’s bank account details had, in his view, committed a criminal offence and that had to be dealt with by the courts.

Dr Oriani-Ambrosini said that this would be a different type of crime, classified as theft, fraud, or racketeering as appropriate.

The Chairperson said that at the moment there were people who were selling bank account details without any law preventing them from doing so. That was the reason why an offence was being created.

Mr Du Preez said that these problems were raised at the outset by the State Law Advisers.

Ms Louw said that in the UK a person committing a first offence was given a light sentence, but for a second offence, or where the conduct was of a serious and persistent nature, then the offence was treated more seriously and carried a hefty penalty. Clauses 104 and 105 were taken from the UK legislation. The Committee had to look at the provisions holistically, so that there was synergy.

The Chairperson said that the Committee wanted people to be able to go straight to court without first having to wait for a Notice from the Regulator, informing them that their bank account details had been stolen, and were being used to deduct money for items they had allegedly purchased.

Ms Louw asked if the wording in Clause 105 could be used for Clause 104 as well.

The Chairperson said that the Committee wanted to ensure that a data processor had adequate safeguards, but provisions must be inserted to cover an employee who disseminated information relating to customers for profit. Clause 104 was too wide and would have to be narrowed down.

Ms Louw proposed that Clauses 104(2) and (3) could be deleted, but not Clause 104(1), because it would be necessary to prove that unlawfulness occurred.

The Chairperson said that Section 7 was too wide as well.

Ms Louw said that Section 7 was applicable where it related to the unique identifier.

Dr Oriani-Ambrosini said that he would have thought that this Bill applied to everyone. He thought that a five year prison sentence would be more than sufficient for the violation of a right to privacy.

The Chairperson said that where a person was a repeat offender s/he should get a ten year sentence, and the R1 million fine would not apply.

Dr Oriani-Ambrosini said that nobody wanted to be put in jail, regardless of the money that person was making.

The Chairperson asked where Mr Du Preez had got the figure of R1 million.

Mr Du Preez said that it was only a proposal at this stage.

Clause 110
The Committee decided that options one and two could be deleted.

Schedule
Dr Oriani-Ambrosini asked why the Bill could not mirror the procedure set out for disputes under the Promotion of Administration Act (PAIA).

Mr Du Preez said that PAIA disputes and the disputes under this Bill were different. PAIA disputes related to a request that had been denied to an applicant, or arose where the entity that had been ordered to make information available wished to dispute this. The disputes under this Bill were far less complex, and the question was whether such extensive provisions would be needed in this Bill for the Regulator to solve more simple matters.

The Chairperson said that a new Working Draft version 6 of the Bill would be prepared, and presented to the full Portfolio Committee. The costing on Working Draft Version 6 should be included in the presentation. There would still be a lot of political consultations that would need to be sought. The drafters need to consider more options and proposals.

The meeting was adjourned.