Protection of Personal Information Bill: Department response to submissions, Draft Implementation Plan & Costing

This premium content has been made freely available

Justice and Correctional Services

26 October 2009
Chairperson: Mr N Ramatlodi (ANC)
Share this page:

Meeting Summary

The Department briefed the Committee on its responses to the public submissions made on the Protection of Personal Information Bill and gave its comments also on the costing and the implementation plans.

The Department firstly noted that out of 410 000 entities, 60 000 had been identified by the Department. Option A was the centralised model, which would cost R35 million, and the Department recommended adoption of this model. The implementation plan was based on how the Bill stood currently. The general component, the component for the establishment for the protection of personal information regulator, the regulations and the necessary steps that needed to be taken for the implementation of the Bill were identified as the core components by the Department.

The Bill had a generic framework and would regulate the public and private sectors. The Bill sought to balance privacy with the need of the free flow of information. The Bill was based on a regulatory model and the regulator was the one who was always in control. The relevance of the EU directory was to explore how this impacted with South Africa's EU ratings. This was an alignment with international practice, however if a particular was domestically related then the Constitution would be applicable. It was imperative that all the principles were complied with during the cycle of information. The right to freedom of expression and the right to privacy were catagorised as not being absolute rights by the Department. A specific provision for whistle blowers was considerable.

The committee expressed concerned with the costing in the following areas: the rental of premises that would be used, the remuneration of the regulator and the part time adjudicators as well as the rollout phase of the implementation. The cost of the codes to be developed was an issue raised by the committee. There was no consensus by the committee on the costs.

Meeting report

 

Overview of the Costing and Implementation of the Protection of Personal Information Bill
Ms Sandra Gomm, Chief Financial Officer, Department of Justice and Constitutional Development (DOJ or the Department) informed the Committee that the entities likely to be affected by the Bill had been identified. There were 410 000 entities and 60 000 had been identified. Complaints management was highlighted as being critical. Option A, for the implementation of the Bill, was estimated to cost R35 million. The costing for adjudicators was based on the Judges’ Remuneration and Conditions of Employment Act and the costs were market related. Option A was the centralised model. Option B made provision for regional offices in the Western Cape, Eastern Cape and KwaZulu Natal. Option B was a decentralised model that would cost R41 million. Option A was recommended by the Department because it was the cheapest.

Discussion
Ms M Smuts (DA) asked how the Department had arrived at the figure of an estimated 60 000 entities out of 407 000. She noted that the IT and Research staff requirements for options A and B were the same. If notification was dispensed with altogether, she asked to what extent this would bring down costs.

Ms K Pillay, Consultant for drafting of the Bill, responded that in terms of the Companies and Intellectual property Registration Office (CIPRO) had 2.5 million registered entities. The Department had gone sector by sector and looked at industry regulators, which was how it came to the figure of 60 000. If notification was dispensed with, then there would be a decrease in costs. This would need to be re-examined. Qualified IT auditors would provide enough IT and technical support.

Mr J Jeffery (ANC) asked what was meant by “Startup in Year one” by the Department. This did not make sense, and he wondered when was the startup envisaged. He did not understand where the pricing of development came in nor could he find any reference to this. He also asked how the development of the codes of conduct had been factored in.

Ms Gomm answered that the Department was responsible for the establishment of the regulator. The startup stage of the process was based on the available budget. The implementation phase would begin on 10 September 2010. This would bring the Department closer to the time it would take to establish the regulator.

Mr Jeffery said that he still did not understand if the costs for Human Resources were based on the salaries for instance, and this was difficult to understand. Startup or Year One was being used, and he asked the Department to explain this more precisely.

Ms Gomm referred to Slide 5 as being the rollout plan for the startup year. This year covered months 1 to 12. The Department was saying that legislation would be introduced after year One. The proposal was that startup should be established in September 2010, which would mean that the R35 million for the first year would not be needed.

Mr Jeffery argued that this rendered the figure of R35 million incorrect, and the startup costs would then be less.

Ms Gomm responded that the figure was correct. Since the R35 million was not available in the budget, the Department would start with the R15 million that was in fact available in the budget in September, and continue with the rollout in the following year.

Mr L Landers (ANC) asked what the costing of the premises was based on.

Ms Pillay answered that the costing of the premises was based on rental. The proposal was for the Chairperson and other members to be housed in the Department of Justice’s buildings for the first three months.

Mr Landers responded that premises should not be rented, but rather purchased permanently.

Ms Pillay said that the costing was based on rental, since the Department was not in charge of purchasing property on a permanent basis as this was not within its scope of powers.

Mr Landers reiterated his question as to whether the Department should rent or purchase outright. He was not asking what the Department's mandate or scope of powers was. He knew that the Department was not directly responsible for purchasing property.

Mr Deon Rudman, Deputy Director General: Legislative Development, DOJ, responded that the costing was based on rental, as the purchasing would alter the costing and he was not sure if this was feasible.

Mr Jeffery asked how much it would cost to develop the codes. The salary for the Chairperson was based on the remuneration of judges, and he asked if the part time adjudicators would be paid on the same scale as Acting judges.

Mr Rudman said that the original suggestion for remuneration was that the salaries would match those of Appeal Court judges and other options.

The Chairperson asked what the other options were.

Mr Rudman responded that the remuneration of the Competition Commissioner and Director of Public Prosecutions were among the options considered.

Mr Henk Du Preez, Senior State Law Advisor, DOJ, also responded that as far as the adjudication process was concerned, there was the possibility to determine other options.

Ms Smuts said that the Department should bear in mind that there was a strong case for individual industries to develop their own codes. This would be less onerous for the Department, as the regulator would just oversee this.

Ms Gomm said that when the Department considered the possible options, it had concluded that Option A was the better option. A 'wait and see' approach would be adopted for the purposes of assessing where most of the information would be processed. The first year would be used to develop the codes. The costing was not based on cost delivery, as a decision had not yet been taken.

Mr Du Preez added that the Bill did not propose that the codes be introduced from day one. The cost recovery regulator would be acting on behalf of somebody else.

Ms Smuts responded that in the instance where the regulator wrote the codes for different sectors, then these sectors could pay for this service.

Mr Jeffery said that he was not sure why the proposal for regional offices was based on the investigative side. The cost factor could be a problem, in terms of what budget was for, and what was actually available in the budget.

Ms Gomm said that the reason for showing this was to give the Committee options.

Mr Rudman added that the A and B models were developed together but reiterated that the recommended option was Option A. The Department would then decentralise later on. This all depended on the regulator.

The Chairperson asked if there was a consensus on the costing amongst the members, but none responded on this point.

The Chairperson noted that this point would need to be taken further.

Presentation: Implementation Plan
Mr Rudman said that the implementation plan was based on how the Bill stood currently.

Mr Du Preez said that there were four important implementation components that the Department had identified. The implementation plan was based on what would happen and when.

The costing and implementation plans would be revisited. The Department would initiate steps to secure the necessary equipment. This was referred to in the costing plan. The regulator was important from the moment that the establishment was initiated. Any other appointed officers should be appointed to assist in having offices set up. The final component referred to the implementation of the Act, after which the Minister would be given due advice.

Discussion
Ms Smuts suggested that the regulator had to write the implementation plan.

Department’s Response to public submissions on the Protection of Personal Information Bill (the Bill)
Mr Du Preez apologised for the fact that the document with the Department's responses was not complete. The Department had compiled three annexures. The first dealt with various issues identified by the media. The second annexure referred to the first. The third annexure gave a brief comparison of the Bill with foreign jurisdictions, mainly those referred to by the commentators.

Ms Ananda Louw, Researcher, South African Law Reform Commission, said that the Bill was outcomes based and it had to be flexible as it applied to different sectors under different circumstances. Entities being regulated had to set up their structures accordingly. The Bill had a generic framework so as to regulate the private and public sectors. The Bill was aimed at protecting personal privacy. It sought to balance privacy with the need for the free flow of information. The Bill provided for the collection of data in a number of different ways, but it did not require for the data to be collected from the data subject personally. The Bill was based on a regulatory model. The regulatory model had a generic Act with a regulator. The regulator would always be in control. Co-regulation had a similar set up, but once the codes had been approved and the regulator was appointed, that person would not remain in control. Self regulation referred to the model where there was no regulator. Individually-specific industries had their own regulators and these adjudicators were on their own.

The relevance of the European Union (EU) directory was to explore how this impacted with South Africa's EU ratings. There was an alignment with international practice. If a particular issue was relevant domestically, then the Constitution would be referred to. The purpose of the EU directives was to ensure that legislation was compliant with the requirements that were contained in them. EU adequacy was also important. The cycle began with the collection of information, and anything could happen to that information during that cycle. This was covered in the Bill. It covered the moment the information was collected to the time that it was destroyed. There were three aspects that had to be looked at in any specific situation. The first was that the whole cycle had to be covered, from the moment of the collection of the information to its destruction. The second was that all responsible parties that could use the information from the time that it was collected up to its destruction should be covered in some or other way by the Bill. Thirdly, all eight principles must be considered throughout the cycle.

Discussion
Mr L Ndabandaba (ANC) asked how exhaustive the principles of the EU directives were.

Ms Gomm commented that different countries included different principles in their legislation that were similar to the Bill. This all depended on the domestic situation and whether or not they had a Constitution. The exceptions in the Bill were wide. The Department was trying to balance the free flow of information with the right to privacy, within the ambit of the EU directives.

Mr Jeffery referred the Committee to the document that had been prepared by the Parliamentary Research Unit that had covered the broader themes, and suggested that the committee should look at these rather than the wording of specific clauses.

Ms Smuts agreed with this approach.

Presentation: Department's Response to Summarised Issues
Mr Du Preez highlighted the Department's responses to the themes that were summarised by the Parliamentary Researchers. In regard to the definitions, the Department had taken into consideration that all eight information protection principles were applicable within the collection cycles. The Department stood down regarding juristic persons.

Ms Louw said that the Exclusions Clause provided for the exclusion of journalists. The issue of the right to freedom of expression and the right to privacy was dealt with by the Department. The Department's stance was that these were not absolute rights. The Bill sought to promote privacy and the free flow of information.

Clause 4(d) gave effect to the balancing of the two rights. Exemptions were found in first world democratic countries. The Bill did not seek to encroach on the rights of individuals. The use of 'Adequate safeguards' in the Bill was not a strange phrase. It had been interpreted by the courts and existed in many pieces of legislation. Exemptions meant that specific principles would not apply to a specific entity or sector, and applications to the regulator had to be made in this regard. Exclusions were absolute, and meant that the Bill was not applicable at all. Exceptions were qualifications that included the scope of the principles.

Ms Louw summarised that the correct reading of the principles was:

Principle 1: The responsible party (i.e. a journalist) would ensure that the principles were complied with.
Principle 2: Personal information must be obtained lawfully and in a reasonable manner.
Principle 3: Personal information must be collected for the specific lawful purposes of the collecting party  - that is, journalism. As a general rule the data subject must be made aware of this.
Principle 4: Information must be collected with due regard to the principles. This meant that journalists may only obtain information for specific purposes.
Principle 5: The responsible party should take reasonable steps to ensure that the information was accurate.
Principle 6: The responsible party must take reasonable steps to inform the regulator of his or her intention to process personal information.

These principles did not impact on the work of journalists. Exemptions would be of a general nature. Exemptions could be requested where a person was not comfortable operating within the principles of the Bill.

Self regulation dealt with the situation where a journalist was subjected to other regulations. The regulator would not interfere unless there was a complainant against a journalist. The Bill would be applicable in instances where there were already industry regulators. The Bill did not make provision for the content of standards nor what these adequately entailed. The reason for this was that there were various regulatory bodies, with their own set of standards or principles that were already within the spirit of the Bill. The common law and case law of South Africa had already covered the interpretation of 'adequate safeguards' extensively. It was however important for South Africa to comply with the EU directives.

Whistle blowers were not dealt with in exclusions. The Department could consider including a specific provision for whistle blowers. The eight principles, however, were not negotiable and there was no reason why journalists could not be subjected to them. It was important that these principles would require journalists to comply with the rest of the Bill.

Discussion
Ms Smuts commented that broadcasters had their own regulators. It was noticeable that there were engagements between South African National Editors Forum (SANEF) and the Department

Ms Louw responded that consultations were mainly in written form .The views of the media had been taken into account, and one of the objectives of the law was to ensure that new technology was also regulated. The principles and exceptions were being developed. The exceptions explained the way in which the principles were to be complied with.

The meeting was adjourned. 

Share this page: