Protection of Personal Information Bill: deliberations

Meeting report

Chapter 3 Part B
Mr Henk Du Preez, State Law Advisor, presented the proposed amendments of Chapter 3 Part B of the Protection of Personal Information Bill to the sub-committee. Part B on page 4 was an extension of Part A on page 3 of the document presented. In order to clarify the position of children, the proposal in clause 25(1) was that “A responsible party may not process the special information concerning a child who is subject to parental control in terms of the law. Clause 25(2) distinguished the position of other data subjects from children. Pages 5 to 7 contained the provisions of the Bill as introduced as well as certain proposed amendments from the last meeting with the Committee. The most important amendment was clause 26. The intention behind this amendment was to expand its ambit so that religious or philosophical groups could process the information of persons other than their members if it was necessary to achieve their aims and principles. Option 1 on page 6 was the proposed expansion of clause 26. The provisions under clause 31 have remained unchanged however a new addition to clause 31 was 31(5). Clause 31(5) was based on section 2(g)(h) of the United Kingdom Act.

Page 8 and 9 had the option that was based on the Australian Act as per the Committee’s request from the last meeting. The concern regarding this option was that there were provisions in the introduced version of Part B of the Bill that were not covered.

Clause 25  Prohibition on processing of special personal information
Ms M Smuts (DA) asked if it was correct to say that the European Union (EU) did not deal with children. The inclusion of genetic data under health in clause 25(b) warranted greater consideration. Would it be the Committee’s intention, for example, to allow insurance companies to look at individual’s genetic mapping and to assess their genetic pre-dispositions?

The Chairperson noted that insurance companies were usually approached on a voluntary basis and it was up to the individual to decide if they wanted to provide genetic information to insurance companies. Why was genetic data included under health?

Dr M Oriani-Ambrosini (IFP) said that the Bill did not deal with what could or could not be asked of a person. The Bill dealt with what data processors did with information after they obtained it from a person. There has to be one article in the Bill, which dealt with privacy. It was important to assert the right to privacy.

Ms Ananda Louw, State Law Advisor, said that genetic data could be separated from health. Genetic data could then be included under clause 30.

The Chairperson repeated his earlier question, why was genetic data included under health?

Ms C Silkstone, Content Advisor to the Committee, asked if it was not possible for genetic data to be defined.

Mr Du Preez said that there was concern to the extent that he wanted to attach genetic data to clause 30 so as to avoid unintended consequences. It may become necessary to define genetic data. There was a definition of “biometric” under clause 1.

The Chairperson asked for the difference between genetic information and DNA analysis.

Ms Louw replied that “biometric” was defined as a technique for the personal identification of a person based on physical characteristics including fingerprinting, DNA analysis, retinal scanning and voice recognition. DNA analysis included genetics.

The Chairperson said that the question would be should genetic data not be considered a category on its own because it had different usages. This issue warranted further consideration and international comparisons had to be looked at as well.

Ms Louw added that the Australian Law Reform Commission had done a very comprehensive investigation on this subject matter.

The Chairperson clarified the Committee’s position by saying that it was not content with genetic data being included under health because it felt that it was wider.

Dr Oriani-Ambrosini said that he did not understand clause 25A(g) and why it was different from the previous clause.

Mr Du Preez replied that the purpose was for there to be more clarity. However it was not a deviation from the previous position.

Dr Oriani-Ambrosini referred to clause 25A(f) and said that the definition of ‘processing’ included the collection, storage and maintenance of information. Information that was not needed had to be destroyed. Those involved in research work ordinarily did not know what information was needed nor what the outcome would be during a research exercise. Clause 25A(f) was not conducive to academic research. This has a chilling effect on the academic freedom and freedom of thought and research.

The Chairperson asked Dr Oriani-Ambrosini if the requirements were that onerous. The requirements under (f)(i)-(iv) did not seem very onerous.

Dr Oriani-Ambrosini made reference to genealogy and the fact that parishes kept an incredible amount of personal information as a result.  Where did one draw the distinction between history and freedom of research, opinion and accessing the personal information of data subjects? It was preferable to exempt an organisation as opposed to the purpose. There, exemption of entities should be considered.

Ms Louw mentioned that the clause came directly from the Netherlands Act. It would not be favourable to exempt entities, as the Bill would be outdated by the fact that new ones would be formed all the time.

Dr Oriani-Ambrosini asked if it would be possible to replace the “and” with a “or” in the clause.

Ms Smuts replied that the suggestion would mean that data subjects would be adversely affected.

Dr Oriani-Ambrosini said that if an individual were the subject of historical or scientific research, their interests would be overridden by the greater purpose of scientific or historical research.

The Chairperson said that the matter was a political question and replacing “and” with “or” would render the clause to be too wide. It was not asking too much to allow an individual to conduct research and then ensure that adequate safeguards were met to protect data subjects. The issue would be that should there not be a specific section on research as opposed to having a clause.

Ms Louw responded that it would not be a problem to have a separate section. Section 8(4) of the EU Directive held that exemptions could be allowed subject to adequate safeguards.

Ms Smuts agreed with there being a dedicated clause for research.

Dr Oriani-Ambrosini said that he cringed at the thought that what would be in the public interest would be pre-determined and not up to individuals to decide for themselves. Legislation that bestowed upon the Regulator the power to decide what would be in the public interest was not favourable.

The Chairperson summarised that the Committee wanted a separate section on research. Once the clause was drafted the debate could be revisited.

Clause 25A
Mr Du Preez explained that the proposal was that children’s information may only be processed with the consent of a parent. Clause 25A(g) referred to data subjects who were not children.

Dr Oriani-Ambrosini said that there were a number of cases in Europe that had established privacy for teenagers even from their parents. In many instances, such as politics or religion, the child need not consent with the parent.

The Chairperson said that the Bill dealt with the processing of information of a child where the parent’s consent was not present. The Bill did not impact on the privacy of a child.

Ms Louw suggested that there perhaps had to be a definition of parental control. There was no age limitation included in the clause because for example in abortion cases it would not have made sense to require the parents consent for the child’s information to be processed but not for the abortion.

Dr Oriani-Ambrosini responded that it was not practical to allow teenagers to choose which religious or political affiliation they wanted to be part of - yet they needed the consent of their parents for their information to be processed before doing so.

Mr Du Preez contemplated a situation where there was an applicable age limit and asked if there should be an age limit across the board, if such an age limit should be attached to other legal competencies, for example, contractual obligations. It would be extremely difficult to draw a differentiation where age and contractual obligations were concerned.

Dr Oriani-Ambrosini said that one could not prevent teenagers from sharing personal information. Teenagers were socially and economically active as they purchased goods and answered all sorts of questionnaires. The notion of parental control had limits to it and a parent did not have a right to know everything and a teenager had a right to enforce his/her privacy.

The Chairperson said that no one was talking about the right of parents to obtain information from their teenagers; this was not what the Bill was about. The desired intention was to protect children from unscrupulous third parties trying to solicit and process information. The effect of this prohibition was not to create a crime. There had to be protection afforded to children however this was not to prevent them from releasing information but to prevent third parties from processing that information. The concerns for this section were that the intention and the wording thereof were not the same. There was also a huge lacuna for children who were not subject to parental control of whom there were many in South Africa. This meant that these children were left out and not protected by the Bill.

Ms Louw pointed out that the point made by the Chairperson was a good one. It should be recalled that there were exemptions insofar as household activities were concerned. Furthermore the Act would only be applicable to records that were automated and being in the process of being automated.

 Dr Oriani-Ambrosini said that as the Bill stood, for example, if a child wanted to open a Facebook account and provided his/her own information, the parent had to open the account.

The Chairperson said that this was a valid point and asked how the issue would be dealt with.

Ms Louw said that America had specific legislation that dealt with social network groups like Facebook. South Africa was at the forefront by including children specifically in the Bill whereas in the legislation of other countries they were referred to as data subjects. The rest of the world was moving towards this position of including and protecting children specifically.

The Chairperson said that one would not want a situation where Facebook refused to allow seventeen year olds to open accounts as a result of this law. This would be an unintended consequence. There could be a blanket exclusion and then the Regulator could be empowered to exempt certain categories for children.

Ms Louw mentioned that in Canada there had been instances where Facebook was taken to court so they were aware of what the rules were where data protection was concerned.

Mr Du Preez said that Facebook had a problem with their privacy policies.

Clause 26
The Chairperson said that children who were not subject to parental control had to be provided for in the Bill. The Chairperson pointed out that under clause 26 the only changes were that “provided” was removed and 23(1)(ii) was added.

Ms Smuts said that she was content with the changes.

Mr Du Preez highlighted that it might be useful to include cultural information under clause 26 so as to align it to section 31 of the Constitution.

Dr Oriani-Ambrosini agreed with Mr Du Preez and questioned why religious organisations always had preference in many instances.

Ms Smuts pointed out that the point of departure of the Bill was sensitive information. Was cultural information such a sensitive issue for individuals? What was so sensitive about cultural information?

Ms Louw said that it should be remembered that there was an exemption because there was a prohibition. Ethnicity was the part of culture that was sensitive and this was a problem in South Africa.

The Chairperson addressed the point made by Dr Oriani-Ambrosini and said that the purpose of the exemption for religious bodies was to enable them to increase their membership and therefore continue to exist, whilst keeping a database of people they had been in contact with for purposes of recruiting them. The issue was would religious organisations be able to process the information of their members other then their beliefs.

Ms Smuts replied that she thought not.

The Chairperson said that ethnicity would be sensitive as in our legal context the concern was for race and not ethnicity.

Ms Smuts differed with this position and referred to the Constitution, which included ethnicity in a number of sections including the section on equality. 

The Chairperson commented that there would be aspects of culture that would be personal.

Clause 27
Mr Du Preez pointed out that the “and” at the end of clause 27(a) meant that it should be read conjunctively with clause 27(b). This section was also included in the Netherlands Act.

Clause 28
Ms Smuts said that she never understood why trade union membership had to be protected but it was in every other law.

Clause 29
Mr Du Preez explained the options that had been made available.

Mr Du Preez referred to Option 1 on page 6 and explained that during the drafting of the Bill the Constitution had been consulted. The Department could come up with something similar to what had been done with religion. The option had covered a lot and it would rein in all the political parties of South Africa.

The Chairperson was worried about a scenario where a Non-Governmental Organisation (NGO) was campaigning around a social issue and it wanted to recruit members, would it be covered since only political parties were mentioned?

Dr Oriani-Ambrosini said that the political process was not restricted to political parties only. The Committee had to look at the purpose. If the purpose was for exercising political rights then an entity that carried and embodied a political purpose should be exempted.

Ms Smuts said that the clause expressed political rights as well.

Dr Oriani-Ambrosini said that the Committee had to go back to the purpose of the Bill which was to exempt the purpose but not the entity.

The Chairperson said that one did not want the clause to allow entities to collect information other than for political purposes. One needed a narrow definition of political persuasion not a broad one.

Ms Louw said that the clause should be read with the general exemption in mind, which was that “processing was necessary for the establishment, exercise or defence of a right or obligation in law”.

Ms Smuts requested a change under clause 29(b)(ii). Political parties also recruited supporters or voters and this should also be added. Article 36 of the EU Directive catered for this.

The Chairperson suggested that the clause should remain as it was but there should be an inclusion to allow political parties to canvass for support.

Mr Du Preez agreed with the proposals and added that the Department felt strongly that clause 29(b)(ii)(cc) should remain.

The Chairperson asked if clause 29 (b)(iii) was not too wide.

Ms Louw replied that this clause was already dealt with in clause 25(c) on page 4.

The Chairperson asked if clause 29 (b)(iii) was necessary and requested that the Department should look at doing away with it.

Clause 30
Ms Smuts said that genetic data should not be included under the exemption.

Dr Oriani-Ambrosini referred to clause 30(c) and said that his concern was the protection of privacy.

The Chairperson asked if the concern was for the whole of clause 30(c) or just sexual life.

Dr Oriani-Ambrosini replied that it was mostly sexual life. It was not clear what the special arrangement that was connected to sexual life was all about in the clause.

The Chairperson agreed and said that he understood the special arrangements that would be made as a result of health, for example, in the instance of epileptic children.

Mr Du Preez replied that a school might want to know how many pupils were sexually active and a special class may be offered.

Dr Oriani-Ambrosini said that this was exactly what terrified him. This was an incredible violation of a teenager’s rights.

The Chairperson agreed with Dr Oriani-Ambrosini and suggested that clause 30(c) could be included under clause 25.

Ms Louw said that the Bill stipulated that a person to whom personal information was disclosed was subject to a confidentiality clause. HIV/AIDS information could be relevant under this clause.

The Chairperson said that nobody had a problem with records being kept for health purposes. The issue was why was there a need for special arrangements to be made for pupils as a result of their sexual life. There is a possibility of unforeseen and unpleasant consequences for children as a result of clause 30(c).

Dr Oriani-Ambrosini said that the Bill had to have a statutory provision on the right to privacy. It was important to indicate to South African citizens when they could enforce their privacy rights.

Ms Smuts said that she had requested that there should be a chapter on the privacy rights of data subjects and that it should be right at the front of the Act. The purpose of the Bill was privacy in the computer age.

Ms Louw cautioned that having such a section at the front would replicate what was already in the Bill. One should not think that the right to privacy could be equated with the right to the protection of information.

Dr Oriani-Ambrosini said that what he was suggesting was a simple statement that read as follows; “Unless authorised under the law or objective necessary for the completion of the transaction concerned, no one should be required to provide or disclose personal information as a condition for the completion of the transaction or the receipt of a benefit, irrespective of whether such information is used or meant to be used for trade or commerce or the public domain”. One should not be asked for their sexual orientation as a pre-condition for going to school.

The Chairperson said that the provision by Dr Oriani-Ambrosini was very wide.

Ms Louw said that the Bill went one stop further than what Dr Oriani-Ambrosini was talking about. It was not about protecting the privacy of persons in the sense that you could or could not ask certain things but rather once you had asked the information from them, what did you do with it. The Bill did not have that many sections that dealt with the collection of information.

Dr Oriani-Ambrosini stressed that he was aware of what Ms Louw had said. The Bill was not clear and based on prior jurisprudence, statutory provisions or clear constitutional provisions and interpretations.

Mr Du Preez said that the Committee had to instruct the Department. The Department could not say that a proposal from the Committee was wrong or right.

Option Based on Australian Act
The Chairperson moved on to the Australian Option on page 8 and requested that it should be kept as an option.

Mr Du Preez agreed and said that there were provisions that were not in this option that the Committee should consider. The Department recommended that they should be inserted. The provisions were clause 25A(c), 25A(d), 25A(e) and 25A(f)(ii). The others were a portion of clause 26 (1)(b), 26(2), clause 27, part of clause 28(1) and 29(1) and clause 31(b) to 31(f). The final provisions were clause 30(4) to clause 30(6) and the whole of clause 31.
 
The Chairperson said that the Sub-Committee would meet on Friday 4 June for the whole day and Saturday morning 5 June 2010 to finalise the Bill.

The meeting was adjourned.