Protection of Personal Information Bill [B9-2009] sixth working draft: technical sub-committee deliberations

Meeting report

Introduction
The meeting's purpose was to consider the Sixth Working Draft of the Protection of Information Bill [B9-2009] dated 27 January 2012 in readiness for presentation to the full Portfolio Committee, and, in conclusion, to discuss briefly the full Committee's process for handling the final draft.

The Chairperson ensured that all present, including observers, had copies of the Sixth Working Draft.

Drafting team's note on technical sub-committee's proposed amendments
Mr Henk du Preez, Senior State Law Advisor, Department of Justice and Constitutional Development, introduced the drafting team's note, which was additional to the Sixth Working Draft. This note included the team's questions that had arisen during its preparation of the draft. He asked if he should first start with the issues identified or take the Working Draft itself clause-by-clause and discuss the identified issues as they arose.

The Chairperson replied that the identified issues were present in the Working Draft. These issues were children, artistic expression, special personal information, authorisation by the Regulator, the amendments to the Promotion of Access to Information Act (No. 2 of 2000) (PAIA), and costing. He suggested dealing with them as the sub-committee went through the Working Draft.

European Commission's Draft Regulation to replace the existing European Union (EU) Directive
Mr Du Preez introduced one more preliminary – a document (already circulated) from Mr Mark Heyink, Attorney, Consultant and Director, Information Governance Consulting, reflecting the European Commission's Draft Regulation to replace the existing European Union (EU) Directive. The State Law Advisors had had the opportunity to study this document and so were in a position to offer the technical sub-committee a comparison and indicate some 34 additional or new matters included in the draft regulation. He expected discussion more in the form of 'panel beating' rather than finding lacunae [gaps] in South Africa's draft legislation as compared to Europe's Draft Regulation, which, he emphasised, was still subject to a process of consultation. Therefore, if Members wanted to borrow from that Draft Regulation, they should exercise caution. The State Law Advisors had considered whether the Draft Regulation could add value to South Africa's draft legislation. If the meeting afforded insufficient time, Mr Du Preez offered to prepare a brief note. He had brought three copies of the Draft Regulation for the sub-committee (see relevant document).

The Chairperson asked if Mr Du Preez had anything in writing on areas in the Bill that he felt should be examined, or if he intended an oral briefing.

Mr Du Preez planned to explain the Draft Regulation and highlight those aspects which Members might wish to consider including in the Seventh Working Draft. There was no formal note at this stage.

The Chairperson had reviewed the Draft Regulation but was worried that there would be more material for the technical sub-committee to examine and that it would have to go back to the beginning again rather than complete the Working Draft for the full Portfolio Committee. There were two options – a separate presentation when the sub-committee reported to the full Portfolio Committee, or propose changes in the National Council of Provinces (NCOP) because by then there might be greater clarity on the status of the EU Draft Regulation.

Dr M Oriani-Ambrosini (IFP) gave Members a sense of what had changed or was about to change in European thinking. This entire process had begun a long time ago on the basis of South Africa having to place itself in compliance with the new European regulations under pain of not receiving transfer of information necessary for the 2010 FIFA World Cup. So South Africa had taken the EU Directive as a blue print, and not just the text of it but the experience that underpinned the Directive. The technical sub-committee should present to the full Portfolio Committee any variation thence that the technical sub-committee felt necessary. It would be unfair to pass this responsibility to the full Portfolio Committee or to the NCOP. It would equally be unfair for Members to close their eyes if there were problems ahead. It was the job of Members, if there were new information, to apply their minds to it. He himself wanted to know what it was before deciding not to take it into account.

Ms D Smuts (DA) saw two choices: either ask the State Law Advisors at the end of the day's work to give a short oral briefing; alternatively, as Members went through the Working Draft, clause-by-clause, there was no reason why the State Law Advisors could not raise the European variations at the relevant clause. What remained could be presented briefly and orally at the end.

The Chairperson saw little sense in doing it at the end, when Members would have completed their work. It would be better to do it at the beginning or as Members deliberated clause-by-clause on the Working Draft. He preferred an overview now together with Ms Smuts' suggestion, in so far as she suggested raising the European variations at the relevant clause. He asked Mr Du Preez how long it would take to give an overview.

Mr Du Preez had not prepared for an overview, but rather to go through the Draft Regulation itself. To do so would take at least two hours.

The Chairperson asked him to take Members through the Draft Regulation.

Dr Oriani-Ambrosi thought that the fastest way would be for Members to scan the Draft Regulation by themselves and then decide what to do with it.

Mr Du Preez offered to give a brief introduction, starting from the existing EU Directive and up to the EU Draft Regulation.

Ms Ananda Louw, Principal State Law advisor, South African Law Reform Commission, said that the EU Directive was old, having come into effect in 1995. In 2007 there was a similar process to re-examine the EU Directive, but it had been decided to change nothing, because the core principles were still in order. However, in 2010, it was decided to look into the EU Directive again, in view of all the changed circumstances presented by the social networks and new technologies that the original Directive had not anticipated. However, the basic principles remained unchanged. A new directive was not proposed, but rather a regulation. The difference was that a directive would be implemented in national law, whereas a regulation would be directly applicable. As such the regulation would be almost like an EU law applicable to all countries in the Union. This was the most controversial aspect. Germany was concerned that it would have to give up its own laws, which it considered of a higher standard than those of the Draft Regulation. Thus, for Germany, the Draft Regulation might be a constitutional issue. The content was less an issue than the level at which the Draft Regulation was pitched. As the Directive was so old, there had been numerous developments since its coming into effect in 1995, which South Africa had already accommodated in its draft legislation. As a result, South Africa's existing draft legislation was not so far behind the Draft Regulation, for example, the question of children, explicit consent, reporting of data breaches, privacy impact assessments, specific provision for accountability, and the inclusion and definition of biometrics. South Africa was already well-advanced in those areas. South Africa had also taken into consideration the Organisation of Economic Development (OECD)'s principles and other countries' interpretations. Also, some of the aspects of the Draft Regulation that were important to other countries were not important to South Africa, for example, the scope of application of existing mechanisms, which really dealt with the horizontal arrangements between countries. It was also important to realise that President Barack Obama of the United States of America (USA) had in March 2012 'published a consumer bill of data protection'. This was a bill of rights that the government of the USA wanted to include in its legislation. The USA already had legislation for data protection in the public sector, but in the private sector had only sectoral legislation. The idea was a specific bill to deal with all the loopholes. A move was therefore expected towards a harmonisation of US law and EU law. It was important to take note of these developments. It was likely that the new US legislation and the EU Draft Regulation would come into effect in 2014 or 2015, which would be at about the same time as South Africa's Bill would be enacted. It would be a pity if South Africa were to lag behind. In many instances, the Draft Regulation would simply 'add value' to the Working Draft, rather than suggest anything controversial or totally different from the Working Draft, because the core principles were the same.

Mr Du Preez would start with Clause 1.

Ms Louw added that the State Law Advisors had taken into account comments already received on the Draft Regulation. These included the comments of the Information Commission (ICO) of the United Kingdom (UK). The UK government had asked for comments and would submit its reply only on 04 June 2012. It was important to note that the European Data Protection Supervisor, who was in charge of all the supervisors in the EU, had also submitted a substantial comment. Various firms of attorneys had also submitted comments. The State Law Advisors had not sought to adapt from the Draft Regulation any provision that appeared to be controversial and unlikely to remain in the final version of the Regulation.

Dr Oriani-Ambrosini asked what the envisaged timeframe for the adoption of the Draft Regulation was.

Mr Du Preez replied that this was the first question that the State Law Advisors had asked themselves. It all depended on the legislative process. The European Commission had held extensive consultations in 2010 and 2011. Though the Draft Regulation document was marked 'final draft', the European Commission was still receiving fairly substantial comments from member countries as well as from the information commissioners. It was extremely difficult to assess the timeframe.

Ms Louw added that the European Commission wanted to finish the Draft Regulation in 2013 but many were saying that it could not be finished until 2014. Thereafter it would be two years before implementation. Some had said that data privacy was not a new issue or a controversial one and that the Draft Regulation should be implemented immediately.

The Chairperson found the finalisation date rather than the implementation date of greater importance. Members should take note of the Draft Regulation's proposals but bear in mind that they were merely proposals.

Ms Louw said that the awaited Article 59 Working Party would be regarded as the submission from the European Parliament. The previous consultations had been with outside bodies and persons, but now consultations were fairly advanced and within the EU structures themselves. She emphasised that the State Law Advisors would include only items that would be of value for South Africa.

Mr Mark Heyink, Attorney, Consultant and Director, Information Governance Consulting, agreed with Ms Louw that some items in the Draft Regulation added value and that there was no need to change South Africa's documentation at all. Last week the Federal Trade Commission (FTC) in the USA published its document on protecting consumer privacy in an era of rapid change. Essentially part of what the FTC was examining was essentially to lobby the US government to have a general law of application. The FTC really performed the role of a regulator in the same way that the commissioner did in the UK. For him one of the most important things was that the sooner South Africa enacted its proposed legislation and the proposed Regulator properly working, the better South Africa would be able to deal with these issues, which were ever changing. What Members had before them [in the form of the Working Draft] might not be perfect but was very good in relation to the rest of the world. It was more important to enact this legislation as quickly as possible and start creating the expertise and skills to administer and assist the protection of personal information. The document from the FTC was replete with provisions on the necessity to work together with business on the tracking of information – for example, Google and Facebook. This was a new concept that South Africa had not addressed. It concerned how tracking should be governed and developed by different technologies and processes. This was something for which it was not easy to legislate. It was therefore necessary to create the capability to be able to regulate that as and when necessary. Many of the principles in the European framework went into greater depth on the problems that one witnessed in the information age – for the policing, enforcement, and recognition of the necessity for cooperation and the harmonisation of law to become a reality. The proposed Regulator would hopefully deal with that on an ongoing basis.

The Chairperson thought it best not to have a briefing on the Draft Regulation but instead to study the Working Draft clause-by-clause. Where the State Law Advisors had noted relevant issues, they should draw Members' attention to them. There were rapid developments. The African Union (AU) model law would have more impact on South Africa's draft legislation. If the AU model law were to be completed in the next month or so Members might require a briefing on it.

Dr Oriani-Ambrosini commended the Draft Regulation as a law that South Africa should, in essence, adopt. However, it was necessary for Members to apply their minds to it. Mr Heyink's proposal, to enact the draft legislation as soon as possible and let the Regulator guide Members on how to amend the resulting Act on a ongoing basis, was a clever way of passing the buck. He agreed with the Chairperson's ruling but wanted time to digest the Draft Regulation, because if that was to be the centre of gravity of the technical sub-committee's progress, and if the USA was going to do something similar, Members would be ill-advised to adopt yesterday's technology rather than tomorrow's.

Ms Smuts said that it was an unfair reflection on Mr Heyink to suggest that he was passing the buck. On the contrary, Mr Heyink was saying that one should establish the Regulator, and what regulators did was to regulate. Regulators were rule-making bodies and made subordinate legislation. Regulators were more ready to respond to developments with more alacrity than legislators, who were 'slow beasts'.

Sixth Working Draft oral briefing, clause-by-clause
Preamble
Ms Smuts objected to the formula 'Parliament of the Republic of South Africa therefore enacts as follows'.

The Chairperson said that this wording was not a mistake. The formula 'Be it enacted by the Parliament of the Republic of South Africa …' was archaic.

Ms Smuts disagreed. The new formula was utterly wrong.

Mr Du Preez mentioned that the State Law Advisors' view was that it was purely a technical matter but it was something that they had not yet had the time to check. He would consult on the matter but he was sure that at the present stage the drafting team was following the usual formula.

The Chairperson confirmed that Members were looking at the Working Draft for presentation to the full Portfolio Committee. Members would work through the Working Draft page-by-page.

Clause 1
Biometric (see personal information (d), Working Draft, page 9)
Mr Du Preez referred to the Draft Regulation (Article 4, definition 11, page 42). There was a slight change in the definition of 'biometric' which, at this stage, Members could merely note as a value-adding issue identified. It was then a question of distinguishing between 'physical', 'physiological' and 'behavioural' patterns or aspects and whether these words should be included in the Working Draft.

Ms Smuts asked if Mr Du Preez was serious about 'behavioural'.

The Chairperson asked from where the definition of 'biometric' had come.

Mr Du Preez doubted the necessity of debating it. The drafting team had merely highlighted it not as an amendment but as something that could add value.

The Chairperson asked Dr Oriani-Ambrosini what he wanted to include.

 Dr Oriani-Ambrosini wanted to include 'behavioural characteristics'.

The Chairperson asked what the impact of that was. He asked where the Bill referred to 'biometric'.

Dr Oriani-Ambrosini said that it was in the definitions.

The Chairperson knew it was in the definitions; he wanted to know in which Clause or Clauses of the Bill itself the term was referred to.

Dr Oriani-Ambrosini then asked why there was a list of definitions.

The Chairperson again asked in which Clause or Clauses the term was referred to.

Mr Du Preez said that, if his memory served him correctly, one was talking about 'special personal information'.

Dr Oriani-Ambrosini said that the only relevant definition was under personal information (d), Working Draft, page 9.

Mr Du Preez said that this was one of those definitions that assisted in defining another term.

Dr Oriani-Ambrosini said that it fell in the basket of what was protected under personal information.

The Chairperson inferred the 'biometrics' as defined in terms of the Bill was under personal information (d), Working Draft, page 9.

Dr Oriani-Ambrosini said that one would simply be adding another element to the basket of things that one wished to protect, since 'biometrics' was today's technology, whereby cameras could identify people walking past them.

 The Chairperson said that what he had found was under 'd' – the blood type or any other biometric information about a person (personal information (d), Working Draft, page 9.) He asked that Members and other participants follow normal meeting rules and not interrupt another person while he or she was speaking. The Bill's definition of 'biometric' was based on physical characteristics. The EU's definition was much wider – physical, physiological and behavioural characteristics. That wider definition would not fit into (d). Members would have to consider that. He was worried that simply following Dr Oriani-Ambrosini's proposal of an option to include it would result in 'a tacky add-on'.

Ms Smuts agreed. This brought one back to the reason why Members had been unhappy with that definition, since that definition referred to a technique of personal identification which moved it right away from the contents of the definition of personal information. That definition was concerned with the blood group or other biometric information, not the technique of identification.

Dr Oriani-Ambrosini was not sure about the technique, since the technique went back to what the technique was based on, namely the physical characteristics. He argued that all that was required was simply to add 'physical or behavioural characteristics'. It would then become part of the basket of what was being protected. Then everything 'tuned into' a technique. Two words would solve the problem and he did not want Members and participants to spend too much time thinking about it.

 The Chairperson thought that (d) should become 'biometric information'. This was on personal information (d), Working Draft, page 9. Then there would be more scope to play with the definition. The drafting team would then need to make sure that 'blood type' was included in the definition of 'biometric'. Then (d) could be this broader EU type definition. The drafting team could show the result of their changes to the full Portfolio Committee.

Blocking
Mr Du Preez said that the EU was moving in the direction of omitting the definition of 'blocking' in favour of referring to restriction in Article 17(4), (5) and (6) of the Draft Regulation, page 52. Mr Du Preez would return to this issue when he reached Clause 14 of the Bill.

Dr Oriani-Ambrosini recollected from law school the old British definition of privacy as the right to be left alone. Here it was headed 'the right to be forgotten'. It was important for the Bill, which already included the right of privacy, to include in that right the right to be forgotten. One now lived in a world in which the ordinary lapse of memory which had allowed privacy to be reinstated was no longer effective since personal information was still available after 20 years on Google, as if the events in question had happened yesterday.

Ms Louw thought that the Draft Regulation, Article 17, dealt with different issues. What Mr Du Preez had referred to was the restriction. The technical sub-committee had only included the definition of 'blocking' in this Sixth Working Draft. The EU had now included that extensively whereas the Bill now just included a definition of 'blocking' which could easily be changed to 'restriction of information'. However, the first part of the Draft Regulation, Article 17, was 'the right to be forgotten'. The technical sub-committee had already examined it, and, although it was an attractive idea, Draft Regulation, Article 17 (1) (a) and (c ) were already present in the Bill. However, Article 17(1) (d) where the data subject withdrew consent was not included. However, from comments received, that might be a problem as far as information legislation – the Promotion of Access to Information Act (No. 2 of 2000) (PAIA) was concerned. On the basis of this concern, the drafting team was not including Article 17 (1) (d).

The Chairperson inferred that 'blocking' would stay as it was with the two options.

Child
Dr Oriani-Ambrosini interrogated the provisions for children (page 7).

Mr Du Preez pointed out that the drafting team had, in view of the technical sub-committee's previous instructions, proposed an amendment to that definition, with regard to the information on children being dealt with in the paragraph on special personal information. Some of the conditions referred to the requirement for consent. This was why the definition of 'child' had to be brought back into Clause 1, because one was going to refer in those relevant clauses to competent persons consenting on behalf of children, so in that proposed amendment one had a reference to a competent person; the drafting team had also proposed that the definition of competent person should also be included in Clause 1. Mr Du Preez would not give too much detail at this stage, but just wanted to highlight the change. It was also included in the Note given to the Members (see paragraph 2.1.1).

Dr Oriani-Ambrosini had not yet had the time to read it carefully. He referred to the Draft Regulation, Article 8. What happened, in terms of the Draft Regulation, between ages 13 and 18. Could a child above the age of 13 give consent?

Mr Du Preez replied in the affirmative. There was a saving clause in that Article that this definition did not affect the existing law to a certain extent, the law of contract, for example (see Draft Regulation, Article 8 (2). A similar approach had been followed in the United States of America's Children's Online Privacy Protection Act 1998 (COPPA).

Ms Louw gave more detail. However, the technical sub-committee had recommended 18 years, with provisions for approaching the Regulator for exceptions. The UK Information Commissioner had criticised the Draft Regulation, Article 8, for the same reasons that the technical sub-committee had criticised it. The drafting team thought the Bill's present position was appropriate.

Dr Oriani-Ambrosini's question was much simpler: what happened between ages 13 and 18?

Ms Louw replied that Dr Oriani-Ambrosini was correct in his inference – that information on a child could, under particular conditions, be processed without the consent of a parent or guardian. This was how the EU had decided to handle it, but the technical sub-committee had not wanted to follow this approach. The position in COPPA and in the Bill was that a child was a child until the age of 18. In principle, the consent of a parent or guardian was required. However, in COPPA, there was to be a law for children aged 13 or younger. So COPPA dealt only with children aged 13 or younger, though the age of majority in the USA was 18 years. There was thus a grey area between 13 and 18, but there was no legislation which prohibited the processing of information, but one would not be able to instigate civil proceedings against the child because that child was under the age of 18 years.
This was exactly the criticism levelled at this Draft Regulation – that it left a grey area in respect of children between 13 and 18 years.

Mr Du Preez read from the FTC report published the previous week. He noted a complete change in attitude because of the above-mentioned difficulties. He could not offer Members a solution at this stage, but there was a recognition that the age of 13 was too low and that there was need for additional protection for children until they reached the age of majority.

The Chairperson did not want to spend a long time on something that Members had already discussed extensively previously and that would require a meeting of the full Portfolio Committee to finalise. There were two options on the table: Dr Oriani-Ambrosini's option of a child being a child aged 12 or under; or, the present amendment, under which a child was defined as a person aged 17 years or under.

Mr Du Preez said that the separate Clauses 11, 12, 14, 15, 18 and 34 related to the requirement for consent. Strictly speaking they were consequential clauses as a result of the reintroduction of, or the extension of the definition of 'child' in Clause 1 as requested by Dr Oriani-Ambrosini.

'Competent person'
Mr Du Preez said that this definition was new.

'Data bank'
Mr Du Preez said that this definition was also an option proposed by Dr Oriani-Ambrosini.

'Data subject'
Ms Louw said that this would be included in the Bill under personal data. The EU Draft Regulation's approach was thus the opposite of the Bill's. It was important to note that the Draft Regulation included as personal data an identification number, location data or on-line identifier. That would therefore include one's IP address for one's mobile telephone or laptop computer. It was also included in the proposed USA bill of rights.

The Chairperson inferred that 'data subject' would have the same meaning in South Africa's Bill and the drafting team would put it under personal information. He suggested keeping 'c' as it was and adding a 'section'.

Dr Oriani-Ambrosini asked if one should add 'physiological' to personal information under 'a'. He thought that 'physical' referred to the way a person looked, and 'physiological' to the way a person functioned. These were specific factors. He just wanted to point it out. It was not worth spending a great deal of time.

The Chairperson inferred that Members wanted on-line identifier to be included.

Mr Du Preez replied to Dr Oriani-Ambrosini that the Bill also had (d) which dealt with the biometric information. The drafting team would examine the amendment on the definition of filing system.

The Chairperson noted that the drafting team had Dr Oriani-Ambrosini's options for personal information.

Dr Oriani-Ambrosini pointed out that his were two, in fact three, different options.

'Filing system'
Mr Du Preez said that there was a move in the African Union (AU) to promote a data protection convention in which there was a recommendation to include 'whether centralised, decentralised or dispersed on a functional or geographical basis'. He proposed that these words be added to the Bill's definition.

The Chairperson agreed.



'Information notice' (Working Draft, page 8)
Mr Du Preez recalled Ms Smuts comment that the definition of 'information notice' should be retained in Clause 1. There was a technical explanation for its omission. It was not used until Clause 95, in which it was fully explained, hence the definition was redundant.

'Information officer'
Mr Du Preez highlighted footnote 10, Working Draft, page 8. PAIA provided sufficient clarity on who these people were in relation to private bodies. Dr Oriani-Ambrosini's proposal on this definition would not take the matter much further. Mr Du Preez referred extensively to PAIA.

The Chairperson moved that this option be taken out.

'Processing'
Mr Du Preez said that there was now an express exclusion of blocked information (Working Draft, page 10).
 
'Unique identifier'
Dr Oriani-Ambrosini asked if this term was used anywhere except in Clause 39(1)(b) (vii) and Clause 62(1)(a).

The Chairperson replied that it was used in Clauses 108 and 109.

Clause 2
Mr Du Preez explained that the option had now been included.

Clause 3
Mr Du Preez said that the drafting team wished to point out that Clause 3(1)(b)(i) was an option originally proposed by the Chairperson and by Dr Oriani-Ambrosini though it was not indicated as such. There was not much debate on jurisdiction especially in relation to electronic networks. He was not sure if it was necessary to include it as an option or as an amendment.

There was the addition of the 'automated means'. (Clause 3(4)).

Dr Oriani-Ambrosini asked if the scope of regulation would be determined by the Regulator.

Mr Du Preez replied that the scope would most probably not be determined by the Regulator, but possibly by other conventions.

Mr Heyink sought elaboration on the insertion of 'and the information is processed in the Republic' in Clause 3(1)(b)(i).

Mr Du Preez explained inaudibly.

Ms Louw explained at length that jurisdiction in cloud computing was a problem.

Mr Du Preez offered to draft suitable wording.

Clause 4
Dr Oriani-Ambrosini said that the drafting team had not considered the right to be forgotten. The Bill included the right not to be profiled only by way of amendment in respect of consumer preferences.

Clause 5
Mr Du Preez said that this was a consequential clause.

Clause 6
Mr Du Preez referred to the Note, paragraph 2.1.2., pages 1-2, and pages 4-8, with especial reference to page 8. The two proposals on page 8 aimed to achieve one and the same thing.

The Chairperson asked if there was anything in the Draft Regulation on this aspect.

Ms Louw replied that the EU Directive confirmed that there should not be a blanket derogation. The Draft Regulation proposed no change. (See Draft Regulation, Article 80, page 94).

Dr Oriani-Ambrosini thought that uplifting things from a Directive into South African law might be problematic with respect to interpretation.

Mr Du Preez said that the drafting team was certainly not doing that.

Dr Oriani-Ambrosini said that an ordinary citizen would wonder what on earth this meant – whether it was necessary for the freedom of expression.

The Chairperson thought that the Regulator would adjudicate in case of disputes.

Ms Louw said that in the first instance the responsible party would take the decision and in case of dispute the Regulator would adjudicate, and finally the courts.

The Chairperson said that the Bill's intention was that the Regulator would adjudicate on implementation.

Ms Smuts objected that one could not contemplate such a thing. If there was prior restraint there was censorship. One could not put a regulatory body in judgement of the fruits of the works of writers and artists. Literature and art meant something and were not just scribbling that someone posted on line, or in a pamphlet or ordinary 'bookie'. 'Literature means literature'. The ordinary definition would refer to what everyone understood literature to be as well as pamphlets. However, pamphlets were not what we were talking about. When talking about literature and art one was talking about the serious exploratory artistic material. Content was sacrosanct under 'Section 16'. One did not allow a body like a regulator to inspect what someone had done, especially not ex ante and certainly not ex post. South Africa's Films and Publications Act 1996, the most progressive in the world, had been consistently amended by the ANC Government. The latest legislation, the Films and Publications Amendment Act simply recreated old apartheid committees of departmental officials to whom one had to submit whatever one wanted to publish – a magazine, book or whatever. 'It is outrageous.' The High Court had just struck it down on the grounds of Section 16, 'prior restraint' and other grounds. The judgement had gone to the Constitutional Court for confirmation. One just did not do that in a country that observed the freedom of expression.
 
The Chairperson said that the technical sub-committee had wanted an exclusion on literary and artistic expression, which had not been included in the Bill. What Members were now examining was how to include it. The 'd' referred to bona fide. There were also two new proposals on the basis of court cases solely because of problems with the meaning of bona fide solely for the purposes of literary or artistic expression to the extent that such an exclusion was necessary to reconcile with public interest. There could be disputes as to whether a particular matter was covered by that exclusion or not. It was a question if one kept the (d) in the present Working Draft whether the exclusion was bone fide or not. Someone had to adjudicate on that. If it was not bona fide literary or artistic expression, then it would not be covered by the exclusion but by the Bill and the conditions for processing personal information would apply and the Regulator would have the standing to deal with complaints. If it was bone fide it was out and there would be no jurisdiction. This was the question, basically. There were three options: the one in the Sixth Working Draft, which was any persons for the purpose of bona fide literary or artistic expression; there were then two other options proposed – options one and option two. He had an interest in option one. He asked if any Member had any other interest.

Dr Oriani-Ambrosini suggested another option - (d) without the bona fide. He did not see the need for it as it was an intrinsic requirement. He had a problem with any organ of state having to decide what was literary or artistic expression. He asked that the Clause be as unqualified as possible.

Ms Louw pointed out that the Bill would not be applicable at all to works of fiction. It would only apply when writing about another living person, in which case it was not such a bad thing to be required to obtain consent. Discussing whether or not to include bona fide would not help at all, since all the information to be regulated by the Bill was bone fide. So she agreed with Dr Oriani-Ambrosini that bona fide might be left out.

Ms Smuts spoke inaudibly.

The Chairperson pointed out to Ms Smuts that this was an exclusion. With the new Clause, literary and artistic expression was excluded. Therefore one had to be careful that literary and artistic expression was not misused. He referred to the case of the biography of Ms Patricia de Lille. He wanted option one. He advised the drafting team to list three options.

The Chairperson wondered how Ms Smuts would explain her objection to Clause 6(1)(c).

Dr Oriani-Ambrosini had previously raised his concern at the language of Clause 6(1)(c)(ii), in particular, 'money-laundering'. Here was a huge loophole. He was worried that Government could retain records of all our financial transactions just in case we did something wrong.

The Chairperson said that Dr Oriani-Ambrosini's objection would be considered but not supported. This provision had been included at the request of the Financial Intelligence Centre (FIC).

Clause 7
Mr Du Preez said that the new Clause 7 had already been considered by the technical sub-committee. Now Dr Oriani-Ambrosini's option was included.

Clause 8
Mr Du Preez referred to the Draft Regulation, Article 23, page 56.

Ms Louw said that data protection by design had been promoted extensively in the past decade. The whole idea was that the whole regulation of data privacy should be proactive. Companies should look at data protection at the beginning of a project. To confirm that idea, the EU had included a separate article. It was also a new idea for the EU to include the OECD principle of accountability. Proactivity had always been part of the drafting team's thinking.

Mr Du Preez supported including it in the Bill. It was a global trend. It fitted in with the information security standards.

 The Chairperson understood that this would mean adding to the accountability Clause. He asked the drafting team to suggest suitable wording and circulate it to Members of the technical sub-committee who could then agree or suggest different options. He did not want a further meeting. He wondered what the heading should be and noted that Ms Smuts supported Dr Oriani-Ambrosini. He was not sure why, particularly if the heading was going to change and become broader. At the moment it read that the responsible party should ensure conditions for lawful processing. The Smuts-Oriani-Ambrosini option was therefore to ensure compliance with conditions for lawful processing. So the difference was really the insertion of the word 'compliance'. This seemed to be splitting hairs.

Mr Du Preez said that the Draft Regulation referred to principles rather than conditions.

The Chairperson said that what was at issue was what was understandable in South African law. In the hearings there had been much confusion.

Clause 10
The Chairperson noted that Ms Smuts supported Dr Oriani-Ambrosini, but felt that a right to privacy heading did not fit in.

Ms Smuts felt that everything in Dr Oriani-Ambrosini's Clause 10 was in Clause 11.

 Dr Oriani-Ambrosini said that two things had been collapsed into one - firstly, the deletion of the old Clause 9, the minimality. The other was the addition of a right to privacy. There was need for a substantial definition of the right to privacy beyond that set out in the Constitution. He recollected that he had been refused a hotel room unless he gave an identity number, yet there was no longer any legislation requiring that. Previously it had been required by the Aliens Control Act. Clause 11 provided the right not to give one's identity number, but did not provide the subsequent right, for example, to obtain one's bed at an hotel. This was why the right to privacy had been phrased the way it had.

The Chairperson noted that Clause 4 dealt with the rights of the data subject. He was personally sympathetic to what Dr Oriani-Ambrosini was raising and sometimes found completely unnecessary requests for information which could be used for profiling. He wished to see provision for data subjects to raise a complaint to the Regulator if they felt that such information was not necessary. However, it might belong better in Clause 4. Dr Oriani-Ambrosini's request that information could be collected only if required in law might be going a little too far. However, he would like to see a situation where someone who wanted to enter into a contract for a cell phone or for a hotel room was not asked for his hobbies or interests or whether he or she was on any information.

 Mr Du Preez replied that it would not be possible to include it in Clause 4. The drafting team had been careful not to create substantive rights in Clause 4.

Ms Louw referred to Clause 11(1)(b). Perhaps one could include 'objectively necessary'. It would then be easier for a data subject to raise a complaint to the Regulator.

 Dr Oriani-Ambrosini said that this was a substantive provision. Clause 11(1)(b) was a prohibition from conducting an activity – the processing – unless it was necessary. So therefore one should not ask for identity numbers. He sought a substantive right to act in the protection of one's own privacy and obtain that which was not given to one because one did not want to allow an infringement of one's privacy. The example that he had given was a good one. If there was only Clause 11, one would not be able to obtain one's hotel room. Examples could be identified ad infinitum. It was a substantive right which said that a contract was valid in which a person had a contractual right to that room even though he or she were not fulfilling Clause 11. It made the Clause invalid, but kept the rest of the contract valid.

Ms Louw said that the provision in Clause 11 was as in the EU Directive and in the Draft Regulation as well.

Mr Du Preez interpreted the question as whether it was unreasonable in contract terms for a hotelier to refuse a room in the situation described by Dr Oriani-Ambrosini. He did not think that a moral obligation was involved.

Dr Oriani-Ambrosini accepted that it was reasonable to ask for necessary information.

The Chairperson was sympathetic, but was not sure that he wanted to follow the route of Dr Oriani-Ambrosini's proposal.

Ms Smuts spoke inaudibly.

Dr Oriani-Ambrosini suggested calling it 'respecting the right to privacy'.

Ms Louw said that the information requested must be adequate, relevant, and not excessive.

The Chairperson ruled that Clause 10 would remain as it was with Dr Oriani-Ambrosini's option.

Clause 11
Mr Du Preez said that this was a consequential amendment.

Dr Oriani-Ambrosini observed that information did not belong exclusively to the data subject; it was between the data subject and the data processor. All that the data subject had was a reasonable expectation of privacy in respect of the information. One sought to achieve here a balance of interests.

The Chairperson was not happy about including some of the provisions of Article 19, Draft Regulation, page 53).

The Chairperson observed that the EU was not close to completion of its Draft Regulation. He suggested a specific submission to the National Council of Provinces (NCOP). He agreed that Mr Preez should continue referring Members to the Draft Regulation, but felt that the approach was somewhat piecemeal at present.

Clause 12
Mr Du Preez noted options proposed for Clause 12(2)(b) and Clause 12(2)(f).

Ms Louw added that Article 7, Draft Regulation, page 45, did not add much but was interesting. Article 7(4) might assist in provisions for vulnerable people other than children. Consent was one of the gateways to processing information.

The Chairperson did not know what Article 7(4) meant. However, Article 7(1) and (3) had merit. He also had some problem in understanding Article 7(2). He asked the drafting team to add a footnote.

Clause 14
Mr Du Preez referred to Article 17(4), (5) and (6), Draft Regulation, page 52, which might be included in the Bill's Clause 14.

Dr Oriani-Ambrosini noted that the Bill provided for data to be retained only for as long as necessary.

The Chairperson felt that the proposed insertion required more thought and he asked Mr Du Preez and Ms Louw to draft proposals to be circulated to Members of the technical sub-committee before presentation to the full Portfolio Committee.

Clause 15
Mr Du Preez noted a cross-reference to a consequential amendment.

Clause 18
Mr Du Preez drew Members' attention to Clause 18(1)(g)(iv), and Clause 18(4)(a) in which there was a cross-reference to children. He said that in the Draft Regulation notification was no longer a requirement, as it was no longer felt to be an effective system and would most probably be replaced by compulsory data protection offices.

Ms Louw noted that instead of notification, the EU required responsible parties to keep extensive documentation in readiness for request by the information commissioner. However, she thought that for the time being it would be better to retain notification, for the benefit of the new Regulator.

The Chairperson thought that to abandon notification would be too radical.

Ms Louw referred Members to Article 14(1)(e) and (g) and 14(3), Draft Regulation, page 48. These sub-clauses might be adopted.

The Chairperson suggested adopting them in the Bill.

Clause 19
Mr Du Preez noted an amendment (footnote 45).

Clause 21
Mr Du Preez said that this Clause was quite straightforward.

Clause 22
Mr Du Preez referred to Article 31, Draft Regulation, pages 60-61, which might add value.

Ms Louw added that, in particular, Article 31(2) and (3)(c), (d) and (e) were pertinent.

Ms Louw suggested deleting from Clause 22(1) the words 'or any third party processing personal information under the authority of the responsible party'.

Dr Oriani-Ambrosini said that if there was a breach, one must inform those whose data had been breached, and then let the Regulator know. 'The absurdity will need to be fixed by dealing seriously with the scope of application of the Act.'

Ms Smuts agreed that the data subject should be advised of any breach.

Mr Francis Cronjé, a specialist in information and communications technology law and privacy, completely agreed with Dr Oriani-Ambrosini and Ms Smuts. The data subject should in all circumstances be notified but that the Regulator should not be notified of every breach as this would complicate matters. He understood the EU Draft Regulations did not require every breach to be notified. It was up to the data subject whether the matter should be to the Regulator.

Mr Heyink agreed with Mr Cronjé. The question came back to the ownership of information. In most instances of breach, it was the data subject who was best able to protect him or herself and most urgently should be informed, for , in case of a breach of password.

The Chairperson said that non-compliance in Clause 22 was not a crime. It would be a complaint to the Regulator. He did not think that frivolous complaints would be presented to the Regulator. He was confused by Article 32(3) of the Draft Regulation. He did think that notifying the Regulator was important and would not harm the data processor. He agreed to the third party deletion as mentioned by Ms Louw, and asked the remainder be kept as it was.

Members agreed.

Ms Louw wanted to insert Article 31(2), Draft Regulation, page 60, and also Article 31(3), Draft Regulation, page 61.

The Chairperson asked what the difference between 'alert' and 'inform' was.

Mr Du Preez replied that 'inform' had the meaning of 'advise' the concerned party of exactly what had happened and what steps he or she needed to take.

Dr Oriani-Ambrosini said that once one had informed one had alerted.

The Chairperson said that Members had agreed on informing the Regulator immediately and on the steps to be taken.

Mr Du Preez said that terminology was always a concern when translation was involved, as with the Draft Regulation.

Mr Heyink said that the global experience was that the real sanction was not so much a criminal sanction as public opinion.

Clause 26
Mr Du Preez here introduced Part B of the Working Draft, page 24.

The major change was to take out 'children' from Part I of Part B. Now Part II dealt only with the processing of special personal information, which was then defined in Clause 26. 'Special personal information' referred to such information in relation to adults.

The new amendments in Clause 26 were merely consequential.

In Clause 26(a) footnote 48, Working Draft, page 24, referred to the term 'sexual life'. At a previous meeting Members had requested omission of this term in relation to the data subject's health. The drafting team had not received any instructions to provide an additional provision. Without such additional provision, there was merely an absolute prohibition on processing information relating to an individual's sexual life based on the provisions of Clause 26(a). He asked if Members still maintained their earlier position.

There was also an option prepared by Dr Oriani-Ambrosini, Working Draft, page 27, dealing with 'sexual life'.

The other option was just to reintroduce the words 'sexual life' in Clause 32.

Ms Smuts, in her note, had queried the use of the term 'sexual life' and suggested replacing it with 'sexual orientation' or 'sexual practice'. She now acknowledged the need to reintroduce it, at least in the medical section. She still expressed a preference for 'sexual practice'.

Mr Du Preez observed that the term 'sexual life' was broader than 'orientation'.

Dr Oriani-Ambrosini was in favour of the term 'sexual life' but preferred to call it 'sex life'. A life with no sex was still a 'sex life' but was not a 'sexual life'. He was not in favour of putting it under health, as it was about philosophy and socialising – it brought everything together from religion to philosophy to conduct and behaviour.
'Sexual life' was more correct grammatically, sense 'life' and 'sex' were nouns and 'sexual' was an adjective, but in everyday life no one used the term 'sexual life'.

Ms Louw said that the EU Directive referred to 'sex life', as did the Draft Regulation. There might have been 'a grammatical change' to 'sexual life' in the drafting of the Bill.

The Chairperson noted that the term 'sexual life' came from the South African Law Reform Commission. He suggested that the drafting team might still use that term.

The Chairperson asked the drafting team to reinsert 'sexual life', while keeping Dr Oriani-Ambrosini's option and making the changes that he wanted, and consider a second option as to whether there should still be a separate section. As to the choice of 'sex life' or 'sexual life' he asked the drafting team to review earlier drafts.

Ms Smuts asked why there was a prohibition on the processing of personal information concerning the criminal behaviour of a data subject (Clause 26(b). If someone had been found guilty and sentenced, it was very much public knowledge. Even expunged convictions remained part of the public record. She understood the prohibition of publication of alleged offences.

Dr Oriani-Ambrosini agreed with Ms Smuts. Whatever was in the public record could not be the object of a claim of privacy. However, a list of people who had divorced would be protected, since, although this was derived from the public records, the information was reorganised. This was one of the fundamental problems about this Bill – that public information at a certain point became protected.

Ms Smuts asked if it was not covered by the provisions in respect of linking.

Ms Louw replied that the EU regarded information about criminal convictions as very sensitive, as if someone had served his or her sentence he or she should be able to start a new life. The Draft Regulation now included only criminal convictions and related security measures, and did not refer any more to offences. (See Article 9(2)(j), Draft Regulation, page 46). This narrowing down had been criticised by commentators.

Mr Sisa Makabeni, State Law Advisor, requested Members to look also at Clause 33, which permitted the use of that information.

The Chairperson observed that Clause 26 was the summary while Clause 33 provided the detail. He proposed leaving things as they were. He noted a problem in the public service where officials had disciplinary cases brought against them, but resigned before the cases were finalised. There was then no record and they then obtained employment elsewhere without the new employer's knowing that there was a case against them. From the ANC's perspective, that had been raised as a strong concern and systems needed to be put in place to detect such situations. In so far
as this concerned employment, this could be covered by the exemptions in Clause 33. He asked the drafting team to put a footnote that the full Portfolio Committee might want to examine this matter in greater detail.

The Chairperson asked where the reference to DNA came from (Clause 26(a)). Unlike the other broader issues dealt with in that sub-clause, DNA was like a unique identification number. Did it belong here?

Ms Louw said that the Draft Regulation referred to genetic data.

Dr Oriani-Ambrosini said that 'biometric' data was completely different.

Mr Du Preez compared Clause 29.

Ms Louw felt that genetic data could fall under the broader issues.

The Chairperson asked if the police would not keep DNA data in terms of the Criminal Procedure Amendment Bill.

Ms Louw replied in the affirmative.

The Chairperson asked if the data subject was required to give consent.

Ms Louw replied that this was dependent on whether the data subject had been sentenced.

Dr Oriani-Ambrosini said that this was a very difficult field.

The Chairperson wanted to leave matters as they were.

Mr Makabeni said that the Portfolio Committee on Police had decided to split legislation dealing with finger prints and DNA.

Clause 27
Mr Du Preez drew Members' attention to Clause 27(2), Working Draft, page 25.

Clause 29
(See discussion under Clause 26 above)
Clause 32
(See discussion under Clause 26 above)

Clause 33
(See discussion under Clause 26, above)

Clause 34
Clause 34 was at the beginning of Part II of Part B. This Part II dealt with processing of personal information of children (Working Draft, page 28). Clause 34, in line with the technical sub-committee's request, contained the prohibition: 'A responsible party may not process personal information concerning a child'. A 'child' was defined in Clause 1.

Clause 35
Mr Du Preez said that Clause 35 was 'general authority concerning personal information of children'. Clause 35(1) (a) to (d) repeated the general authority with regard to the processing of special personal information of adults. He apologised and undertook to review the technical provisions. He noted that the word 'or' should be inserted at the end of Clause 35(1)(c).

Clause 35(2) dealt with the second part of the technical sub-committee's request – that the Regulator should be empowered to grant authorisation to a responsible party to process the information.

Clause 35(3) provided for the Regulator to impose certain conditions. These provisions were self-explanatory.

The Chairperson agreed.

Clause 37
Mr Du Preez noted the need to correct the heading.

Dr Oriani-Ambrosini asked if there was a reporting requirement on the side of the Regulator (Clause 37(1)) and if there was a reporting requirement to the Regulator (Clause 37(2) or if this were an exemption that, once given, was given for ever. Once exempted, one was out of the control. Should there not be a deadline?

Ms Louw pointed out that it was not a blanket exemption.

Clause 38
Mr Du Preez pointed out that Clause 38(d) was, at Members' request, a new paragraph.

Clause 39
Mr Preez said that Clause 39(1) was just a consequential amendment. There was not much to report on the remainder of that Clause.

The Chairperson objected to the phrase 'by means of' in Clause 39(1)(a). He also objected to the phrase 'by means of consultation' (Clause 39(1)(c), which was not very elegant. Maybe it was a translation issue.

Dr Oriani-Ambrosini said that 'by means of consultation' was not required. He suggested alternative, more concise, wording.

Clause 40
Mr Du Preez said Clause 40(e) had been included at the request of Members to disallow members of the Regulator from performing other remunerative work during the period in which they held office, subject to subsection (4).

An option proposed by Ms Smuts was that the chairperson of the Regulator and the members of the Regulator must be appointed by the President on the recommendation of the National Assembly. (Working Draft, page 33; also footnote 68).

The Chairperson asked who, for example, appointed the chairperson of the Human Rights Commission.

Ms Smuts affirmed that it was clear in this instance that it should be the National Assembly.

Ms Christine Silkstone, Parliamentary Content Advisor, said that the Human Rights Commission appointed its own chairperson.

Clause 41
Mr Du Preez said that the drafting team had amended Clause 41(2)(b) as requested by the technical sub-committee.

Clause 44
Mr Du Preez said that at the previous meeting it had been realised that the conflict of interest provision should apply to both pieces of legislation – the PAIA as well as the Bill.

Clause 46
Ms Smuts questioned Clause 46(1).

The Chairperson clarified that this sub-clause referred to members of the Regulator and not to the staff.

Dr Oriani-Ambrosini pointed out that the state was one entity. The private sector comprised millions of entities so it was only in the private sector that there was conflict of interest.

Ms Smuts said that she would never appoint, as a Regulator, anyone from an entity having a vested interest such as a bank. However, there were many other kinds of people who could be appointed, such as academics.

Dr Oriani-Ambrosini said that the great threat here would be from people who produced the very tools that the Regulator would be promoting, such as computer programs. He would make it clear that anyone having a relationship with a supplier of technology not to the Regulator but to the field, would be ineligible. He pointed out that a university professor, in South Africa, was not a civil servant.

Ms Smuts said that such people were required, provided that they had resigned from companies such as Microsoft and other suppliers of technology, and provided that there was a need for a 'cooling off' period to deal with the revolving door problem. Ideally one would not appoint anyone directly from Microsoft.

There was further discussion on whether a member, full-time or part-time, of the Regulator could be a public servant.

Ms Smuts said that one could not have an independent Regulator with public servants sitting on its committees.

The Chairperson thought that the matter could not be resolved at present; he asked Ms Silkstone to make a note for the full Portfolio Committee.

Ms Silkstone asked if it would be helpful to distinguish between remuneration for the full-time and allowances for the part-time members of the Regulator.

Clause 49
Mr Du Preez pointed out an amended sub-clause, Clause 49(2).

Clause 50
(See discussion under Clause 98).

Clause 52
Mr Du Preez drew Members attention to Clause 52(1)(b).

Clause 53
Mr Du Preez pointed out that the drafting team, on recommendations of Members, had reverted to the original version.

Clause 54
Mr Du Preez pointed out an interesting provision on the duty of confidentiality in the Draft Regulation (Article 50, Draft Regulation, page 77). This kind of provision was fairly standard in South Africa.

The Chairperson suggested including this provision.

Clause 57
Mr Du Preez pointed out Clause 57(1), the option proposed by Dr Oriani-Ambrosini.

Clause 61
Mr Du Preez pointed out Clause 61(1), the option proposed by Dr Oriani-Ambrosini (see footnote 90, Sixth Working Draft, page 42).

Clause 62
Mr Du Preez drew Members' attention to Clause 62(1)(d) and referred to Article 34(1), Draft Regulation, page 63.

Ms Louw explained further, with reference to Article 34(1), Draft Regulation, page 63, and Article 42(4), Draft Regulation, page 71. Trans-border transfers of information were of considerable importance.

Dr Oriani-Ambrosini had asked for options which he did not see reflected in the Working Draft.

Ms Louw explained prior investigation.

Dr Oriani-Ambrosini referred to the Banding Agreement. It was important to deal with the issue of the initiation of the investigation.

Ms Louw responded.

Clause 63
Ms Silkstone pointed out that Clause 63(2) provided that responsible parties might not carry out information processing that had been notified to the Regulator in terms of subsection (1) until the Regulator had completed its investigation or until they had received notice that a more detailed investigation would not be conducted.

The Chairperson found Clause 63(2) contorted. The EU required authorisation; it did not talk about prior investigation.

Dr Oriani-Ambrosini found the manner of the drafting difficult; he agreed with Ms Silkstone. Clause 63(2) referred to 63(1); 63(1) must be read into 62(1). When one put the three things together one started with the basic proposition that one could not do any of these things until the investigation had been completed. This would have a paralysing effect – one would need some kind of a private agreement to take the place of the laws. Otherwise South Africa's industries would be adversely affected.

Ms Louw replied that if one was subject to a code of conduct one was not subject to prior investigation.

The Chairperson his difficulty with emphasis on prior investigation.

Ms Smuts wanted to retain the concept of prior investigation for the less reputable dealers.

Ms Louw considered prior authorisation and prior investigation to be effectively the same.

The Chairperson acknowledged his difficulty with the concept of prior investigation; his end goal was prior authorisation. The concept was not helped by the Article 34 of the Draft Regulation.

Ms Louw sought to dissuade the Chairperson for putting too much emphasis on the difference in terminology.

Dr Oriani-Ambrosini wanted further thought on the matter and debated the issue with Ms Louw.

The Chairperson inferred that the EU was moving from prior investigation to prior authorisation. He asked Mr Du Preez and Ms Louw to review Clauses 62 and 63 in the context of the above discussion and with regard to consistency of cross border flows (Clause 77).

Clause 64
Mr Du Preez had little to report on Clauses 64-73, which comprised Chapter 7 (Working Draft, pages 43-46). Mr Du Preez had nothing to report on Clause 64.

Clause 74
The Chairperson noted that Ms Smuts wanted the data subject's refusal to be free of charge. Opting out was currently paid for by the consumer. He was especially worried about opt out emails. So he preferred opt in.

Mr Du Preez pointed out that in Clause 74(5) it might be useful to have a definition of 'automatic calling machine'.

The Chairperson was incensed that he received direct marketing from 'automatic calling machines'.

Clause 75
Mr Du Preez pointed out that 'subscriber' was defined in Clause 75(5).

Clause 76
Ms Louw explained 'automated decision making' in Clause 76 with reference to Article 20, Draft Regulation, page 54.

Dr Oriani-Ambrosini said that the right defined in Article 20(1) was very important. Such new generation rights were important in addressing the challenges of the future.

Clause 77
(See discussion on Clause 63).

Ms Louw pointed out two issues – the EU Directive had not referred to 'the adequacy requirement' as a specific section, whereas Article 42(1), Draft Regulations, page 70, did so. Also this Article's provision for a safeguards with respect to the protection of personal data in a legally binding instrument was new. Perhaps one should refer to this as well. Such an instrument applied wherever a company operated.

The Chairperson's worry was that the EU was much more advanced in terms of practice and experience and the EU countries had safeguards. South Africa was in a neighbourhood without such safeguards, which, in Africa, had not gone beyond the francophone countries. It was easier for the EU countries to be more assertive, so he preferred in this instance not to copy the Draft Regulation.

Clause 81
Mr Du Preez drew Members' attention to Clause 81.

Clause 90
Mr Du Preez drew Members' attention to Clause 90.

Clause 94
Ms Louw referred to Article 33, Draft Regulation, page 62, which dealt with data protection impact assessment for the first time in depth.

The Chairperson asked if it would not be safer to retain the Bill's broad approach rather than specify particular areas as in Article 33.
 
Clause 98
Mr Du Preez noted a cross-reference [to proposed section 78].

Ms Smuts said that it had to be decided who exercised the right of search and seizure (Clause 98). Under ICASA it was the Inspectors who could summons, swear, search, etc. Thereafter the matter went to the compliance committee. Here it had to be decided if the equivalent, the enforcement committee (see Clause 50, and footnote 79, Working Draft, pages 37-38), would issue the penultimate order. It would be the Regulator who issued the final order. Alternatively, would another committee, unnamed, do all this investigating? If one was happy with the investigative functions being carried out by some other committee, adjustments would be needed to Clauses 50 and 98. She gave details of such adjustments. There were also similar adjustments to be made to the PAIA amendments (Section 77J, Schedule, Working Draft, page 75).

Ms Louw acknowledged the importance of the aspects that Ms Smuts had raised. However, other legislation had not gone into extensive detail and left such matters to the discretion of the Regulator or to be dealt with under regulations.

Ms Smuts said that it was necessary to define clearly the role of the enforcement committee.

Dr Oriani-Ambrosini apologised that he would have to leave. He was confident that the Chairperson and Ms Smuts could handle the remaining matters and he had no pressing further inputs.

The Chairperson said that the general power was given to the Regulator. He wanted to legislate rather than micro-manage the structure of the Regulator.

Ms Smuts sought more detailed provisions.

Dr Oriani-Ambrosini agreed. A regulatory agency had two elements: one regulated, the other adjudicated. Because of the difficulties of adjudicating under one's own regulations, there was a greater emphasis on spelling out various procedures which Ms Smuts had brought to Members' attention. ICASA was different because it regulated and adjudicated. The difference was that only a few entered the business of broadcasting whereas almost everybody was in the business of processing information. If one could not afford to establish the appropriate mechanism, it might be better not to pass the legislation.

The Chairperson said that the enforcement committee had been included as an option to be used by the Regulator when there were disputes of fact. If one were too stringent as to the bureaucracy, then one would have to consider increased costs. Then it might be appropriate not to have the provisions on the enforcement committee.

Dr Oriani-Ambrosini said that the issue was adjudication. One could not 'play hard-ball against the Constitution'.

The Chairperson said that the workings of the enforcement committee must be consistent with the Constitution. It was one thing to have an enforcement committee but to include pages on how it would work would be excessive – it would be better not to have an enforcement committee.

Dr Oriani-Ambrosini wanted to speak.

The Chairperson said that he had given Dr Oriani-Ambrosini permission to leave, but he persisted in debating an issue that had been on the table for some time.

Dr Oriani-Ambrosini insisted that this was the first time. He had wanted to leave but had then realised that the Chairperson and Ms Smuts needed his assistance. One could not depend on regulations. If it was important, it should be included in the legislation.

The Chairperson said that the bottom line was that Dr Oriani-Ambrosini must come with amendments.

Dr Oriani-Ambrosini wanted the drafting team to capture from the Independent Communications Authority of South Africa (ICASA) legislation that which seemed to be applicable to this Bill.

The Chairperson's difficulty was that the enforcement committee had been on the table for months, if not years.

Ms Smuts said that Members had never exhausted the matter.

Mr Du Preez said that the minimum requirements were present in the Bill.

Dr Oriani-Ambrosini requested another meeting.

The Chairperson refused. He inferred that Dr Oriani-Ambrosini did not want this Bill passed.

Dr Oriani-Ambrosini said that the Chairperson was out-of-order.

The Chairperson assured Dr Oriani-Ambrosini that this was the last meeting of the technical sub-committee. A report would be given to the full Portfolio Committee.

Dr Oriani-Ambrosini said that it would be necessary to meet to approve the report.

The Chairperson replied in the negative. The next step would be to take the Seventh Working Draft, which the drafting team would prepare after this meeting, to the full Portfolio Committee.

Ms Smuts said that footnote 79, Working Draft, pages 37-38, was on the table, and it was present even in her own black and white version of the Working Draft, while other parties had a version in full colour.

Dr Oriani-Ambrosini offered to give in, so that Members could move on.

The Chairperson asked Dr Oriani-Ambrosini 'Give in to what?'

Ms Smuts said 'Yes'.

Dr Oriani-Ambrosini replied 'Into her'.

Dr Oriani-Ambrosini said that it was the gentlemanly thing to do.

The Chairperson asked Dr Oriani-Ambrosini put his proposed amendments to the full Portfolio Committee.

Ms Smuts agreed, but said that it was necessary to amend Clauses 50 and 98 at a minimum. It was as simple as putting in the steps.

The Chairperson asked Ms Smuts to put her proposal in writing to Ms Louw so that it could be circulated.

Ms Smuts agreed.

The Chairperson hoped that Dr Oriani-Ambrosini had brought his umbrella with him, as it was starting to rain.

Dr Oriani-Ambrosini had not, and he hoped that this pleased the Chairperson.

Clause 111
 Mr Du Preez noted that the Bill's provision for the Regulator to impose administrative fines was an alternative to a prosecution for any offence in terms of the Act. The responsible party would have the option to pay the fine or opt for prosecution. This provision was based on the existing provisions of the Firearms Control Act. However, the UK Information Commissioner's approach was different. This Commissioner did not apply administrative fines for offences, but for non-compliance with conditions. The drafting team was concerned that the Bill's provisions as they stood now might weaken the enforcement of the proposed legislation.

Ms Louw said that previously there had not been consideration that the offences in terms of the Bill were mostly technical, except for those in Clauses 108 and 109 with reference to the unique financial identifier. She feared that the administrative fines would be connected only to the technical offences and not to the substantive provisions, which was different from the UK's practice and that of other countries. The Bill's approach was too soft. She preferred to remove the provision for administrative fines for fear that they would dilute the Bill's enforcement provisions. Administrative fines were too similar to an admission of guilt for a traffic offence.

The Chairperson disagreed. He believed that administrative fines were a useful provision and option for the Regulator and wanted administrative fines retained. The drafting team's proposal would escalate costs, would affect people's rights, and require the establishment of a tribunal.

Ms Louw differed. The Bill did not criminalise non-compliance. Instead an enforcement notice was issued. Only non-compliance with the enforcement notice was criminalised. Admission of guilt fines were usually used for lesser offences.

Mr Du Preez denied that the drafting team's proposal was an about-turn but rather that it had noted a new direction in terms of the Draft Regulation. The drafting team was not criticising the Bill's provision as such.

The Chairperson said that the Regulator would have discretion in offering the option of an administrative fine.

Clause 114
The Chairperson pointed out that the option (see footnote 112), Working Draft, page 62, was requested by Ms Smuts, not by him.

Ms Louw liked the option.

Clause 115
Mr Du Preez said that this Clause provided the procedure for making regulations. He had no further observations.
 
Schedule [Laws repealed or amended by proposed section 112]
Ms Smuts raised issues with reference to Section 77G of PAIA (Working Draft, page 72). She said that one could not allow the Regulator's staff to take the judicial peak.

Mr Preez, from the drafting team's perspective, could not criticise what Ms Smuts had just said. This was exactly why reference had been included to Section '80' of PAIA.

[At this stage there was considerable discussion, but without correct use of the microphones.]

Mr Du Preez said that the requirement to submit the manuals to the South African Human Rights Commission came from the obligation in Section 10 of PAIA. However, Section 10(4) of PAIA required the guide to be made available as prescribed. So it was actually regulations that had introduced the requirement that was causing the problem. Thus it had to be asked if one would ask the Minister to amend the regulations or simply supersede the regulation by amending Section 10(4).

The Chairperson asked Mr Du Preez to check if there was a statutory provision within PAIA that private bodies should submit a hard copy of their manual to the South African Human Rights Commission. He feared that this was a burden to the Commission. If there was such a requirement in PAIA, there was need of an amendment to change the requirement to an electronic copy. If it was in the regulations, one could ask the Minister to change the regulations.

Conclusion
The Chairperson confirmed that this was the last meeting of the technical sub-committee. The drafting team would prepare the Seventh Working Draft for submission to the full Portfolio Committee for an introductory briefing by Mr Jeffery with input by Ms Smuts and Dr Oriani-Ambrosini followed by a clause-by-clause (not page-by-page) briefing led by Mr Du Preez with Ms Louw.

However, creative solutions were needed to finalise the Bill. The areas of dispute could be included in the Seventh Working Draft as options. If there remained grey areas, it would be necessary to find ways of leaving them out, include an enabling provision, or deal with them by regulation.

There was no point in spending vast sums of money on translating the Bill into a second language when it was as yet an incomplete product. There should be a translation only after the full Portfolio Committee had finalised the Bill. The Chairperson would not expect to produce a second language translation in an unreasonable time.

The Chairperson concluded the meeting.