Information Regulator 2022/23 Annual Performance Plan

This premium content has been made freely available

Justice and Correctional Services

11 May 2022
Chairperson: Mr G Magwanishe (ANC)
Share this page:

Meeting Summary

Information Regulator South Africa

The Portfolio Committee on Justice and Correctional Services (the Committee) met virtually with the Information Regulator (IR) for a briefing on its 2022/2023 Annual Performance Plan (APP) and budget.

The presentation by the IR outline included an overview of the entity’s external environmental analysis and annual targets per programme. The Regulator has been allocated an amount of R100 609 million for the 2022/23 financial year. The major spending focus of the Regulator will therefore be on implementing the ICT Strategy. The IR discussed enablers to achieve targets.


The ensuing discussion by Members entailed: the progress and position regarding the separation from the Department of Justice (DOJ); the position regarding the portal for registering information officers; the position regarding an electronic system for complaints management; low influx of the Promotion of Access to Information Act 2 of 2000 (PAIA) requests; public awareness of rights; action taken in respect of the leakages experienced in the public domain of data and TransUnion; outcome of the IR’s own investigation around the attack of the systems of the DOJ; funded vacancies and targets; Human Resources (HR) issues and the current filling of vacancies, including the Chief Financial Officer (CFO) position; the issue of office space, taking into account the filling of vacancies; projected underspending; the listing of the organisation not progressing; risks that faced the IR; Information and Communications Technology (ICT) infrastructure implementation and sufficiency thereof; possible inadequate enforcement; and the Experian data breach.

Members further discussed: the appointment of a practitioner to head the enforcement committee as opposed to a retired judge; current timeframe to properly establish the enforcement committee; the manner in which the IR dealt with complaints; low targets for the finalisation of complex complaints; ineffective education and awareness programmes and setting of targets; detail around the seven education programmes; the magnitude or content of the intended education programmes; role of the IR in terms of reducing the number of cybercrime victims in South Africa; inclusion of people with disabilities in relation to the planned awareness training and education programmes; feedback on the use of personal information during the coronavirus pandemic and the provision of an updated report; news editors taking the Department of Basic Education (DBE) to court with regards to matric results; progress in enforcing the Protection of Personal Information Act 4 of 2013 (POPIA) in regards to the publishing of matric results; and the risk of offering unaccredited training courses.

The Committee listed issues that required a speedy resolution by the IR, including the: chairperson of the enforcement committee; ransomware attacks; listing of the IR; and separation of the IR from the DOJ. The Committee would go through the briefing and look at other issues that might need to be taken up on the IR’s behalf, and revert back to the IR.

The IR would make the necessary follow ups and come back to the Committee with progress reports. 

Meeting report

The Chairperson invited the Information Regulator to commence its presentation.

Information Regulator Annual Performance Plan (APP) for the 2022/23 Financial Year
Adv Pansy Tlakula, Chairperson, IR, lead the presentation. Mr Mosalanyane Mosala, CEO, IR, presented the targets for Programme One. Mr Ntsumbedzeni Nemasisi, Executive: PAIA, IR, presented the targets for Programme Two. Mr Mukelani Dimba, Executive: Education and Communication, IR, presented the targets for Programme 3. Ms Hellen Shube, Executive: Corporate Services, IR, presented the targets for Programme 5, and the 2022/2023 budget and Medium-Term Expenditure Framework (MTEF).

The APP targets were presented per programme. Programme One concerned the protection of personal information and targets included
-Percentage of complex complaints received, investigated and finalised
-POPIA compliance monitoring and enforcement framework approved  
- Number of targeted responsible parties monitored on compliance
- Application for Codes of Conduct finalised within the prescribed time frame
- Percentage of applications for prior authorisation processed
-Percentage of applications for exemption from POPIA
-Percentage of information officers and deputy information officers registered as prescribed
-Approved and implemented rules of procedure relating to the manner in which any POPIA matters or POPIA complaints must be referred and handled by the Enforcement Committee

Programme Two concerned the promotion of access to information and targets included:
-Percentage of complaints received, investigated and finalised. 
 -Percentage of simple complaints received, investigated, and resolved
-Approved and implemented rules of procedure relating to the manner in which any PAIA matters or PAIA complaints must be referred and handled by the Enforcement Committee
-Number of targeted public and private bodies monitored on compliance
-Approved and implemented Compliance, Monitoring and Enforcement Framework

Programme Three concerned education and communication and targets included:
-Percentage of the nationally-representative sample of the population who are aware of their rights to privacy (as it relates to protection of personal information).
-Percentage of the nationally-representative sample of the population who are aware of their right of access to information
-The number of education programmes conducted to promote the protection of personal information.
-The number of education programmes conducted to promote access to information
-Number of public awareness programmes conducted on Information Rights at community levels
-Number of stakeholder engagement sessions conducted
-Number of international cooperation programmes conducted
-Number of research reports finalised 

Programme 4 concerned Legal Services and targets included:
-Percentage Implementation of the HR Plan achieved
-Lower % of vacancy rate
- Percentage Implementation of ICT Plan
-Number activities in the Records Management Plan implemented

Programme 5 concerned administration and targets included:
-Facilities management plan approved
-Number of research report on technological changes affecting protection of personal information
-Percentage expenditure on allocated budget annually for goods and services and machinery and equipment
-Percentage completion on annual procurement plan  

In terms of the budget for 2022/2023, the Regulator has been allocated an amount of R100 609 million for the 2022/23 financial year.
-R71 875 million is allocated for compensation of employees,
-R23 029 is allocated for goods and service, and
-R5 705 is allocated for capital assets
The major spending focus of the Regulator will therefore be on implementing the ICT Strategy

Enablers to achieve targets
-Recent significant amendments of PAIA requires the Regulator to develop and conduct educational programmes to advance the public understanding, in particular the disadvantaged communities, of how to exercise their constitutional rights of access to any information held by the public or private bodies.
-The Regulator is currently using ineffective manual system to manage or handle complaints. The Regulator intends to deploy, in this current financial year, the Complaints Management System to ensure proper management of records electronically.
-The integrity and confidentiality of information to prevent loss of damage to or unauthorised destruction of information, and unlawful access to or processing of information.
-An efficient complaints management process
-The POPIA Compliance, Monitoring and Enforcement Framework, once approved, will provide a foundation for the Regulator’s mandate to effectively promote the protection of personal information and dissuade responsible parties from unlawfully processing the personal information of data subjects
-Agreements with training service providers and universities on partnerships with the Regulator to develop and provide educational programmes on POPIA
 

Discussion
Adv G Breytenbach (DA) asked what the progress and current position was regarding a separation envisaged from the DOJ. What is the position regarding the portal for registering information officers? Is it up and running yet? If not, why not? What is the position regarding an electronic system for complaints management? Is there one in place? Does it function? If so, is it successful? There appeared to be a very low influx of the PAIA requests. What is the reason for this? Is there something more that should be done or could be done to make people aware of their rights in this regard? What is the IR doing in this regard? She said that she had many other questions, including that of TransUnion, but she was sure that Members would ask those questions.

Mr S Swart (ACDP) congratulated Adv Tlakula and her colleagues on their appointment by Parliament and encouraged them to continue with their good work. On the leakages that had been experienced in the public domain of data and TransUnion, he hoped that the IR could fill the Committee in on the action that had been taken. Regarding the funded vacancies, he saw the targets that had been set to fill them. Will the IR achieve those targets? Is the IR on track with the targets? Tied to that was the projected underspending of R4.9 million. Could an explanation be provided for this? Could the IR’s funds not be shifted in terms of Treasury regulations to fund all personnel, assist, or shift it elsewhere, given that the IR was only allocating R1.25 million for the PAIA division and R1.25 million for the POPIA division? One would think, if tying up with what Adv Breytenbach had said about the low influx of the PAIA requests, that perhaps more funds should be allocated to that division to avoid underspending. He was not sure whether National Treasury would allow that. According to his understanding, if there was underspending would the IR be able to roll it over and move it within the budget that was granted?

Mr W Horn (DA) said that in respect of the listing, the Committee had to express their frustration that it was seemingly not progressing. While a contributing factor may be that there was now a new Minister of Finance, he thought that the Committee had to say that it had to be resolved and quite possibly note it as a matter that the Committee had to engage its own Minister of Justice and Correctional Services (the Minister) on to try and ensure that this matter was being resolved at an executive level. He enquired in addition to the TransUnion issues, whether the IR was in a position to appraise the Committee on their own investigation around the attack on the systems of the DOJ. The Committee’s information at the time was that the IR had decided to embark on its own investigation. Could any outcomes be shared with the Committee, which also had oversight over the DOJ in that regard?

He spoke about four risks that faced the IR, three of which the IR had identified themselves and an additional one from his side. The additional risk was around ICT infrastructure. The Committee saw that one of the perennial issues that hampered the effectiveness of all departments and institutions was an insufficient ICT infrastructure. Given that the IR was a fairly new entity, the importance was to interrogate whether in setting up the institution the ICT infrastructure was sufficient for current needs but also forward-looking enough to enable the IR not to fall foul of the ICT issues that typically plagued public institutions. In that regard, it was noted that the IR had an 80% implementation target. Is that in fact sufficient to also protect the data that the IR would hold? Around the risks that the IR had identified around possible inadequate enforcement he noted that the IR, quite counter-intuitively, seemingly only learned along with the rest of the country through the media about the Experian data breach. Given the feedback in that the guidance that the IR had received that a practitioner rather be appointed to head the enforcement committee and knowing that the other outstanding matter around the enforcement committee had been the adoption of rules, what is the current timeframe at which the IR is currently looking to properly establish the enforcement committee?

In terms of the manner in which the IR dealt with complaints, would the IR share the sentiment that to have a target of only 50% for the finalisation of complex complaints is too low and that it might, unfortunately, add to creating a perception that the IR is not serious in dealing with these complex matters in a speedy manner? He was mindful of the fact that complex matters, by their very nature, might be difficult to finalise but he thought that if the IR was serious about not falling foul of bad perceptions, then they should relook at that issue. Around the risks previously identified by the IR around ineffective education and awareness programmes, how has the IR settled on the 5% awareness target amongst the general population? Is this an international benchmark? What has informed this? Secondly, he asked for some further detail about the intended seven education programmes. The difficulty around this was that education programmes could of course have a limited impact. One could have an education programme where it was said that tertiary institutions would be visited, and then set up a gazebo there for the morning and hand out a few leaflets or ultimately through partnerships ensure that all enrolled students are reached. What will the magnitude or content of these intended education programmes be?

Ms W Newhoudt-Druchen (ANC) said that it was quite alarming to read that South Africa had the third highest number of victims in terms of cybercrime. What is the role that the IR is going to play in terms of reducing the number of cybercrime victims in South Africa? In relation to awareness and dissemination of information and education programmes, she was hoping that the IR would take into account people with disabilities so that they could have access to the planned awareness training and education programmes and also receive this very vital information. On the ransomware attack on the DOJ, the IR had done its own investigation. Could the IR provide the Committee with an update? In terms of the Department of Health, the IR expected a report back by April 2022. Has that feedback been received in terms of the use of personal information during the coronavirus pandemic? Could an updated report be provided on this? She said that it was bit complicated to read through percentages and that it made it straightforward there were numbers. Could the IR stipulate how many positions were filled and still needed to be filled in numbers?

Ms Y Yako (EFF) said that she was covered in terms of the questions as she had wanted to ask whether the CFO position was still yet to be filled and how far the IR was in terms of that.

Ms A Ramolobeng (ANC) said that when the Committee had done their oversight in January 2022, there was an issue that there were current vacancies. Have those vacancies been filled, especially bearing in mind the current financial year? If they are filled, how many have been filled and how many are still outstanding? The IR had made an indication of the frustrating matter regarding the office space. How is the IR going to deal with that when they filled all those vacancies that were required to be filled? The TransUnion matter had been touched on, as well as that the Committee needed to meet with the Minister of Justice as a matter of urgency. However, there was an issue that the Committee had also raised and sought clarity from the IR when they had done their oversight in January 2022 regarding the matter of news editors taking the DOE to court with regards to matric results. It was reported how the news editors might have won the case, being on the basis of an unlawful standing of olden traditions and standards or that it did not follow the POPIA. How far is the IR with this process in enforcing the POPIA? Has a breakthrough been made on this matter? What is it that will be anticipated with matriculants, especially towards the results being gazetted? Will there be a similar thing as what had happened in January, or will it be different?

Information Regulator’s Response
Adv Tlakula dealt with the issue of the separation from the DOJ and linked it with the issue of listing. Until such time that these issues have been resolved, it was going to be difficult for the IR to separate completely from the DOJ. She said that the IR would really appreciate it if the issue of the listing could be taken up with the Minister of Finance. The IR had put a proposal to the Minister of Finance to say that the way that they thought that this could be done was to just amend the Public Finance Management Act 1 of 1999 (the PFMA) and include the IR under ‘constitutional institutions’. The PFMA did not define a ‘constitutional institution’; it simply said that a constitutional institution is an institution that is stipulated in the schedule. Thus, if the schedule was amended to include the IR, that would solve the problem. However, the IR still had to hear from the Minister of Finance as to whether he was going to accept the IR’s proposal or not.

Insofar as enforcement was concerned, she had indicated in her introductory remarks that the IR had appointed all the members of the enforcement committee save for the chairperson of the enforcement committee. The IR’s intention was that by the end of the second term, which was starting quite soon, the IR should be able to refer cases as the enforcement committee should sit because the draft rules would be adopted quite soon. The IR also needed to push. She thought that why the IR had also decided on the retired judge was because if they appointed a retired judge they would not have to compensate him or her, as a retired judge received compensation as part of their pension until the end of their life. If the IR was going to be appointing a practitioner, it had to be a very senior practitioner and probably a senior counsel – whose rates would just be unaffordable. There was thus a problem there if the IR could still try to convince the Chief Justice or get the Minister of Justice to assist them to allow the IR to appoint a retired judge. The IR had found that the retired judge had agreed to sit on the enforcement committee, but the Chief Justice refused it.

The Chairperson thought that the IR should be thinking about a plan B because it was quite possible that a stalemate might be reached. Even with retired judges or judges discharged from active duty, the experience was that quite a number of them would still want some form of remuneration although they did receive their pension in the form of a salary until they died. However, for any additional work, a number of them still wanted additional money even when they were appointed to chair commissions of enquiry and there were those that did not. For instance, it was known that Justice Dikgang Ernest Moseneke had chaired the Life Esidimeni in Gauteng, he did not want to take the money. He thought that the issue was if the Chief Justice strongly felt that a retired judge should not serve, even if there were 10 retired judges who would want to, then it would still be a serious issue if he was not convinced. The issue was what would be done to ensure that the IR passed through that impasse.

Adv Tlakula said that what the IR thought should be done—because the consultation in law was with the Chief Justice and the Minister and because the Chief Justice had pronounced himself and the Minister of Justice had not—was to hear the view of the Minister of Justice. Once the Minister of Justice had pronounced himself, the IR’s plan B was to get a practitioner. The IR had already said that they would then have an open process and perhaps approach the Bar Council or Legal Practitioners Council to identify people who might be interested. The IR would then have some sort of conversation with them, not necessarily an interview but just a conversation about what this was all about. This was thus the IR’s plan B, but they were waiting for the Minister of Justice to respond to them.

Mr Mosala responded to the questions on the separation as it related to administrative work. The IR had identified three areas that they had wanted to separate from the finance part of the DOJ. To this end, the IR had been given access to, among others, PaySal so that they could appoint and pay employees. The IR could not create structure on those systems, and to that end, they had separated in a way although the system still lay in the DOJ. On the Information Technology (IT) side, the IR had its own website. The IR had separated a lot of areas of IT and was just awaiting State Information Technology Agency (SITA) to come on board in terms of accommodating the IR in that space. The IR had also separated on the HR part and was doing all of their appointments and approving them here, so they no longer had to travel to Pretoria just to do an appointment. On the operational side, the IR had almost 80% separated. However, all of these things were accounted for at the regional office of the DOJ, so the IR was not accounting for any of them. On the issue of underspending, it was the projected figure which meant that during the year there might be issues where people resigned and others coming on board. Given the 10% vacancy rate that the IR had targeted, they had also projected that it may result in the R4 million underspending. This was an issue that the IR was managing but it was also an issue with which they had dealt.

Ms Teboho Ramosangoana, Chief Information Officer, IR, responded to the questions relating to the portal registration, ICT, and separation of ICT. The IR had a few systems that were already in place and were being managed by the IR. For example, the IR had its own emails, website, and was working with SITA in terms of hosting the registration portal as a complaints management system. Regarding HR, the IR had appointed a few ICT staff that provided ICT support to the IR. The IR had implemented ICT infrastructure in the office to allow connectivity and also had an IT Analysis Manager who dealt with IT analysis and security services. The IR was working with SITA so that they could be moved to the government network. SITA would then be the IR’s operator. Regarding the registration portal, the development of the portal had been completed, tested, and quality checked the registration portal for a very long time. The IR was now in the final stages of working with SITA as they would be hosting the registration portal for the IR. The IR was thus working on this now in order to deploy the registration portal.

Regarding the complaints management system, the IR had envisioned that they would start with the project in the previous financial year. What the IR had done in the previous financial year was that they had appointed SITA to be the developer and hosting service provider for the complaints management system. In the beginning of the current financial year, the IR had issued a purchase order to SITA as they could not do it in the previous financial year due to budget constraints. This was the portal that would cost the IR about R8 million but they were working with SITA on this aspect. Regarding the 80% achievement of ICT initiatives, and more specifically with regards to security, one of the IR’s key priorities for the current financial year was to ensure that they put in some security controls so that they were protected and their information guarded. The IR had already started working on this and had already procured firewalls and was busy with ICT security policies and procedures. In the current financial year, The IR was looking at procuring more tools that would assist them in terms of security control as this was also their priority.

Mr Nemasisi responded to the matters relating to the content and TransUnion security compromise that had been reported to the IR. The IR had taken its own initiative compliance assessment on the security measures which TransUnion, as the responsible party, was required to put in place to protect the personal information. The IR had already indicated to TransUnion that they were conducting their own initiative assessment. Ms Ramosangoana was leading that assessment of TransUnion. The IR was hoping that by the end of May 2022 they should be able to finalise their assessment of whether TransUnion had complied with the provisions of the POPIA, especially certain conditions that dealt with the obligation of all responsible parties to ensure that they had appropriate security measures to protect personal information. It had to be highlighted that the credit bureau was one of the sectors that the IR was regulating because it collected the majority of South African’s personal information. The IR was thus monitoring and attending to it, and by the end of May 2022, they should be able to finalise the assessment.

Regarding the appraisal of the investigation about the DOJ security compromise, the IR had also engaged the DOJ on their own initiative because of security compromise. The angle that had been taken earlier on was to engage with the DOJ without using the IR’s enforcement mechanisms. This seemed to be failing as the IR was not getting any cooperation. The IR had thus decided that they were now going to invoke their enforcement mechanisms so that they could be given access to the system and all the documents that they required for them to finalise their enforcement mechanisms. Therefore, the angle that the IR now took was that they should use their enforcement mechanisms so that they could get all the information required to finalise the assessment. The assessment had commenced but the IR was getting frustrated in finalising it due to lack of cooperation from the DOJ.

Lastly, on the matric results, the IR had briefed the Committee on this matter during their visit to the IR’s office. The IR had taken a position on this and it was communicated to the DOJ regarding how the IR felt about the publication of matric results. The patterns that had been happening had happened before the promulgation of the POPIA and it could not be that parties should continue without respecting the current legislation that Parliament had approved. The IR had communicated their position to the DOJ but unfortunately at that time because it was an urgent application, the IR could not have entered it in terms of the court. However, the IR was going to engage the DOE in terms of them ensuring that all the processing of personal information, especially those who were doing matric, should be in line with all eight conditions for the lawful processing of personal information. The IR was hoping that before the publication of the next results the DOE should be in compliance with those eight conditions.

On the response from the DOH, the IR had not received a response but he said that a meeting had taken place the previous day. The IR would follow up with the DOH for them to respond to the IR’s letter that they had written to them regarding the personal information that had been collected during the COVID-19 pandemic. The DOH had collected a lot of personal information, particularly those who had done the tests for COVID-19 and tested positive, so the DOH had the database. The regulations that the IR had described were what had to happen and the IR had taken a decision that they would monitor the DOH to ensure that the information that they had collected was actually managed in accordance with the provisions of the POPIA.

Regarding the low complaints that the IR received under the PAIA, the IR had focused mostly on the POPIA in terms of public education and awareness. In terms of the new financial year, Members had seen the IR’s plan and they were going to focus much more on the PAIA. He thought that the awareness was going to assist a lot of people to be able to understand that the IR was here now and that if those services were provided for free, they could then start with the complaints. The IR had seen an increase of complaints against private bodies in terms of access to information, which was very encouraging. In the past, the IR had always thought that access to information was being requested of private bodies but the IR had seen an increase of request complaints that they had received if there was much more access to information from private bodies. Normally the IR would finalise them and some of them would go to the enforcement committee.

Adv Collen Weapond, Full-Time Board Member, IR, dealt with the data breaches. The IR had looked at the data breach from TransUnion and had also analysed the 2020 data breach from Experian. The IR had received subsequent correspondence from Experian who had explained that there might have been a linkage between the data breaches. The IR had then looked at both and was in the process of writing a report which they were going to present to the Hawks for further investigation because they had a standing arrangement with the Hawks. Secondly, the IR was establishing a Data Breach Unit within the organisation, which would then be responsible for analysing and processing data breaches or security compromises. The IR was in the process of developing its processes, which were framework and strategy. Those two documents would then assist the IR in their approach.

The IR had also done some initial benchmarking with Ireland in Canada, with regards to how data breaches are managed – from simple data breaches to complex data breaches. The IR was also in the process of developing its model. Some of the skills would be sourced through a type of panel approach and other types of skills would reside internally. The IR had acquired one very competent person, Mr Masibu, and he was currently assisting with analysing data breaches and engaging with TransUnion and assisting where possible and necessary with the investigation in the TransUnion space. The IR had started analysing the information that they had received from TransUnion and was also requesting more information from TransUnion. As soon as all of the information is received the IR would make sure that the report is compiled and present it to Members for consideration and approval.

Regarding the linkages between the protection of personal information and the cybercrime legislation, sections 2 to 10 of the Cyber Crimes Act mirrored section 19 of the POPIA insofar as unauthorised access and data breaches were concerned. The IR was in the process of engaging with the council that would be established through the Cyber Crimes Act and would then come up with a proposal of how interaction and engagements would be pursued. The IR would also continue strengthening their engagements with the Hawks because that was their point of entry with regard to criminal investigations. On the educational aspect thereof, there was some material that the IR had analysed from other jurisdictions such as the Information Commissioners Office in the United Kingdom. That material then pointed to the IR trying to look at what their environment dictated and how they could then roll out this sector approach.

He explained that it would include the IR going sector by sector and trying to do those types of awareness. Public awareness was also on the radar where the IR would educate communities about their safekeeping. The IR had a standard arrangement with the South African Social Security Agency (SASSA) and they were also going to engage, as they had done in the past, the Black Sash as part of the nongovernmental organisation sector approach. This was so that the IR would then have a wider approach to community engagements with regard to how personal information should be protected to avoid access thereto. The IR had also learned, through the Experian and TransUnion data breach, that they should be doing and conducting regular cybercrime awareness. The IR was also in the process of looking at the National Cyber Security Advisory Council in the Department of Communication and Digital Technologies to work on an approach and develop the material.

Ms Shube responded to the questions relating to HR and corporate services. Currently, the IR had 86 filled positions and seven vacancies. The vacancy rate stood at 7.5%. The IR’s target was to have a vacancy rate that was below 10% in the previous financial year and they had achieved that target. In the previous financial year, the IR was given funding to fill positions and to establish the administration of the IR, wherein they were able to fund 43 positions with the funds that were allocated to them. All of the 43 positions were filled to date. The IR had then identified 12 positions for phase four. All 12 of the phase four positions were currently filled – six of them were filled with effect from 1 January 2022 because the IR had realised the savings from the previous financial year's budget and was thus able to fill them earlier, and six of them were advertised in January 2022 and filled by 1 April 2022 because they were only funded with effect from 1 April 2022.

Regarding the seven vacancies that the IR had, five of them were as a result of resignations which had occurred between the months of March and April within the current financial year, one was a promotion which had happened with effect from 1 May 2022, and the last position was the senior manager for data breach wherein the IR was currently busy with the organisational design processes so that they would be able to fill the position. On the position of CFO, as the Committee was sitting today, the candidates were writing their competency assessments as interviews had been conducted. The IR planned to issue offer letters by the following week. If all went well, given that whoever would be appointed may want to serve notice in June, by 1 July 2022 the IR should be having the CFO appointed. In addition, the IR had also appointed nine interns. There were ten interns and one was offered a position somewhere else so the IR was left with nine interns in the IR who were assisting. The target of 10% vacancy rate would continue to be achieved.

Regarding the funding and the projected underspending for compensation of employees, the IR had already requested a rollover from Treasury. The IR would see, during budget adjustments, whether Treasury was able to give them any funding. However, the IR noted that Treasury may not be able to really assist as at now within classifications. The IR would have to wait until the budget adjustments to see whether Treasury would be able to shift between classifications and give the IR more funding for their groups and services. The projected underspending may decrease looking at the fact that these positions would be filled as soon as it was possible. Mainly, by July 2022, most of them would have been filled.

Adv Tlakula responded to the questions regarding the target for complex complaints in that the target was too low for the POPIA in particular. For the POPIA, the IR had put the target as it was because the POPIA had a lot of processes and work that had to be dealt with on a daily basis and with large volumes. For instance, applications for prior authorisations came in hundreds and the IR had processed more than 400. There were also applications for codes of conduct, exemptions, processing personal information of children, and processing personal information. This was voluminous work. Taking that work into consideration as well as the capacity that the IR had, that was why the IR put the target of complex complaints at the figure they had put.

Mr Nemasisi added that, in terms of the PAIA targets, it was also similar to the reasons provided under the POPIA. It was much more due to capacity constraints because the IR still had a low number of staff that would be able to handle bulks of complaints. It was also much more than the IR did not know how many complaints they would receive and they tried to avoid overstretching the capacity that they had. Now that the first time that the IR had received complaints was in September 2021, in the new financial year they would be able to at least have a dashboard on what they should expect in terms of complaints and plan properly. As the case was now, the IR could only estimate that depending on the number of complaints that they had received they might only be able to do 50%. In the new financial year, it would be much easier to plan because the IR would have known the number of complaints that they had received. The IR had anticipated a high number of complaints and, looking at capacity, they thought that they may not be able to attend to all of those complaints.

Mr Dimba responded to matters raised around public awareness, education programmes, and low targets. On the 5% target on awareness, it was correct that the figure was based on historical work that had been done before the IR had been established. This was the work that had been done by civil society organisations that had been working in the area for a while, but also some surveys which showed that generally, South Africans were aware of the idea of the right to know. People would say, “Of course I have a right to know what government is doing”, but when they were asked about the legal instruments that enabled them to exercise the right to know it was largely found that people were not aware of the right itself in section 32 of the Constitution of the Republic of South Africa, 1996, as well as the enabling legislation being the PAIA. The IR expected that it would be the same with the POPIA and the PAIA currently. At the highest, the IR would have about 15% of the respondents indicating awareness of section 32 and the PAIA. The target was thus informed by that historical work but the IR wanted to push that level of awareness in accordance with what they had and the strategic plan to something around 25% at the end of the five-year period.

Regarding the content of educational programmes, the IR intended to be structured in how educational programmes were delivered on the PAIA and the POPIA. To this extent, the IR had engaged with institutions that they believed would be advantageous if they were to partner up with them. For instance, this included the Justice College, universities in South Africa, and the South African Local Government Association (SALGA) in terms of local government capacity building. The IR wanted to put in place sustainable programmes – not ad hoc training or education that tended to happen, but something that could be standardised and live beyond the plans of each of the institutions that were involved in this effort. The work was ongoing and would ideally lead to a place where the IR is able to provide accredited training programmes, but that was a long-term vision. For now, the IR would offer non-accredited training while they put in place systems to be able to offer accredited training in terms of the South African Qualifications Authority (SAQA) and National Qualifications Framework system.

On the issue of educational programmes catering for people with disabilities, the IR had taken an organisational position and policy that whatever public awareness programmes they ran, including webinars and seminars etc., they would always ensure that they had sign language interpretation. The IR had a standard arrangement with a certain provider, who was always present at the IR events and activities. The IR also made sure to produce all of their materials in braille. One would find the POPIA training manual available in braille, as well as other public awareness materials that the IR had produced in braille. The IR was quite intentional in how they made sure that they reached out to all parts of South African communities, and these were some of the ways that they achieved that.

The Chairperson asked if Mr Dimba had looked at the risk of offering the unaccredited training courses because, generally, the perception amongst people was to equate the offering of unaccredited qualifications to thuggery. This was because quite a number of people had taken advantage of South Africans. Has the IR looked at the risk to the reputation of the institution?

Mr Dimba said yes, that was why the IR’s plan was to be in a position where they are able to offer accredited training. The process of being able to offer accredited training was a quite lengthy and involved one. There were a number of things that SAQA would want to see and that the IR would need to produce before they are able to be given the right to provide accredited training. There was thus a 12-month plan that the IR had put in place that would lead them to a point where they are able to offer accredited training. The IR had felt that given the demand that they had currently, particularly from public institutions that wanted training, they needed to be able to respond to that request to some extent while they had the formal process of accreditation unfolding.

The Chairperson asked if the IR had indicated to those institutions or anyone who would be receiving the IR’s training that it was not accredited.

Mr Dimba confirmed that the IR made it clear.

The Chairperson asked what their response was.

Mr Dimba said that at this point what people were looking for, or at least the institutions that the IR had engaged with, was for their people to be able to comply with the POPIA in particular and the PAIA to some extent. These institutions took comfort in the fact that the training was provided by the IR and they believed that by so doing it would be credible training. It may not be accredited, but it would be credible training because it came from the IR. It thus seemed to provide the comfort that the IR was doing the training as opposed to quite a number of entities outside who were running training on the PAIA but which the IR was not really comfortable with. If the IR received a request for training, they would not say to a requester that they should go and approach another service provider or company. The IR would rather keep it in-house, that way they were sure of the quality and content that would be provided.

Ms Shube responded to the question on office space and how the IR was dealing with the issue vis-a-vis the appointment of staff. She said that, as she had presented earlier, the IR was looking at getting additional office space. The IR was currently having discussions with the landlord to see if they could not get additional office space. What the landlord had promised the IR, which the IR still had to explore, was that the landlord was looking at providing the IR additional office space using the current contract at no cost. The IR was currently using a hot desk model where everyone could have access to any office in the organisation. Staff were thus able to work – if they came in, they would find a space available and utilise that space to do work. Staff did not report to work on a daily basis. At a minimum, all employees should be in the office three days per week to allow space for social distancing so that the IR could also deal with the managing of COVID-19. This was how the IR was currently dealing with the issue of office space. Those who could work from home were given that opportunity to work from home, however, they should be in office at least three times per week.

The Chairperson said that it had to be remembered that when the Committee was at the IR, the IR had raised the issue of office space. The Committee had even said to the IR that they should seriously explore the issue of hot desks and to what extent it would be part of the IR’s permanent strategy going forward because the resources that they had should be used sparingly. What was quite clear was the IR’s offices were properly demarcated.

Ms Shube said that the Chairperson was correct: the IR’s offices were properly demarcated. However, as the stage complement was increasing there was seriously a shortage where it would be found that even those who were in open plan were still brought together into one small space. It would not be a significant extension that would be provided to the IR and it would be at no cost. The IR was exploring the hot desk model, which was going to be their strategy for now because they did not really have funding to get office space for each and every employee in the organisation. Members may have seen the floor that was completely open plan, so any employee who came to the organisation was able to report for duty and have a space to work on.

Closing remarks
The Chairperson thanked the IR for their engagement. The issues that the Committee would like a speedy resolution of was the firstly the issue of the chairperson of the enforcement committee. It was quite important, and the Committee would also engage the Minister of Justice to make a decision and respond to the letter that the IR had written to him so that they could be able to explore all of their options. It was important that the enforcement committee start working, including the approaching of some of the senior counsel and senior attorneys who would be prepared to work pro bono. The issue of the ransomware attacks was a matter that was also of concern to the Committee. The Committee was quite shocked that the IR was not receiving the necessary cooperation from the DOJ. The Committee would follow up with the DOJ because they thought it was important that the DOJ be the first to lead by example in ensuring that they cooperated with the institutions that had been created through an Act of Parliament.

The issue of the listing of the organisation was long overdue. The IR had raised it on a number of occasions and the Committee would engage with the Minister to ensure that he raised the matter quite sharply with his counterparts in the Finance department. The Committee would also raise it as part of their budget debate to ensure that the matter is responded to. If the Committee did not find the necessary cooperation or responses, they would then take it further from there. He thanked the IR for the briefing that they had given the Committee. The Committee would still go through the briefing and would also look at other issues that they might need to take up on the IR’s behalf and that they might not have heard properly. The Committee would revert back to the IR as soon as it was practically possible.

On the issue of the separation, it was also important that by the time the Committee met with the IR the next time, the Committee should be giving the IR feedback as to the interventions that they would have made to ensure that was remaining of the separation was done. The Committee understood that the listing would also have an impact on the IR’s 100% separation, so it should be something that would be one of the IR’s first actions on their radar and should be sold as soon as possible. The Committee was in constant contact with the Deputy Minister of Justice and Correctional Services, Mr John Jefferey, who had assured the Committee that the Department and the process led by him were in contact with the IR with respect to the issues that had been raised during the last engagements that the Committee had had with the IR on their conditions of service and other issues relating to employment contracts.

He said that the Deputy Minister had informed him that the discussions were quite advanced, and that the IR had raised additional issues that they had wanted the Minister to look at. The Minister and Deputy Minister were thus looking at those issues, including the proper benchmarking as to which of the institutions. The Committee was aware that the IR had used, for instance, the issue of the institution responsible for South African elections as the benchmark from which the IR wanted to be benchmarked. The work was continuing, and the Chairperson was receiving the briefings continuously. The Committee took up matters that the IR had raised with them very seriously and they wanted to ensure that by the time they finished their term all of the issues should have been resolved. He thanked the Adv Tlakula and her team.

Adv Tlakula tendered the apology of Adv Lebogang Stroom-Nzama, Full-Time Member, IR, as she was representing the IR at the meeting of the African Network of Data Protection Authorities in Morocco.

The Chairperson clarified that the IR had wanted to be benchmarked with the Independent Electoral Commission of South Africa (IEC).

Mr Mosala confirmed that the IR would make those follow-ups and come back to the Committee with progress reports.

Consideration and Adoption of Reports

Report of the Portfolio Committee on Justice and Correctional Services on the Annual Performance Plan for 2022/23 of the Office of the Chief Justice and Vote 27: Office of the Chief Justice
 The Chairperson said that the Committee would deal with two reports, being the Office of the Chief Justice and Correctional Services. The Office of the Chief Justice report was circulated to Members the previous day and he took it as though Members had gone through it. He went through the report and asked whether Members had any corrections or otherwise moved for the adoption of the report.

Adv Breytenbach moved for the adoption of the report.

Ms Newhoudt-Druchen seconded the adoption of the report.

The Committee duly adopted the report.

Report of the Committee on the budget vote 2022 of the Department of Correctional Services
Ms Newhoudt-Druchen said that she had followed the Committee draft programme, so she had not read this report yet. However, if the Chairperson could give her some time, she could read it quickly. According to the programme, it said that the Committee would be adopting the report on the upcoming Friday.

The Chairperson asked how much time was needed. Could Members have 30 minutes to go through the report?

Ms Newhoudt-Druchen said that even 20 minutes was fine.

The Chairperson said that he did not want to rush Members. So that they could read with comprehension, he would allow 30 minutes.

The Committee reconvened at 12:35.

The Chairperson said that the report would be taken as read. He went through the report and asked if Members had any corrections.

Ms Newhoudt-Druchen said that at point 1.2 the second last line should be 2022 and not 2020.

Mr Swart referred to page 10, the Committee observations, and wanted to know whether the author of the report had ever read Dr Seuss. Could the Committee replace ‘eggs and pork’ with ‘green eggs and ham’ on a lighter note?

Ms Newhoudt-Druchen moved for the adoption of the report with corrections.

Ms Ramolobeng seconded the adoption of the report as corrected.

Mr Horn asked that it be noted that the DA reserved its position on both the report and the budget.

Mr Swart said that the ACDP also reserved its position.

Ms Yako said that the EFF would also like to reserve its position on the report.

The Committee adopted the report as corrected, with the DA, ACDP, and EFF reserving their positions.

The meeting was adjourned.
 

Download as PDF

You can download this page as a PDF using your browser's print functionality. Click on the "Print" button below and select the "PDF" option under destinations/printers.

See detailed instructions for your browser here.

Share this page: