“Unique Identifier”, as defined in POPIA, means any identifier that is assigned to a data subject and is used by a responsible party for the purposes of the operations of that responsible party and that uniquely identifies that data subject in relation to that responsible party”.

READ WITH https://www.justice.gov.za/inforeg/docs/InfoRegSA-GuidanceNote-PriorAuthorisation-20210311.pdf

https://www.justice.gov.za/inforeg/docs/InfoRegSA-GuidanceNote-Processing-PersonalInformation-Children-20210628.pdf

If after reading this Guide, the responsible party still requires help in completing the authorisation application form, it may contact the Regulator’s Customer Service Centre by email at: [email protected].

The guidance notes and application forms can be accessed at:

  1. Special Personal Information – https://www.justice.gov.za/inforeg/docs/InfoRegSA-GuidanceNote-Processing-SpecialPersonalInformation-20210628.pdf
  2. Personal Information of Children – https://www.justice.gov.za/inforeg/docs/InfoRegSA-GuidanceNote-Processing-PersonalInformation-Children-20210628.pdf

The Information Regulator published March 11 2021 the above Guidance Notes (‘the Notes’) advising Responsible Parties (‘RP’), why, how and when to apply for prior authorization (‘PA’) to process certain information.

Such PA is required for processing one or more of the following:

  • Unique identifiers of persons (the Data Subject: ‘DS’) to be processed for reasons other than originally intended AND with the intention of linking it with information processed by other RP – it is defined as ‘ any identifier that is assigned to a data subject and is used by a responsible party for the purposes of the operations of that responsible party and that uniquely identifies that data subject in relation to that responsible party”. Examples are bank account numbers; identity numbers & telephone numbers
  • Criminal behaviour, objectionable or unlawful conduct – examples are criminal records and disciplinary steps. This applies not only to the employer (RP) doing background checks on employees (current or potential) but third parties going it in behalf of the RP  
  • Credit reporting – as above and entities such as credit bureaus
  • Transferring personal information (‘PI’) or special personal information (‘SPI’) of children to a foreign country which incidentally includes storing it on/in ‘the cloud’ if such country or party does not ‘provide an adequate level of protection’ (‘by law; binding corporate rules or binding agreement’). Interesting for the tourism industry is that this action does not require PA if it has been carried out before July 01 2021 but it would appear to apply to ongoing processing!  

Here are a few of the details that have to be disclosed by the applicant:

  • Details of the RP similar to the manual
  • PI categories to be addressed
  • Reason for the processing
  • Whether the processing relates to a function/activity of the IR
  • Security measures
  • Staff: number employed & training
  • Has RP suffered any security breaches in last 3 months? 

However there are certain aspects of the PA that can create problems, hence it being referred to as a ‘conundrum’ (ENs March 16 2021) i.e.

  • The form must signed by an Information Officer approved by the IR – what if has not been done?
  • How is business (RP) expected to ascertain which countries offer the required levels of PI compliance?

Further guidance from the IR is required in this regard.

 © ADV LOUIS NEL

Louis-THE-lawyer

May 26 2021

DISCLAIMER – Each case depends on its own facts & merits – the above does not constitute advice – independent advice should be obtained in all instances

This series of articles will assist you in your compliance with POPIA and will address monthly the following topics: The Appointment of Information Officers; Code of Conduct; Prior Authorization (x2); Employees (x6); POPIA & PAIA Manuals; CCTV; Direct Marketing and further topical issues as they arise – if required online POPIA training sessions (1 – 1.5 hours duration including Q&A) can be arranged with Adv Nel

wanderers club POPI - PRIOR AUTHORISATION 1