APPLICATIONS TO THE INFORMATION REGULATOR FOR PRIOR AUTHORISATION
The Information Regulator has issued a Guidance Note to guide responsible parties who are currently processing or intend to process personal information which is subject to notification to and prior authorisation from the Information Regulator to ensure compliance with the relevant provisions of the Protection of Personal Information Act 4 of 2013 (POPIA).
An application to the Information Regulator is required to be made prior to processing or any further processing of:
- Unique identifiers (contact details, any account number, identity number, policy number, employee number or the like), for a purpose other than the one for which the identifier was specifically intended at collection with the aim of linking the information together with information processed by other responsible parties.
- Information related to criminal behavior or unlawful or objectionable conduct of a data subject on behalf of third parties. (this will include criminal record enquiries and reference checks).
- Personal information for credit reporting. Credit bureausregistered with the National Credit Regulator or any person processing personal information for credit reporting purposes like credit providers, may apply for prior authorisation.
Responsible parties may not carry out information processing that has been notified to the Information Regulator until the Information Regulator has completed its investigation or until they have received notice that a more detailed investigation will not be conducted. (An affirmative decision may however be assumed if no response is received from the Information Regulator within prescribed time frames.)
This requirement can be overcome by the registration of an approved Code of Conduct applicable to the responsible party and does not apply to processing which takes place prior to 1 July 2021.
Failure to obtain prior authorisation is an offence and upon conviction may lead to a fine or to imprisonment for a period not exceeding 12 (twelve) months, or to both a fine and such imprisonment.