3D"http://www.iweek.co.za/images/iweek-header.jpg"

Government to protect personal information Ensuring integrity of personal information

Author: Leon Engelbrecht
Issued: 26 Apr 2007

Expect added cost - and some benefit Seven years in the making, a new law is about to change business handles customer data

A NEW BILL is on the way that, on the face of it, = will add to the burden business carries in terms of cost, complexity and complia= nce. Like the National Credit Act and the Promotion of Access to Information Act (PAIA), the Draft Protection of Personal Information Bill is a civil rights= law meant to protect privacy in the era of Google and Big Brother.

In the words of John Brent, GM at Critical Identit= y, the Draft Bill proposed by the SA Law Reform Commission (SALRC) "will = give South African consumers protection from identity theft and online gangsters= by holding companies who fail to take adequate steps to protect consumers' pri= vate information, legally liable. In terms of the proposed law companies will be required to notify all customers affected by security breaches that could result in identity theft. Offenders could face up to 10 years in prison "as well as fines and punitive damages."

A BOON FOR BPO?

The Draft Bill should also be a boon to companies = in business process outsourcing (BPO) as one of its avowed intentions is to br= ing South African legislation in line with European Union BPO security requirements. It will also save companies time and hassle in that it provid= es for conciliation and mediation - costly court battles can be avoided with i= ndividuals who feel aggrieved. The Draft Bill, for that is where it is in the legislat= ive process, will bind everyone, including the state and also affords businesses and other juristic persons protection against nosy parkers and officious officials.

A TORTUOUS PATH...

But the 66-page draft is still some years from reaching Parliament, and even then may take a while to pupate from worm to butterfly. Ananda Louw, the researcher responsible for the project, says the SALRC is taking its time, something ICT lawyer Lance Michalson supports. "There is no point in rushing through legislation and then finding out that it will take years to implement, if at all," he says.<= /span>

Louw says the commission has been studying a priva= cy law from as early as the year 2000 when a Parliamentary Ad Hoc Joint Commit= tee on the Open Democracy Bill, later enacted as PAIA, requested the justice department to research and prepare a Bill on the matter.<= /p>

"In so far as timeframes are concerned it sho= uld be noted that the consultation process in this investigation was very impor= tant since the Bill will regulate each and every record containing personal information found in both the private and the public sector," Louw say= s. "It takes time to include everyone... However, a huge amount of work h= as been done in this investigation and it is about to be finalised."=

Louw says the draft is being evaluated by a project committee, chaired by High Court judge Craig Howie and headed by delictual expert Professor J Neethling. "As soon as it has been approved it will= be submitted, with the report, to the [SALRC] for final approval. Once it has = been approved the commission will submit the report and Bill to the Minister for Justice and Constitutional Development for consideration. It is envisaged t= hat the Commission process will be finalised in June 2007," Louw says.

Michalson cautions that even that is not the end. "There might be a Green Paper, a White Paper, then debate in the relev= ant Parliamentary portfolio committee, then certification by the State Law Advi= sor, then adoption by the National Council of Provinces and the National Assembl= y; and finally it will be sent to the President for signature and enactment in= the Government Gazette."

SO, WHAT DOES IT SAY?

The 400-page report accompanying the Draft Bill, a= ccessible at www.doj.gov.za/salrc/index.htm, is a thorough introduction to the subject and explains in copious detail the legal position elsewhere and the views o= f a raft of local respondents, including the Internet Service Providers Association, the Banking Council, the Financial Services Board, the Credit Bureau Association, Eskom, the SABC and even the Furniture Traders Associat= ion. All made substantial contributions that were included in the reasoning underlying the wording of the draft - except perhaps the SABC which was afr= aid the proposed law would make it difficult to trace TV licence defaulters.

The report notes that privacy is a valuable aspect= of personality and that data or information protection forms an element of safeguarding a person's right to privacy. In South Africa the right to priv= acy is protected in terms of both our common law and in the constitution. Howev= er, the right is not absolute, but may be limited in terms of law of general application, and has to be balanced with other rights.

Consideration "must also be given to competing interests such as the administering of national social programmes, maintain= ing law and order, and protecting the rights, freedoms and interests of others, including the commercial interests of industry sectors such as banking, insurance, direct marketing, health care, pharmaceuticals and travel servic= es. The task of balancing these opposing interests is a delicate one", the report observes.

Concern about information protection has increased worldwide since the 1960s as a result of the expansion in the use of electr= onic commerce and the technological environment. "The growth of centralised government and the rise of massive credit and insurance industries that man= age vast computerised databases have turned the modest records of an insular society into a bazaar of information available to nearly anyone at a price," Louw's team observes. "The question is no longer whether information can be obtained, but rather whether it should be obtained and, where it has been obtained, how it should be used," the report adds. W= ell over thirty countries now have information protection statutes. "A fundamental assumption underlying the answer to these questions is that if = the collection of personal information is allowed by law, the fairness, integri= ty and effectiveness of such collection and use should also be protected."= ;

THE EU DIRECTIVE

Turning to the 1995 EU Data Protection Directive (95/46/EC), the report says the EU "imposed its own standard of protec= tion on any country within which personal data of European citizens might be processed." It notes the directive stipulates that personal data should only flow to countries that can guarantee an "adequate level of protection".

The report continues: "Privacy is therefore an important trade issue, as information privacy concerns can create a barrier= to international trade." Later on, the report notes that the EU does not define "adequate" and that the standard has thus far been met thr= ough the inclusion of appropriate clauses in contracts. PAIA, the Electronic Communications and Transactions Act and the National Credit Act also provide safeguards that arguably meet the EU's test.

The central pillar of the draft legislation is an Information Protection Commission with its powers to investigate, search and seize, and enforce data privacy and security. It also has the power to issue codes of conduct, educate, research and report. In its work the commission = is assisted by an Information Protection Officer. Like the Information Officer appointed under PAIA, this is a company employee.

Every organisation that collects personal data is required to have such a person and to register them with the commission. Am= ong this person's duties is providing prior notice to the commission in every c= ase where personal data is processed. The intention is clearly to create a paper and audit trail for every act of commission or omission to prove - or dispr= ove a privacy or security breach. The commission, in turn, enters all this information into a register that is freely accessible to everyone, the thou= ght being that one cannot protect one's rights where one is ignorant that they might be violated.

MORE GOOD THAN HARM?

Although compliance may appear onerous and costly,= the legislation provides for exemptions, the legislation requiring the commissi= on to "have due regard for the protection of important human rights and social interests that compete with privacy, including the general desirabil= ity of a free flow of information and the recognition of the right of government and business to achieve their objectives in an efficient way..." It may also provide BPO and security vendors with the opportunity to develop new products or applications to automate the notification process and reduce co= sts.