DATA PROTECTION AND PROTECTION OF INFORMATION. You think knowledge, we think

Transcription

1 DATA PROTECTION AND PROTECTION OF INFORMATION You think knowledge, we think

2 Our horizons are as broad as your business vision

3 Our Firm Our Footprint in Africa Bowman Gilfillan Africa Group is a leading Pan-African law firm. Our track record of providing specialist legal services, both domestic and cross-border, in the fields We provide integrated legal services throughout Africa from eight offices (Antananarivo, Cape Town, Dar es Salaam, Durban, Gaborone, Johannesburg, Kampala and Nairobi) in six countries (Botswana, Kenya, Madagascar, South Africa, Tanzania and Uganda). Nigeria Uganda Kenya Tanzania of corporate law, banking and finance law and dispute resolution, spans over a century. We work closely with leading Nigerian firm, Udo Udoma & Belo-Osagie, which has offices in Lagos, Abuja and Port Harcourt, and have strong relationships with other leading law firms across the rest of Africa. Botswana South Africa Madagascar With eight offices in six African countries and over 400 specialised lawyers, we are differentiated by our geographical reach, independence and the quality of legal services we provide. We draw on our unique knowledge of the African business environment and in-depth understanding of the socio-political climate to advise clients on a wide range of legal issues. Our aim is to assist our clients in achieving their objectives as smoothly and efficiently as possible while minimising the legal and regulatory risks. Our clients include corporates, multinationals and state-owned enterprises across a range of industry sectors as well as financial institutions and governments. We provide coverage of francophone OHADA jurisdictions across the continent (including Benin,Burkina Faso, Burundi, Cameroon, Central African Republic, Chad, Congo Republic, Democratic Republic of Congo, Gabon, Guinea, Ivory Coast, Mali, Mauritania, Niger, Rwanda, Senegal and Togo) from our office in Madagascar. Our Kenyan, South African and Ugandan offices are representatives of Lex Mundi, a global association, with more than 160 independent law firms in all the major centres across the globe. This association gives us access to the best firms in each jurisdiction represented. Bowman Gilfillan Africa Group offices Best friends office Francophone Africa coverage Significant transactions or advisory experience Our expertise is frequently recognised by independent research organisations. We have been named Africa Legal Adviser by DealMakers for the last two consecutive years (2014 and 2015). Most recently we won the Competition and Regulatory Team of the Year and the IP Team of the Year Awards at the prestigious African Legal Awards hosted by Legal Week and the Corporate Lawyers Association in 2015.

4 Our Data Protection and Protection of Information Group Background: The Common Law and Constitutional Right to Privacy The Bowman Gilfillan Data Protection of Information practice group includes expert members of the Bowman Group s Technology, Media and Telecommunications (TMT), Employment, Employee Benefits and Forensics & Compliance divisions. Our team has extensive experience in advising and acting for clients in various sectors in South Africa, including international telecommunications operators and equipment manufacturers, pharmaceutical companies, financial institutions - and employers in general - in respect of data protection issues (both in respect of the common law and constitutional right to privacy, and in respect of the provisions of the Protection of Personal Information (PoPI Act). If a responsible party processes personal information about individuals and - in some instances - companies, then that party has a number of legal obligations to protect that information in terms of the Protection of Personal Information Act (the PoPI Act). The PoPI Act is specific data protection legislation which was assented to by the President on [insert date], and which will come into effect on [insert date]. The PoPI Act contains a transitional period such that all processing of personal information must comply with the provisions of the Act within one year after its commencement, although this period may be extended to three years. Prior to the implementation of the PoPI Act, no comprehensive data protection or privacy statute had been adopted in South Africa in terms of which mandatory data protection obligations were imposed on data controllers with regard to the processing of personal data. Instead, the processing of personal data was regulated in terms of the constitutional right to privacy (which includes informational privacy), contained in section 14 of the Constitution of the Republic of South Africa, 1996, the common law right to privacy under the law of delict (tort), and requirements that emanate from certain other legislation such as, for example, the Electronic Communications and Transactions Act 25 of 2002 which (prior to the PoPI Act coming into effect) listed nine data protection principles which could be complied with on a voluntary basis. In terms of the common law and constitutional right to privacy, data subjects have an objectively reasonable expectation of privacy, which may not be wrongfully or intentionally interfered with.

5 The Effect of the PoPI Act The purpose of the PoPI Act is to give statutory effect to the constitutional right to privacy, by safeguarding personal information when processed by a responsible party, subject to justifiable limitations. As a result of the PoPI Act, any party that collects, holds and uses individuals personal information will have to do so under certain conditions. The requirements will apply to personal information that is held in relation to employees, customers and clients, prospective customers and clients, visitors to premises, and any other personal information that a business holds in the context of its particular activities. The PoPI Act also establishes a data protection authority (called the Information Regulator), and imposes requirements in relation to cross-border transfers of personal information and direct marketing activities. The PoPI Act is very similar in substance to the UK Data Protection Act 1998, which is how the UK implements the European Union Data Protection Directive (Directive 95/46/ EC), a directive adopted by the European Union designed to protect the privacy of all personal data collected for or about citizens of the European Union, especially as it relates to processing, using or exchanging this data. As such, while there is, at present little guidance on how the provisions of the PoPI Act are to be interpreted, some guidance may be sought from the guidelines published by the UK s Information Commissioner s Office (ICO). Although the PoPI Act has an effect on all entities to some extent, as most employee-related information is personal information, certain entities that deal extensively with personal information will be particularly affected. These include, for example, retirement funds, medical schemes, short-term insurance providers, pharmaceutical companies which conduct clinical trials, banks, credit providers and credit bureaux.

6 Balancing information with privacy

7 The PoPI Act: A Practical Perspective From a practical perspective, there are a few steps that each business (or Responsible Party) should take to ensure that it complies with the PoPI Act: Consider the nature of the Responsible Party s business: (1) identify what personal information the Responsible Party processes, and (2) identify the circumstances in which the Responsible Party processes that personal information (e.g. what is the purpose for processing the personal information; how is the personal information used; etc.). Consider the processes that the Responsible Party has adopted in order to collect, record, store, update, modify, use or disclose the personal information. Where the Responsible Party processes personal information, including the collection of personal information, it must define the purpose for which that personal information is being processed. In other words, personal information must be collected for a specific, explicitly defined and lawful purpose that is related to a function or activity of the company. Personal information may only be processed if it is adequate, relevant and not excessive given the purpose for which it is processed. Where necessary, the Responsible Party must make sure that it has obtained the data subject s consent for the processing of his or her personal information, or make sure that the processing falls within one of the other grounds for justification (e.g. where the processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied). The Responsible Party must take reasonably practicable steps to notify the data subject when collecting his or her personal information. This notification should ensure that the data subject is aware of the following: what information is being collected, where the information is not collected from the data subject - the source from which it is collected, the name and address of the Responsible Party, the purpose for which the information is being collected, etc. If information is processed further, the Responsible Party must check to see whether that further processing falls within the defined purpose. If not, the Responsible Party may need to obtain the data subject s consent for that further processing or the Responsible Party may need to ensure that the further processing will fall within one of the other grounds for justification. The Responsible Party must check that the business has implemented sufficient security measures to ensure the integrity and confidentiality of personal information in its possession or under its control. This may require the Responsible Party to take appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of personal information. The Responsible Party must take reasonably practicable steps to ensure the quality of the personal information, and that it is complete, accurate, not misleading and updated where necessary. The Responsible Party must allow data subjects access to the personal information and allow for the correction of personal information (e.g. a data subject has the right to know the identity of all third parties that have had access to their information, and can also ask for a record of the information concerned). The Responsible Party must take steps to notify the Information Regulator of the processing of personal information, where processing is subject to prior authorisation (e.g. information on criminal behaviour or on unlawful or objectionable conduct on behalf of third parties, and the personal information of children). The Responsible Party must check the its processes for retention and destruction processes for personal information documents must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed unless, for example, the retention of the record is required or authorised by law. If personal information is being transferred across borders (i.e. outside of South Africa) in the course of the Responsible Party s operations, the Responsible Party must ensure compliance with the restrictions in terms of the PoPI Act (e.g. by obtaining the consent of the data subject to the transfer, or where the recipient of the information is subject to a law, binding corporate rules or binding agreement which provide an adequate level of protection). If the Responsible Party is using personal information to conduct direct marketing, the Responsible Party must check that the processes comply with the provisions of the PoPI Act (e.g. that the data subject has given his or her consent or, subject to certain conditions, that the data subject is a customer).

8 Clients and Recent Deals The Bowman Gilfillan Data Protection of Information team has extensive experience in advising and acting for various clients. We: Advised a major South African bank on the collection and dissemination of credit bureau information in the construction of marketing lists Advised AngloGold Ashanti on the application of global data protection practices in South Africa and various other African countries Advised ENRC on data protection issues and the drafting of appropriate notifications and consents Advised Bloomberg on various data processing activities for the capturing of client and employee information Advised Avios on the drafting of its data protection policy and general data protection issues Reviewed the privacy policies and end-user agreements of a marine electronics products manufacturer and advising on registration requirements Advised Avon on data collection and notification requirements Advised on data protection aspects of a transaction involving a data collection entity Advised a number of multinational corporations on various data protection issues, including background and criminal checks. Advising a major courier and postal service company on the deployment of new logistics services for the delivery of medical devices and medicines, including the use of personal information for delivery purposes Advised Bosch on the drafting of local data protection policies

9 Our Team Partners JEAN MEIJER Tel LULAMA MTANGA Tel CLAIRE REIDY Tel RUDOLPH LABUSCHAGNE Tel DEREK LOTTER Tel TAMARA DINI Tel GOMOLEMO KEKESI Tel MARYANNE ANGUMUTHOO Tel IONA DHLADHLA Tel LUCINDA VESTER Tel

10 BW 3833/8C Antananarivo Tel Fax Cape Town Tel Fax Dar es Salaam Tel Fax Durban Tel Fax Gaborone Tel Fax Johannesburg Tel Fax Kampala Tel Fax Nairobi Tel