Understanding the power of the POPI Act
Following the acquisition of the marketing for the Ekurhuleni Business Initiative Forum (EBI), by the Marketing Fanatics Digital Department, digital marketing specialist Kirstin Harris recently delivered an informative presentation to the EBI.
Harris covered the important aspects of the Protection of Personal Information (POPI) Act and the significant impact it has on individuals and businesses, from a marketing perspective.
The marketing space is evolving at a rapid pace, with a clear shift in mindsets, as well as a distinct level of governance in the way marketing is practiced.
The Government published the POPI Act in the Government Gazette on November 26, 2013, directly impacting several industries, including the marketing and communications industry.
Some of the key elements covered in Harris’s presentation included:
- Aims of the POPI Act.
- To who does the POPI Act apply?
- Implications for businesses and individuals.
- Understanding the scope of personal and processing.
- Information protection principles for compliance.
During the presentation, the aims of the Act were clearly defined as establishing how information is collected and processed, to establish an informational regulator to regulate the collection of the information, the flow of information across South African borders and, most importantly, to give rights to South Africans receiving unsolicited communication.
Harris further elaborated on practical, everyday examples, in which people divulge information without ensuring they ask the correct questions.
“With reference to opening bank accounts, we provide a vast amount of information, yet we neglect to understand how this information will be stored and used in the future,” said Harris.
The POPI Act now gives individuals the right to ask businesses and service providers how their information will be used.
Ideally, compared to basic rights enjoyed by all South Africans, the POPI Act is applicable to any person or business.
Harris explained that, if people receive or give any personal information to another party, then POPI applies to them.
“With the number of laws and Acts being passed, the relevance to individuals and businesses is often lost in the legal noise,” she said.
This informative presentation carefully unpacked the bearing this law has on individuals, highlighting the implications of having your personal information exploited, with identity theft being one of the risks.
Consumer intelligence and buying power is changing the way companies market their products and services, and the POPI Act now places businesses under legal obligation to take responsibility for collecting, processing and using, storing and sharing customer information.
As per the South Africa legal system, failure to comply with the POPI Act will result in legal ramifications.
Harris added that the penalties for failing to comply are a possible 10-year jail term or a R10-million fine.
Harris elaborated on the eight information protection principles for compliance:
- Accountability – companies are now accountable for overseeing their compliance.
- Processing limitation – consent and purpose. This simply means processing of information or sharing of information has to be done under explicit consent from the individual in question. Information collected should be in relation to the purpose.
- Purpose specification – individuals should be fully aware of what their information will be used for.
- Further processing limitation – this principle further highlights the legal obligation businesses have to use the personal information for specific and legitimate purposes.
- Information quality – organisations are required to ensure that the personal information they process is completely accurate, not misleading and updated where necessary.
- Openness – individuals must be informed of what information is being held by specific entities.
- Security safeguards – organisations are required to ensure that all personal information is kept secure and, should any information be compromised affected, persons should be notified immediately.
- Data subject participation – what you say goes. After having handed information over to a business you are able to request any changes or deletion.
According to Harris: “The POPI Act is fast changing the way responsible marketing agencies conduct their daily business and creating great opportunities to engage in meaningful marketing activities”.
