EMBARGO: FOR IMMEDIATE RELEASE

The SALRC hereby releases its report on privacy and data protection. The report will be launched formally at a media conference which will be announced shortly. It contains the Commission’s final recommendations for the protection of personal information and a draft proposed Bill, the Protection of Personal Information Bill, which embodies proposals giving effect to these recommendations.

The Commission’s investigation into privacy and data protection commenced in 2003 with the publication of an Issue Paper. The investigation was included in the SALRC’s programme in response to a request received from the then Minister of Justice and Constitutional Development, who, in turn, received a request in this regard from the Parliamentary Ad Hoc Joint Committee on the Open Democracy Bill. The investigation was finalised in February 2009 with the submission of the final report and draft legislation to the Minister.

The Minister has subsequently sought and obtained Cabinet approval to submit the Protection of Personal Information Bill into Parliament. The Bill (B9/2009) is in the process of being tabled and can be accessed at http://pmg.org.za or obtained from Parliament, the Government Printers or the Commission.

Privacy is a valuable aspect of personality and data or information protection forms an element of safeguarding a person’s right to privacy. In South Africa the right to privacy is protected in terms of both our common law and in the Constitution. However, the right is not absolute, and consideration must also be given to competing interests such as the administering of national social programmes, maintaining law and order and protecting commercial interests. The task of balancing these opposing interests is a delicate one.

Concern about information protection has increased worldwide since the 1960s as a result of the expansion in the use of electronic commerce and the technological environment. Worldwide the surveillance potential of powerful computer systems has prompted demands for specific rules governing the collection and handling of personal information Technologies such as the Internet, mobile phones, digital cameras and social networking websites have also increased opportunities for private data collection.

Key users of personal information include telephone companies, retailers, credit bureaux, the health and medical profession, banks and financial institutions, the insurance industry, the direct marketing industry and public bodies such as government departments and agencies, educational institutions, local authorities and the police.

It is clear that information privacy touches almost every aspect of our daily lives and that if the personal information of a person is not protected the consequences can be serious. A person’s dignity, integrity and independence may be undermined if decisions are taken based on information that has been entered wrongly, is out of date, confused with someone else’s information, irrelevant, used for purposes that are incompatible with or contrary to the purpose for which it was collected or which has been partly and unlawfully destroyed.

Unprotected personal information may, furthermore, lead to identity theft and other criminal offences; the proliferation of unsolicited pornography, spam and direct marketing excesses. Children and other vulnerable parties are also currently unprotected especially in so far as the Internet (Facebook, etc) and other electronic devices are concerned.

Privacy is also an important trade issue as information privacy concerns can create a barrier to international trade. On a global economic level, an adequate international privacy protection rating will result in the free flow of information, both nationally and internationally, which will stimulate the economy and provide employment opportunities, for instance in the call-centre (Business Process Outsourcing) industry. Proper protection will furthermore ensure consumer confidence and trust in electronic on-line business activities. Privacy legislation will also provide a safe environment within which the current e-government initiative can be developed.

Finally, with the World Cup in 2010 upon us, South Africa needs a credible personal information environment to deal with the challenges of the surge of personal information collection and protection which will confront us.

The SALRC, inter alia, recommends as follows:

* Privacy and information protection will be regulated by a general information protection statute, with or without sector specific statutes, which will be supplemented by codes of conduct for the various sectors.

* The legislation is pro-active in nature, focusing on ensuring that proper systems are put in place instead of only policing encroachments.

* The Bill applies to both the public and private sector; to paper records as well as those held on computers; and to identifiable natural and juristic persons.

* The Bill will give effect to the following internationally accepted core information protection principles, and will provide that personal information must be -

* obtained fairly and lawfully;

* used only for the original specified purpose;

* adequate, relevant and not excessive to purpose;

* accurate and up to date;

* accessible to the subject;

* kept secure;

* destroyed after its purpose is completed;

* transferred to countries that ensure an adequate level of information protection only; and

* accounted for by the responsible party at all times.

* Provision is made for exceptions to the information protection principles. Exclusions and exemptions are furthermore possible for specific sectors in applicable circumstances.

* Special provision has also been made for the protection of special (sensitive) personal information. Special personal information includes information regarding children, religion, health and sex life, race, political persuasion and criminal behaviour.

* The Commission recommends a flexible approach where industries will develop their own codes of conduct (in accordance with the principles set out in the legislation), which will be overseen by the regulatory agency. Codes of conduct for individual sectors may be drawn up for specific sectors on the initiative of the sector itself or of the Regulator. This will include the possibility of making provision for an adjudicator to be responsible for the supervision of information protection activities in the sector. The Regulator will, however, retain oversight authority. Although the codes will accurately reflect the information protection principles as set out in the Act, it should furthermore assist in the practical application of the rules in a specific sector.

* Enforcement of the Bill will be through the Information Protection Regulator, using as a first step, a system of notices where conciliation or mediation has not been successful. Failure to comply with the notices will be a criminal offence. The Regulator may furthermore assist a data subject in claiming compensation from a responsible party for any damage suffered. Obstruction of the Regulator’s work is regarded in a serious light and also constitutes a criminal offence.

* The Regulator will administer both the new Protection of Personal Information Act and the existing Promotion of Access to Information Act.

The recommendations and draft legislation are the result of a profoundly thorough consultation process. Should these recommendations be adopted by Parliament, the protection of information privacy in South Africa will be in line with our international obligations in terms of prescribed adequacy requirements. In the last 30 years more than fifty countries have enacted data privacy legislation in order to ensure that they also are compliant.

The report and the Commission’s draft Bill will be made available on the Internet at http://salawreform.justice.gov.za

ISSUED BY THE SECRETARY: SA LAW REFORM COMMISSION, PRETORIA

25 AUGUST 2009

CONTACT FOR ENQUIRIES IN RESPECT OF MEDIA STATEMENT:

ANANDA LOUW TEL: (O12) 392 9566

FAX: (012) 320 0936

EMAIL: This e-mail address is being protected from spambots. You need JavaScript enabled to view it

EMBARGO: FOR IMMEDIATE RELEASE

The Direct Marketing Association of South Africa (DMASA) has launched multiplatform functionality for its Opt Out Register via SMS, Internet and call centre which allows consumers to remove their details from mailing lists used by the association's members to promote goods and services via.

To add your details to the "Don't Contact Me" list - previously known as the Mail Preference Service (MPS):
• SMS DMA followed by your ID number (this is crucial) to 34385.
• Call the call centre on 0861 DMA DMA (362 362)
• Log onto www.dmasa.org to access the DMA's opt out register

Since the launch of the DMASA's Opt Out register in March 2007, 35 000 consumers have registered. Registration via any one of these methods serves the sole purpose of removing your name and address from all prospect mailing lists used by members of the Direct Marketing Association.