Home
2008 12 23 Dirk Willem Bouwer v City of Johannesburg and another (JA64/06) JA 64/06
2008 12 18 Arangie v the Commission for Conciliation, Mediation and Arbitration and others (D483/06) D483/06
2008 12 18 Junid Manufacturing cc v National Bargaining Council for the Clothing, Manufacturing Industry and others (D812/06) D812/06
2008 12 18 Imatu v South African Local Government Bargaining Council and others (D505/06) D505/06
2008 12 05 Netherburn Engineering CC t/a Netherburn Ceramics v Mudau NO and Another (JA 1/05) [2008] ZALAC 13 (5 December 2008) ZALAC 13
2008 11 15 Democratic Nursing Organization of South Africa and another v the Director General Department of Health and others (J2386/08) J2386/08
2008 11 12 The Member of the Executive Council for the Department of Health, Eastern Cape V Dr J P Odendaal (P504/07) P504/07
2008 09 19 Eberspächer v National Union of Metal Workers of South Africa obo Skade and Others (JA21/2007) [2008] ZALAC 11 (19 September 2008) ZALAC 11
2008 09 02 Ponties Panel Beaters Partnership v National Union of Metal Workers of South Africa (JA 43/06) [2008] ZALAC 12 (2 September 2008) ZALAC 12
2008 08 21 Dudley v City of Cape Town and Another (CA 1/05) [2008] ZALAC 10 (21 August 2008) ZALAC 10
2008 06 20 Shoprite Checkers (Pty) Ltd v Commission For Conciliation, Mediation and Arbitration and Others (JA 08/2004) [2008] ZALAC 9 (20 June 2008) ZALAC 9
2008 06 20 Amazwi Power Products (Pty) Ltd v Turnbull (JA 14/07) [2008] ZALAC 8 (20 June 2008) ZALAC 8
2008 06 05 Sondolo IT (Pty) Ltd V Gordon Howes and others (JR3217/06) JR3217/06
2008 05 19 Crouse N.O and Another v Workers Union of South Africa (CA1/2006) [2008] ZALAC 5 (19 May 2008) ZALAC 5
2008 05 19 Continental Tyre SA (Pty) Ltd v National Union of Metal Workers of South Africa (P301/05; PA2/06) [2008] ZALAC 4 (19 May 2008) ZALAC 4
2008 05 12 South African Rugby Players Association (SAPRA) and Others v SA Rugby (Pty) Limited and Others; SA Rugby Pty Limited v South African Rugby Players Union and Another (CA 10/2005) [2008] ZALAC 3 (12 May 2008) ZALAC 3
2008 05 09 Boxer Superstores (Pty) Limited v Zuma and Others (DA6/2007) [2008] ZALAC 7 (9 May 2008) ZALAC 7
2008 05 08 Ellerine Holding Limited v Commission For Conciliation, Mediation and Arbitration and Others (JA22/2005) [2008] ZALAC 6 (8 May 2008) ZALAC 6
2008 04 18 Maepe v Commissin for Conciliation, Mediation and Arbitration and Another (JA 48/04) [2008] ZALAC 2 (18 April 2008) ZALAC 2
2008 03 20                   State Information Technology Agency (SITA) (Pty) Ltd v Commission For Conciliation, Mediation and Arbitration and Others (JA 16/2006) [2008] ZALAC 1 (20 March 2008) ZALAC 1
     

 

 

POPI and consent - don’t get caught in your own net

By Gillian Lumb, Director, Kara Meiring, Candidate Attorney, Cliffe Dekker Hofmeyr

 

2020 has given rise to many challenges for employers. The Protection of Personal Information Act 4 of 2013 (POPI) poses yet another challenge. Employers have a grace period of one year as of 1 July 2020 within which to ensure their compliance with POPI.

 

POPI distinguishes between the collection, storage and processing of personal information and special person information. Special personal information includes e.g. an employee’s race or ethnic origin, health or sex life, religious or philosophical beliefs and trade union membership. Securing an employee’s consent is one of the basis on which an employer can lawfully process both general and special personal information of its employees.

 

It is crucial for employers to understand the meaning and interpretation of consent within the context of POPI. While employers may hope for a “quick fix” to ensure compliance and trust that including a broad, “catch all” consent in employees’ contracts of employment will be suffice – this may not prove to be adequate in every instance. A general consent may be sufficient to cover some of the personal information that will be processed during the course of an employee’s employment, however employers should be aware of the risks associated with relying on blanket consents in every instance.

 

Section 1 of POPI defines consent as “any voluntary, specific and informed expression of will in terms of which permission if given for the processing of personal information”. Written consent is not expressly required. However, it will be for the employer in its capacity as responsible party to show that it has secured an employee’s consent where it is relying on consent. In the circumstances it is advisable for employees’ written consent to be secured.

 

The requirement that consent be voluntary, specific and informed means that there should not be any pressure or force placed on an employee to consent. The employee should also be sufficiently aware of the content of the processing given the requirement that the consent is informed.

 

The Information Regulator has yet to give guidance on the interpretation of consent in terms of POP. In all likelihood it will have regard to the General Data Protection Regulation 2016/679 (GDPR) which requires that the consent is unambiguous and must be given by a clear affirmative act. It may well be that the Information Regulator interprets consent restrictively in keeping with the GDPR.

 

In the circumstances clauses relating to the processing of personal information in employees’ contracts of employment which are aimed at securing employees’ consent to the processing, should at minimum set out the nature and scope of the personal information that is to be processed, the reason for the processing, consent to further processing, consent to collection from a source other than the employee and consent to the transfer of the information. The employees must be able to understand in clear language what they are consenting and the extent of the consent. Where necessary provisions should also be made specifically for the processing of special personal information.

 

Employers should bear in mind that POPI does not demand consent in every instance and that processing may take place without consent where e.g. the processing is required in terms of law, or for the purposes of protecting a legitimate interest of the employee.

 

Employers will need to determine on a case by case basis whether the processing which they wish to conduct falls within the scope of the consent which they may have secured from an employee in his or her contract of employment or whether they will need to rely on one of the other basis set out in POPI.

 

Both special and general personal information may be processed lawfully if the processing is necessary for the “establishment, exercise or defence of a right or obligation in law”. This would cover instances where e.g. an employer processes employees’ personal information to comply with its obligations under the Employment Equity Act.

 

An employer can process general personal information without an employee’s consent where such processing either protects a legitimate interest of the employee, or is “necessary for pursuing the legitimate interest of the responsible party or of a third party to whom it is supplied”. While the term “legitimate interest” is not defined in POPI, it is likely that the Information Regulator will seek guidance from the GDPR in this regard. The GDPR has established a three-pronged test in interpreting “legitimate interest” which considers purpose, necessity, and balance. It first asks, “Is there a legitimate reason or purpose for the processions?”, secondly “Is processing the information necessary for that purpose” and thirdly “Is the legitimate interest overridden by the interests of the data subject?

 

A determination is made as to whether there is a “legitimate interest” for the purposes of processing personal information based on the answers to these three questions.

 

So as not to fall foul of the provisions of POPI it is recommended that employers develop internal policies that will assist them in determining whether in each instance, personal information to be processed is covered by the general consent clause in an employee’s contract of employment alternatively, by one of the other basis for lawful processing. In the absence thereof, the employer will need to prepare and secure a further consent from the employee.

 

For more information, please contact Gillian Lumb at

Article published with the kind courtesy of Cliffe Dekker Hofmeyr www.cliffedekkerhofmeyr.com

 

 

 

 

 

Courses and Workshops

 

                   

 

Basic Labour Relations

28 January 2021 (09:00 - 16:00) (Fully Booked)

Interactive Online Course

05 February 2021 (09:00 - 16:00)

Interactive Online Course 

Employment Equity Committee Training

29 January 2021 (09:00 - 16:00) (Fully Booked)

Interactive Online Course

11 February 2021 (09:00 - 16:00)

Interactive Online Course

COVID-19 Workplace Compliance Health, Safety and Claims Management Course

03 & 04 February 2021 (08:30 - 13:00) (Fully Booked)

Interactive Online Course

09 & 10 February 2021 (08:30 - 13:00)

Interactive Online Course

POPIA: Protection of Personal Information Act

04 February 2021 (09:00 - 12:00)

Interactive Online Course

The OHS Act and the Responsibilities of Management

11 February 2021 (08:30 – 16:00)

Interactive Online Course

Managing Poor Performance/ Incapacity

12 February 2021 (09:00 - 12:00)

Interactive Online Course

Health and Safety Representative and Committee Training Course

18 February 2021 (08:30 - 16:00)

Interactive Online Course

Workshop Chairing Disciplinary Hearings

25 & 26 February 2021 (09:00 - 16:00)

Interactive Online Course

 

 Our Clients 

 

Android App On Google Play

Android App On Google Play