POPIA Alert: When does public interest trump your right to privacy?

Although everyone has a right to privacy, as enshrined in the Constitution and the Protection of Personal Information Act 4 of 2013 (“POPIA”), there may be instances where public interest is deemed to outweigh your right to privacy. 

On 28 June 2021, with only 2 days to go before the expiry of the POPIA compliance grace period, the Information Regulator published 2 guidance notes dealing with the process to be followed and forms to be completed by responsible parties who are required to obtain authorisation from the Information Regulator to process special personal information and personal information of children, where the processing is not in terms of the general grounds for processing such information.

The general grounds provide that special personal information (such as information relating to a data subject’s religious beliefs, race, ethnic origin, political persuasion, health, biometric information, or criminal behaviour), and personal information of children, may only be processed where the provisions of sections 27 to 33 (special personal information) or section 35(1) (personal information of children) are applicable, for example, where the processing is carried out with the consent of a data subject or competent person (where applicable), or where processing is necessary for the establishment, exercise or defence of a right or obligation in law.

Sections 27(2) and 35(2) provide that the Information Regulator may, upon application by a responsible party and by notice in the Gazette, authorise a responsible party to process special personal information or personal information of children, for reasons other than those provided for in the general grounds, if such processing is in the public interest and appropriate safeguards have been put in place to protect such personal information.

The guidance notes do not provide any further clarity as to what “appropriate safeguards” are, and merely states that, although “public interest” is not specifically defined in POPIA, it is a “wide and diverse concept that cannot, and should not, be limited in its scope and application”.

Public interest, as referred to in POPIA, includes some wide concepts, such as (a) the interests of national security; (b) the prevention, detection and prosecution of offences; (c) important economic and financial interests of a public body; (d) historical, statistical or research activity; and (e) the special importance of the interest in freedom of expression. As public interest is very broad and quite subjective, applications for authorisation could result in the misuse of these provisions.

Should a responsible party wish to apply for authorisation, they must do so using the prescribed forms set out in the guidance notes. The Information Regulator will assess the applications on a case-by-case basis and may impose reasonable conditions in respect of any authorisation granted.

Please contact us should you require any assistance in determining whether you need to apply for authorisation and/or in completing the prescribed forms.

The guidance notes and application forms can be accessed at:

1. Special Personal Information –

https://www.justice.gov.za/inforeg/docs/InfoRegSA-GuidanceNote-Processing-SpecialPersonalInformation-20210628.pdf

2. Personal Information of Children –

https://www.justice.gov.za/inforeg/docs/InfoRegSA-GuidanceNote-Processing-PersonalInformation-Children-20210628.pdf