on data protection.
20 However, authors opine that all these instruments have no
significant influence on data protection in South Africa.
21
2.2 The Meaning of Personal Data and the Right to Data
Protection
According to the POPI Act, personal data (information)
22 is defined as “information
relating to an identifiable living, natural person, and where it is applicable, existing
juristic person”.
23 The Act further gave a non-exhaustive list of personal information.
24 In a unique fashion, the Act made effort to harmonize other legislation
relating to data privacy protection with its provisions especially with respect to the
definition of personal information. It brought the definition of ‘personal information’
in the Access to Information Act to that contained in the Act by amending the
provision of the latter.
25
The right to personal data protection in South Africa, unlike some other jurisdictions in Europe, is not an independent right. It is a derivative of the right to privacy
which is contained in section 14 of the South African Constitution. Scholars have
interpreted the right to privacy to include both substantive privacy right and informational privacy.
26 The latter is that which covers aspects of the right to data
protection. The POPI Act is explicit in this regard when it expressly upholds the
constitutional right to privacy in its preamble and further provides that “the right to
privacy includes a right to protection against the unlawful collection, retention,
dissemination and use of personal information”.
27 Notwithstanding the foregoing,
other scholars have linked data protection to other human rights like the rights to
dignity and personality.
28
20 For more incisive discussions on these instruments, Greenleaf and Georges (2014), pp. 18 ff.;
Makulilo (2015), p. 78; Abdulrauf and Fombad (2016), pp. 67 ff.
21 See Roos (2016b), pp. 223 ff.
22 Although the POPI Act uses the term ‘information’ rather than ‘data’; within the context of data
protection law, one may argue that both mean the same thing. However, scholars like Bygrave and
Roos have tried to distinguish between both terms. See Roos (2016a), p. 368; Bygrave (2013),
p. 20. In this report, I will be using both terms interchangeably.
23 Section 1, POPI Act.
24 Section 1, POPI Act.
25 Section the schedule to the POPI Act.
26 McQuoid-Mason (2000), p. 248. See also Roos (2012), p. 395.
27 See Preamble to the POPI Act.
28 See for example, Neethling et al. (2005), p. 217. This is so even though the right to personality is
not an independent right in the South African Constitution.
352
L. A. Abdulrauf
20 However, authors opine that all these instruments have no
significant influence on data protection in South Africa.
21
2.2 The Meaning of Personal Data and the Right to Data
Protection
According to the POPI Act, personal data (information)
22 is defined as “information
relating to an identifiable living, natural person, and where it is applicable, existing
juristic person”.
23 The Act further gave a non-exhaustive list of personal information.
24 In a unique fashion, the Act made effort to harmonize other legislation
relating to data privacy protection with its provisions especially with respect to the
definition of personal information. It brought the definition of ‘personal information’
in the Access to Information Act to that contained in the Act by amending the
provision of the latter.
25
The right to personal data protection in South Africa, unlike some other jurisdictions in Europe, is not an independent right. It is a derivative of the right to privacy
which is contained in section 14 of the South African Constitution. Scholars have
interpreted the right to privacy to include both substantive privacy right and informational privacy.
26 The latter is that which covers aspects of the right to data
protection. The POPI Act is explicit in this regard when it expressly upholds the
constitutional right to privacy in its preamble and further provides that “the right to
privacy includes a right to protection against the unlawful collection, retention,
dissemination and use of personal information”.
27 Notwithstanding the foregoing,
other scholars have linked data protection to other human rights like the rights to
dignity and personality.
28
20 For more incisive discussions on these instruments, Greenleaf and Georges (2014), pp. 18 ff.;
Makulilo (2015), p. 78; Abdulrauf and Fombad (2016), pp. 67 ff.
21 See Roos (2016b), pp. 223 ff.
22 Although the POPI Act uses the term ‘information’ rather than ‘data’; within the context of data
protection law, one may argue that both mean the same thing. However, scholars like Bygrave and
Roos have tried to distinguish between both terms. See Roos (2016a), p. 368; Bygrave (2013),
p. 20. In this report, I will be using both terms interchangeably.
23 Section 1, POPI Act.
24 Section 1, POPI Act.
25 Section the schedule to the POPI Act.
26 McQuoid-Mason (2000), p. 248. See also Roos (2012), p. 395.
27 See Preamble to the POPI Act.
28 See for example, Neethling et al. (2005), p. 217. This is so even though the right to personality is
not an independent right in the South African Constitution.
352
L. A. Abdulrauf