2.3 Categories of Personal Data in the POPI Act
The POPI Act provides a very wide and non-exhaustive list of both sensitive and
non-sensitive personal information. In terms of the Act, personal data includes
information such as that relating to race, gender, sex, pregnancy, marital status,
nationality, ethnic or social origin, religion, conscience, belief culture, etc.
29 It
includes information relating to education or the medical, financial, criminal or
employment history of the person.
30 Personal information also includes, according
to the Act, any identifying number, symbol, e-mail address, physical address,
biometric information and the name of a person if it appears with other information
relating to the person or if the disclosure of the name itself would reveal information
about the person.
31 It must be reiterated that this list is not limited to the above
mentioned categories.
The POPI Act seems not to discriminate between sensitive and non-sensitive
information in its definition as it lumps together both classes. Nevertheless, the Act
still makes a special provision for the processing of sensitive information which is
termed “special personal information”.
32 In terms of the Act, special personal
information is personal information which relates to the religious or philosophical
beliefs, race or ethnic origin, trade union membership, political persuasion, health or
sex life or biometric information of a data subject or information relating to the
criminal behaviour of a data subject in specific contexts.
33
There is a category of personal information which is completely excluded from
the scope of the POPI Act. These are information which processing may present no
potent risk on data subject based on the principle of de minimis or for public policy
purposes. This category includes personal information processed for purely personal
or household activity, that has been de-identified, for national security, crime
detection and public policy purposes etc.
34
2.4 The Scope of the POPI Act
The POPI Act covers processing of personal information, as narrowly defined, by
both a responsible party who/which is domiciled in South Africa or makes use of
means in South Africa. A responsible party, according to the Act, is “a public or
private body or any other person who, alone or in conjunction with others,
29 Section 1 of the POPI Act.
30 Ibidem.
31 Ibidem.
32 See the whole of Part B of the POPI Act.
33 Section 26 of the POPI Act.
34 Section 6 of the POPI Act.
Data Protection in the Internet: South Africa
353
The POPI Act provides a very wide and non-exhaustive list of both sensitive and
non-sensitive personal information. In terms of the Act, personal data includes
information such as that relating to race, gender, sex, pregnancy, marital status,
nationality, ethnic or social origin, religion, conscience, belief culture, etc.
29 It
includes information relating to education or the medical, financial, criminal or
employment history of the person.
30 Personal information also includes, according
to the Act, any identifying number, symbol, e-mail address, physical address,
biometric information and the name of a person if it appears with other information
relating to the person or if the disclosure of the name itself would reveal information
about the person.
31 It must be reiterated that this list is not limited to the above
mentioned categories.
The POPI Act seems not to discriminate between sensitive and non-sensitive
information in its definition as it lumps together both classes. Nevertheless, the Act
still makes a special provision for the processing of sensitive information which is
termed “special personal information”.
32 In terms of the Act, special personal
information is personal information which relates to the religious or philosophical
beliefs, race or ethnic origin, trade union membership, political persuasion, health or
sex life or biometric information of a data subject or information relating to the
criminal behaviour of a data subject in specific contexts.
33
There is a category of personal information which is completely excluded from
the scope of the POPI Act. These are information which processing may present no
potent risk on data subject based on the principle of de minimis or for public policy
purposes. This category includes personal information processed for purely personal
or household activity, that has been de-identified, for national security, crime
detection and public policy purposes etc.
34
2.4 The Scope of the POPI Act
The POPI Act covers processing of personal information, as narrowly defined, by
both a responsible party who/which is domiciled in South Africa or makes use of
means in South Africa. A responsible party, according to the Act, is “a public or
private body or any other person who, alone or in conjunction with others,
29 Section 1 of the POPI Act.
30 Ibidem.
31 Ibidem.
32 See the whole of Part B of the POPI Act.
33 Section 26 of the POPI Act.
34 Section 6 of the POPI Act.
Data Protection in the Internet: South Africa
353