With regard to the Access to Information Act which has been listed among the
sets of legislation with data protection implications, its provisions are being supervised currently by the South African Human Rights Commission (SAHRC).
45 The
SAHRC merely has de facto and not de jure powers as it cannot enforce the
provisions of the Act. The Commission can only give recommendations, submit
report and exercise other sort of subtle powers. However, this will seize as soon as
the Information Regulator is fully active especially when the act is totally in force.
This is because the Information Regulator is to supervise the enforcement of both the
POPI Act and the Promotion of Access to Information Act.
46
3.1 The Structure of the Information Regulator
Generally, the supervision or enforcement of the provisions of the Act is to be carried
out by one single supervisory body—the Information Regulator (or ‘the Regulator’).
This Herculean task is to be performed with the assistance of other entities. For
example, it is stipulated in the Act that the Regulator may appoint “a suitably
qualified and experienced person” as a chief executive officer to assist with the
performance of its duties.
47 Furthermore, the Regulator must establish an Enforcement Committee.
48 The courts also have some enforcement powers under very welldefined circumstances.
49
There seems to be no explicit provision in the Act which sanctions sectoral
supervisory bodies. Nevertheless, the POPI Act has robust provision which enables
the Regulator to issue code of conducts with specific sectoral application and
supervise sector-specific data processing generally.
50 It would seem that this
sector-specific supervisory role of the Regulator is a one-sided affair giving the
Regulator so much latitude with regard to sectoral data processing. That may
arguably not be the case given that the Act provides that the Regulator may issue
a code of conduct on its own initiative “but after consultation with affected stakeholders or a body representing such stakeholders”.
51 This does not however derogate
form the fact that supervision is to a larger extent by the Information Regulator.
The point must also be made that every institution that falls within the scope of
the POPI Act must also appoint an Information Officer who is generally to supervise
45 Section 83(2) of the Promotion of Assess to Information Act.
46 Section 39 of the POPI Act.
47 Section 47 of the POPI Act.
48 Section 50 of the POPI Act.
49 See for example secs. 97, 98 and 99 of the POPI Act. However, I have argued elsewhere that the
supervisory role of the court is very limited. See Abdulrauf (2016), p. 292.
50 See Chapter 7 generally of the POPI Act.
51 Section 61(1) of the POPI Act.
Data Protection in the Internet: South Africa
355
sets of legislation with data protection implications, its provisions are being supervised currently by the South African Human Rights Commission (SAHRC).
45 The
SAHRC merely has de facto and not de jure powers as it cannot enforce the
provisions of the Act. The Commission can only give recommendations, submit
report and exercise other sort of subtle powers. However, this will seize as soon as
the Information Regulator is fully active especially when the act is totally in force.
This is because the Information Regulator is to supervise the enforcement of both the
POPI Act and the Promotion of Access to Information Act.
46
3.1 The Structure of the Information Regulator
Generally, the supervision or enforcement of the provisions of the Act is to be carried
out by one single supervisory body—the Information Regulator (or ‘the Regulator’).
This Herculean task is to be performed with the assistance of other entities. For
example, it is stipulated in the Act that the Regulator may appoint “a suitably
qualified and experienced person” as a chief executive officer to assist with the
performance of its duties.
47 Furthermore, the Regulator must establish an Enforcement Committee.
48 The courts also have some enforcement powers under very welldefined circumstances.
49
There seems to be no explicit provision in the Act which sanctions sectoral
supervisory bodies. Nevertheless, the POPI Act has robust provision which enables
the Regulator to issue code of conducts with specific sectoral application and
supervise sector-specific data processing generally.
50 It would seem that this
sector-specific supervisory role of the Regulator is a one-sided affair giving the
Regulator so much latitude with regard to sectoral data processing. That may
arguably not be the case given that the Act provides that the Regulator may issue
a code of conduct on its own initiative “but after consultation with affected stakeholders or a body representing such stakeholders”.
51 This does not however derogate
form the fact that supervision is to a larger extent by the Information Regulator.
The point must also be made that every institution that falls within the scope of
the POPI Act must also appoint an Information Officer who is generally to supervise
45 Section 83(2) of the Promotion of Assess to Information Act.
46 Section 39 of the POPI Act.
47 Section 47 of the POPI Act.
48 Section 50 of the POPI Act.
49 See for example secs. 97, 98 and 99 of the POPI Act. However, I have argued elsewhere that the
supervisory role of the court is very limited. See Abdulrauf (2016), p. 292.
50 See Chapter 7 generally of the POPI Act.
51 Section 61(1) of the POPI Act.
Data Protection in the Internet: South Africa
355