Specific protection is provided for electronic processing in the ECT Act which
has provisions protecting consumers in the context of e-commerce generally.
Section 50 of the Act provides that it “applies to personal information that has
been obtained through electronic transactions”. Section 51 of the Act outlines
principles that are specifically applicable for electronic collection of personal information and a data controller must subscribe to all the principles as a whole.
80
The ECT Act also has provisions, like the POPI Act, on unsolicited electronic
communications for direct marketing purposes and also protection of personal
information in the context of e-commerce.
81 The major snag of this legislation is
its voluntary nature making its provisions non-binding.
82
4.1.2 The Requirement of Consent in the Electronic Processing
of Personal Data
Under the POPI Act, personal data may only be processed if the data subject
consents.
83 This means that previous consent is paramount for the electronic
processing (since the Act does not discriminate as noted in 4.1 above). Furthermore,
the responsible party bears the burden of proof of consent.
84 I have argued elsewhere
that the kind of consent required under the Act is ‘explicit’ or ‘opt-in’ consent.
85
Similarly, there are specific instances consent is crucial under the other conditions
for processing of personal information contained in Chapter 3 of the Act.
There is no specific provision under the Act specifying circumstances in which
electronic processing may be carried out without consent. However, there are provisions on exemption from conditions for processing of personal information generally.
86 It is my view that since consent is among the conditions for lawful
processing, this exemption also specifically applies to consent. In terms of the Act,
processing is not in breach of a condition for processing if the Regulator grants
exemption (in terms of section 37) or if processing is in accordance with section
38.
87 Instances listed under section 37 are where Regulator is satisfied that such
processing is: in the public interest
88 and for the benefit of the data subject or a third80 Section 51 of the ECT Act.
81 See. 45 of the ECT Act.
82 See Roos (2016a), p. 428.
83 Section 11 of the POPI Act.
84 Section 11(2) of the POPI Act.
85 See Abdulrauf (2016), p. 344.
86 Chapter 4 of the POPI Act.
87 Section 36 of the POPI Act.
88 Public interest includes items that are usually contained under this head which includes national
security, prevention and detection of crimes etc. see section 37(2) of the POPI Act generally.
Data Protection in the Internet: South Africa
359
has provisions protecting consumers in the context of e-commerce generally.
Section 50 of the Act provides that it “applies to personal information that has
been obtained through electronic transactions”. Section 51 of the Act outlines
principles that are specifically applicable for electronic collection of personal information and a data controller must subscribe to all the principles as a whole.
80
The ECT Act also has provisions, like the POPI Act, on unsolicited electronic
communications for direct marketing purposes and also protection of personal
information in the context of e-commerce.
81 The major snag of this legislation is
its voluntary nature making its provisions non-binding.
82
4.1.2 The Requirement of Consent in the Electronic Processing
of Personal Data
Under the POPI Act, personal data may only be processed if the data subject
consents.
83 This means that previous consent is paramount for the electronic
processing (since the Act does not discriminate as noted in 4.1 above). Furthermore,
the responsible party bears the burden of proof of consent.
84 I have argued elsewhere
that the kind of consent required under the Act is ‘explicit’ or ‘opt-in’ consent.
85
Similarly, there are specific instances consent is crucial under the other conditions
for processing of personal information contained in Chapter 3 of the Act.
There is no specific provision under the Act specifying circumstances in which
electronic processing may be carried out without consent. However, there are provisions on exemption from conditions for processing of personal information generally.
86 It is my view that since consent is among the conditions for lawful
processing, this exemption also specifically applies to consent. In terms of the Act,
processing is not in breach of a condition for processing if the Regulator grants
exemption (in terms of section 37) or if processing is in accordance with section
38.
87 Instances listed under section 37 are where Regulator is satisfied that such
processing is: in the public interest
88 and for the benefit of the data subject or a third80 Section 51 of the ECT Act.
81 See. 45 of the ECT Act.
82 See Roos (2016a), p. 428.
83 Section 11 of the POPI Act.
84 Section 11(2) of the POPI Act.
85 See Abdulrauf (2016), p. 344.
86 Chapter 4 of the POPI Act.
87 Section 36 of the POPI Act.
88 Public interest includes items that are usually contained under this head which includes national
security, prevention and detection of crimes etc. see section 37(2) of the POPI Act generally.
Data Protection in the Internet: South Africa
359