contend that this fine is even higher than what is obtainable in UK and most of
Europe.
141 So far, the Regulator has not exercised any of its enforcement powers.
It is not explicit whether it is possible to appeal to the court but it must be stated
that the penalties are usually imposed with the support of the courts.
142
5 The Extra-Territorial Reach of South Africa’s Data
Protection Framework
5.1 The Territorial Scope of Rules on Data Protection
The territorial scope of application of data protection rules is clearly defined under
the POPI Act. Section 2 provides that the Act applies to processing of personal
information (including electronic processing) by a responsible party where he is
domiciled in the Republic (Republic of South Africa).
It goes without saying that the ECT Act and all the other legislation cited in this
chapter are only applicable in South Africa.
Section 2 of the POPI Act further provides that the Act is also applicable where
the responsible party is “not domiciled in the Republic, but makes use of automated
or non-automated means in the Republic, unless those means are used only to
forward personal information through the Republic”.
143
5.2 Transfer of Personal Data to a Foreign Jurisdiction
The general rule under the POPI Act is that transfer of personal data to a third party
in a foreign jurisdiction is prohibited.
144 However this rule, like Article 25 of the EU
Directive and the Article 44 of the EU Regulation, is subject to some exceptions
according to the Act, which are:
Firstly, where the third party recipient of the information is subject to a law,
binding corporate rules or binding agreement which provide an adequate level of
protection that upholds the general principles of data processing which are substantially similar to the conditions for lawful processing under the Act.
145
Secondly, where the data subject consents to such transfer.
141 See Protection of Personal Information Act (POPI) - Ten things to know http://www.
nortonrosefulbright.com/knowledge/publications/119575/protection-of-personal-information-actpopi-br-ten-things-to-know.
142 See Secs. 99 and 107 of the POPI Act.
143 Section 2(1)(b) of the POPI Act.
144 Section 72(1) of the POPI Act.
145 See Section 72(1) (a) of the POPI Act generally.
Data Protection in the Internet: South Africa
367
Europe.
141 So far, the Regulator has not exercised any of its enforcement powers.
It is not explicit whether it is possible to appeal to the court but it must be stated
that the penalties are usually imposed with the support of the courts.
142
5 The Extra-Territorial Reach of South Africa’s Data
Protection Framework
5.1 The Territorial Scope of Rules on Data Protection
The territorial scope of application of data protection rules is clearly defined under
the POPI Act. Section 2 provides that the Act applies to processing of personal
information (including electronic processing) by a responsible party where he is
domiciled in the Republic (Republic of South Africa).
It goes without saying that the ECT Act and all the other legislation cited in this
chapter are only applicable in South Africa.
Section 2 of the POPI Act further provides that the Act is also applicable where
the responsible party is “not domiciled in the Republic, but makes use of automated
or non-automated means in the Republic, unless those means are used only to
forward personal information through the Republic”.
143
5.2 Transfer of Personal Data to a Foreign Jurisdiction
The general rule under the POPI Act is that transfer of personal data to a third party
in a foreign jurisdiction is prohibited.
144 However this rule, like Article 25 of the EU
Directive and the Article 44 of the EU Regulation, is subject to some exceptions
according to the Act, which are:
Firstly, where the third party recipient of the information is subject to a law,
binding corporate rules or binding agreement which provide an adequate level of
protection that upholds the general principles of data processing which are substantially similar to the conditions for lawful processing under the Act.
145
Secondly, where the data subject consents to such transfer.
141 See Protection of Personal Information Act (POPI) - Ten things to know http://www.
nortonrosefulbright.com/knowledge/publications/119575/protection-of-personal-information-actpopi-br-ten-things-to-know.
142 See Secs. 99 and 107 of the POPI Act.
143 Section 2(1)(b) of the POPI Act.
144 Section 72(1) of the POPI Act.
145 See Section 72(1) (a) of the POPI Act generally.
Data Protection in the Internet: South Africa
367