Thirdly, where the transfer is necessary for the performance of a contract between
the data subject and the responsible party.
Fourthly, where the transfer is necessary for the conclusion or performance of a
contract concluded in the interest of the data subject between the responsible party
and a third party and finally, where the transfer is beneficial to the data subject to
some conditions.
146
5.3 Liability for Unlawful Processing of Personal Data
in South Africa
There is liability for unlawful processing of personal data in South Africa whether or
not there is a resultant damage. Unlawful processing in this circumstance is a
processing which infringes on any of the stipulated conditions for lawful processing
under the Act.
147 The POPI Act lists instances of interference/violation with the
provisions of the Act in section 73 and provides in section 99 that a data subject or
the Regulator, may institute a civil action for damages against an infringer for the
breach of any of the provision of the Act. Indeed, the POPI Act shows the uniqueness
of data protection law by explicitly stating that liability attracts a penalty whether or
not there is intent or negligence on the part of the responsible party.
148
After hearing the matter as above, the court may award an amount which is just an
equitable.
149 This amount could include “payment of damages as compensation for
patrimonial; and non-patrimonial loss suffered by a data subject as a result of a
breach of the provisions of the Act”.
150 Similarly, the court may award an amount as
aggravated damages based on its discretion.
151
The POPI Act also creates offences as liabilities for unlawful for unlawful
processing in South Africa. A person may be imprisoned, fined or both depending
on if such offence falls into the category of serious or less serious offence.
152 For
example, failure of a responsible party to comply with an enforcement notice is
considered a serious offence.
153 Less serious offences include failure of a responsible party to notify the Regulator or the data subject for processing that needs prior
146 Sec 72(1)(a) of the POPI Act.
147 Except of course such processing falls within exceptions or exempted category under the Act.
148 Section 99 of the POPI Act.
149 Section 99(3) of the POPI Act.
150 Section 99(3) of the POPI Act.
151 Section 99(3) of the POPI Act.
152 Section 107 of the POPI Act. See also Roos (2016a), p. 475.
153 Section 103(1) of the POPI Act.
368
L. A. Abdulrauf
the data subject and the responsible party.
Fourthly, where the transfer is necessary for the conclusion or performance of a
contract concluded in the interest of the data subject between the responsible party
and a third party and finally, where the transfer is beneficial to the data subject to
some conditions.
146
5.3 Liability for Unlawful Processing of Personal Data
in South Africa
There is liability for unlawful processing of personal data in South Africa whether or
not there is a resultant damage. Unlawful processing in this circumstance is a
processing which infringes on any of the stipulated conditions for lawful processing
under the Act.
147 The POPI Act lists instances of interference/violation with the
provisions of the Act in section 73 and provides in section 99 that a data subject or
the Regulator, may institute a civil action for damages against an infringer for the
breach of any of the provision of the Act. Indeed, the POPI Act shows the uniqueness
of data protection law by explicitly stating that liability attracts a penalty whether or
not there is intent or negligence on the part of the responsible party.
148
After hearing the matter as above, the court may award an amount which is just an
equitable.
149 This amount could include “payment of damages as compensation for
patrimonial; and non-patrimonial loss suffered by a data subject as a result of a
breach of the provisions of the Act”.
150 Similarly, the court may award an amount as
aggravated damages based on its discretion.
151
The POPI Act also creates offences as liabilities for unlawful for unlawful
processing in South Africa. A person may be imprisoned, fined or both depending
on if such offence falls into the category of serious or less serious offence.
152 For
example, failure of a responsible party to comply with an enforcement notice is
considered a serious offence.
153 Less serious offences include failure of a responsible party to notify the Regulator or the data subject for processing that needs prior
146 Sec 72(1)(a) of the POPI Act.
147 Except of course such processing falls within exceptions or exempted category under the Act.
148 Section 99 of the POPI Act.
149 Section 99(3) of the POPI Act.
150 Section 99(3) of the POPI Act.
151 Section 99(3) of the POPI Act.
152 Section 107 of the POPI Act. See also Roos (2016a), p. 475.
153 Section 103(1) of the POPI Act.
368
L. A. Abdulrauf