POPIA and PAIA Supplement for Residential Estates

IACT-Africa POPIA and PAIA Supplement for Residential Estates

Table of Contents

1. Introduction. 1
2. Context, Obligations and Benefits of Protecting Personal Information. 2
3. POPI Act Parties. 2
   • Data Subjects: 2
   • Responsible Party:
   •  Operator:
   • Third Party: 3
4. Internal Roles. 3
   • Information Officer. 3
   • Deputy Information Officer. 3
5. Key Activities for POPIA and PAIA Compliance in Residential Estates. 3
6. Privacy Governance and Management Structures. 4
7. Estate Constitutions. 5
8. Related Legislation. 5
9. POPIA 8 Conditions for Lawful Processing and Additional Sections in Residential Estates. 5
10. Ongoing Compliance. 12
11. Training. 12
12. Status of this document. 12

1.       Introduction

Welcome to the Residential Estates supplement to the IACT-Africa and PTC POPIA and PAIA Implementation Guide.

The purpose of this supplement is to provide introductory information for Residential Estate Management teams regarding the implementation and maintenance of compliance measures for the Protection of Personal Information Act (POPI Act/POPIA) and the associated law, the Promotion of Access to Information Act (PAIA).  This supplement is intended to provide context to impact areas regarding POPIA and PAIA compliance in residential estates. It should be read as an introduction to the POPIA and PAIA Implementation Guide and used in conjunction with information provided duration training workshops.

2.       Context, Obligations and Benefits of Protecting Personal Information

Before we get started on the detail, let us think about what we are about to embark on and why are doing this.

We know that there is an obligation to comply with the POPI Act, also called POPIA, before the enforcement date is upon us.  But there is another reason for doing this. It is to protect the privacy of personal information of people in estates as well as those who visit, work at and provide services to estates.  In a nutshell, estate management teams and Boards have a duty to ensure that personal information is processed in a lawful manner and that it is adequately secured in accordance with relevant laws enabled by global and local practices.

The consequences of not adopting such practices for privacy and data protection can be in the form of a fine or prison sentence or a legal claim but more realistically they are likely to be reputational damage for the estate, loss of trust in the management team and Board, business disruption, a negative impact on property values and others.

The benefits of adopting these practices include avoiding penalties (prevention is better than cure), building trust among your community and other stakeholders, enhancing the image and reputation of your estate and more. As already mentioned, you will be protecting a fundamental human right regarding privacy as enshrined in the South African Constitution and in the United Nations Universal Declaration of Human Rights (UDHR).

3.       POPI Act Parties

It is important to provide an introduction to the parties involved in the processing of personal information as an understanding of these is essential for your privacy journey. There are four parties (or four types of actors) who can be involved in the processing of personal information, these being:

1. 1. • Data Subjects: The person to whom personal information relates.  In a residential estate these are typically residents, home owners, visitors, estate employees, contractors and suppliers/service providers. POPIA also regards organisations as data subjects as it also includes juristic persons as data subjects.  These are typically companies, trusts, bodies corporate, etc.  This inclusion of juristics is fairly unique to POPIA as it is not found in many privacy and data protection laws in other countries.  Note: In related international standards, data subjects are often referred to as Personally Identifiable Information (PII) Principals.
      • Responsible Party: This is a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information. It is also the party responsible for processing and protecting personal information in accordance with POPIA. In the residential estate sector this is the HOA, Body Corporate or similar entity. Note: In related international standards, responsible parties are usually referred to as PII Controllers.
      • Operator: This is an entity or person which processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party.  In the residential estate sector this is a service provider which provides services to the estate which involves the processing of personal information.  Examples of operators are security companies, IT service providers and other similar organisations.   Note: In related international standards and laws, responsible parties are usually referred to as PII Processors.
      • Third Party: Third parties are not formally defined in POPIA but they are referred to in numerous sections with regard to certain processing activities. Third parties are organisations to which personal information could be sent but who are not typical operators or service providers to the organisation. Examples of third parties are government organisations to which returns have to be submitted e.g. employers send employee tax information to SARS, they may also send payments to medical schemes on behalf of employees.  As can be seen, these organisations are not operators but recipients of personal information.

4.       Internal Roles

In additional to the parties described above, there are two key internal roles, these are outlined below:

1. 1. • Information Officer: POPIA and PAIA both require public and private organisation to appoint an Information Officer. The primary responsibility of the Information Officer is to develop, implement, monitor and maintain a compliance framework.  This is a key leadership role which forms the foundation of POPIA and PAIA compliance.

Who should the Information Officer be in a residential estate? In the definition of the Information Officer in POPIA (Chapter 1), it is stated that this is the head of a private body (including non-government organisation). It refers to section 1 in PAIA, which states that in a private body, the Information Officer is the Chief Executive Officer or equivalent. In a residential estate/HOA or body corporate, this is normally the Estate Manager (or GM or CEO).  As can be seen, it is not the Chairman of the Board or a Trustee.  The Board’s role is an oversight role, not a management or operational role.

1. 1. • Deputy Information Officer: POPIA and PAIA make provision for a Deputy Information Officer to be appointed in order to assist in the execution of compliance related activities. There are no guidelines in POPIA or PAIA with relating to who this should be. We recommend that this is a person in a senior business management position in order to ensure that an appropriate level of authority is established.

It is important to note that that while Deputy Information Officers can be appointed, accountability for compliance remains with the Information Officer.

The responsibilities of the Information Officer and Deputy Information Officer are contained in the appointment Letter provided in the POPIA and PAIA Compliance Toolkit.  Please refer to 1.2 in the Implementation Guide for more information.

5.       Key Activities for POPIA and PAIA Compliance in Residential Estates

Key activities for POPIA and PAIA compliance activities or measures in estates are summarised below:

1. 1. • Establishing privacy governance structures such as the key appointments (Information Officer and Deputy Information Officer) and any committees for privacy and data protection should be established;
      • A set of privacy and data protection policies and notices are required. The following are recommended:
        • A Privacy Policy or Notice as well as visible signage i.e. a summary of the privacy notice and CCTV policy should be published. These should be published on the estate website and made available in the estate office and/or practical locations;
        • Information security related policies and technical measures such as anti-virus, anti-malware, strong password practices, access controls to systems, file encryption, etc. Policies should include information security, acceptable use, CCTV polices and Biometric polices;
      • An inventory of personal information should be developed and maintained; this will enable effective and efficient responses to data subject requests;
      • Identification of processes or points where personal information is collected for example new resident registration and visitor registration processes. These should be checked to ensure that information is being collected lawfully i.e. that it is being collected and processed with the knowledge of the data subject (resident, visitor, etc.) for a clear valid purpose and with their consent. These should be amended where necessary;
      • Conducting a personal information risk assessment and establishing risk management plans. These risks are in addition to traditional estate risk management practices;
      • Conduct a Privacy Impact Assessment for any new initiatives;
      • Reviewing agreements with service providers where their services involves personal information e.g. Security companies, IT service providers, Managing Agents, Accountants, Auditors, etc. These must include a commitment by the service provider to protect personal information in line with POPIA as well as the rights of the estate for assessing their Information Security practices. We provide a Responsible Party to Operator contract template which has the appropriate clauses and references to sections in POPIA as part of the POPIA and PAIA Compliance Toolkit.

It is important to check if any of these are hosted services outside of SA as Transborder requirements exist in POPIA.  If such services are used, they should be hosted in a country with a substantially similar law to POPIA (e.g. Europe or the UK and more recently the State of California) and their Terms and Conditions or Data Protection Agreements must include a commitment to protecting personal information. These will normally be found in clauses or sections relating to a Processor.

6.       Privacy Governance and Management Structures

In larger organisations it is recommended that privacy and data protection i.e. POPIA and PAIA related governance structures and processes, are established.  These typically include establishing a Privacy Office or function, creating a Privacy Steering Committee or forum which has responsibilities for ensuring that effective privacy monitoring and maintaining practices are carried out as well as for reporting thee status to the Board.

In residential estates, however, it is not likely to be financially viable to establish such structures. Estate managers should, however, establish adequate mechanisms for ensuing that the Board is engaged and that they are kept informed of the status of privacy compliance in their estates.  Boards should also add privacy and data protection to their agenda and should provide direction and support to estate management.

As a general recommendation, Board and management team members should make it their business to gain a general understanding of privacy and data protection practices.

7.       Estate Constitutions

As part of an estate’s governance structure and process, it is recommended that key aspects of POPIA, PAIA and privacy compliance are included in the estate’s constitution. These should include references to the key roles and policies.

8.       Related Legislation

There are numerous laws with which organisations need to comply.  In the residential estate sector, the important sector related laws are the Sectional Titles Schemes Management Act (STSMA) and the Community Schemes Ombud Service Act (CSOS Act).  As at February 2021, there is no linkage or alignment between these laws and POPIA and PAIA which is likely to result in confusion and uncertainty in the near term.  IACT-Africa will endeavour to monitor developments in this regard and to provide updates where appropriate.

9.       POPIA 8 Conditions for Lawful Processing and Additional Sections in Residential Estates

The responsibilities for the Information Officer and Deputy Information Officer aim to addresses the POPIA contains 8 Conditions for the lawful processing of information.  These can also be seen as the principles for the lawful processing of personal information.  They are based on the 8 principles contained in the EU Data Protection Directive of 1995.  POPIA also contains 5 additional sections which must be applied in conjunction with the 8 Conditions.

Table1 below contains a list of the 8 Conditions and 6 additional sections as well as guidance for applying these in the Residential Estate sector.

Table 1: Summary of 8 Conditions and 5 Additional Sections

10.       Ongoing Compliance

It is essential to continue with the ongoing monitoring of your POPIA compliance efforts and to ensure that you maintain your assessments, policies, contracts and other documents once your compliance preparation project has been completed.  Please refer to section 5 in the Implementation Guide for more information on the Post Implementation Compliance Checklist.

11.       Training

We strongly recommend that you attend the POPIA training workshops which are being scheduled by ARC before commencing your POPIA Compliance Preparation Project.

12.       Status of this document

This document and the Implementation Guide should be treated as practical advice and guidance to assist you in your POPIA & PAIA compliance activities. They do not represent to be neither do they constitute legal advice.

Date Published: February 2021