A. DEFINITIONS AND INTERPRETATION
In this policy, unless the context indicates a contrary intention, the following words and expressions bear the meanings assigned to them below, and cognate expressions bear corresponding meanings:
1. “another source” means any other source other than the data subject;
2. “child” means a natural person under the age of 18 years who is not legally competent, without the assistance of a competent person, to take any action or decision in respect of any matter concerning him-or herself.
3. “competent person” means any person who is legally competent to consent to any action or decision being taken in respect of any matter concerning a child;
4. “consent” means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information;
5. “Constitution” means the Constitution of the Republic of South Africa, 1996;
6. “data subject” means person to whom personal information relates;
7. “Deputy Information Officer” means the Service Manager of Empilweni;
8. “Empilweni” means Empilweni NPO with its registered address being Metropolitan Building, Cnr Spine and Ntlazane Road, Khayelitsha;
9. “Information Officer” means the Director of Empilweni;
2
10. “Personal Information” means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, exiting juristic person, including but not limited to –
(a) information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
(b) information relating to the education or the medical, financial, criminal or employment history of the person;
(c) any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;
(d) the biometric information of the person;
(e) the personal opinions, views or preferences of the person;
(f) correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
(g) the views or opinions of another individual about the person; and
(h) the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person;
11. “POPIA” means Protection of Personal Information Act 4 of 2013 as amended from time to time;
12. “processing” means any operation or activity or set of operations, whether or not by automatic means, concerning personal information, including the collection, receipt,
3
recording, organisation, collation, storage, updating or modification, retrieval, alternation, consultation or use; dissemination by means of transmission, distribution or making available in any other form; or merging, linking, as well as restriction, degradation, erasure or destruction of information;
13. “Special Personal Information” means Personal Information relating to religion;
14. “suppliers” means a company that supplies a service or goods to the Empilweni;
15. “the Representative” means an employee, director and/or consultant duly authorise to process Personal Information on behalf of Empilweni;
16. “third party” means any party other than Empilweni clients and employees who conducts business with Empilweni.
B. EMPILWENI WELCOMES THE PROTECTION OF PERSONAL INFORMATION
6. Empilweni recognises the importance of protection of Personal Information, not only its own but also that of its employees, clients and third parties.
7. The right to privacy is an integral human right which is recognised and protected in terms of the Constitution and the POPIA.
8. It is important to protect privacy of clients, employees and third parties, especially in a world that is driven by technology where there are great risks for potential infringements of the right to privacy.
9. The purpose of POPIA is to promote the protection of privacy by providing guiding principles that are intended to be applied to the processing of Personal Information.
10. Empilweni is excited to welcome the enactment and implementation of POPIA into the workplace.
4
11. It is for this reason that this policy has been put in place to implement the provisions of POPIA relating to the way Empilweni , inter alia, collects, uses and stores Personal Information of data subjects.
12. This policy regulates inter alia, where Empilweni must collect such Personal Information, the information that must be given to the data subject before such Personal Information is collected, the quality of the Personal Information, the purposes for which Personal Information may be processed, the retention of Personal Information and the destruction thereof.
1. SCOPE
1.1. This policy forms part the policies and procedures of Empilweni.
1.2. The purpose of this policy is to regulate and give effect to the provisions of the POPIA as Empilweni processes Personal Information.
1.3. Empilweni is committed to safeguarding the Personal Information of data subjects and processes such Personal Information in accordance with the provisions of POPIA.
2. IMPLEMENTATION OF POPIA
2.1. This policy sets out the specific requirements of POPIA and the way Empilweni implements those requirements.
3. INFORMATION OFFICER OF THE FIRM
3.1. The Information Officer of the Firm shall be the Director, currently Mr William Williams.
4. DEPUTY INFORMATION OFFICER
4.1. The Deputy Information Officer shall be the Service Manager, currently Mr Lulama Mfuniselwa.
5
5. LAWFULNESS OF PROCESSING OF PERSONAL INFORMATION
5.1. Empilweni shall process Personal Information of the data subject lawfully, reasonably and in accordance with this policy and POPIA.
6. MINIMALITY OF PROCESSING OF PERSONAL INFORMATION
6.1. The Representative shall only process Personal Information of the data subject that is adequate, relevant, and necessary for the given the purpose.
7. PURPOSES OF PROCESSING PERSONAL INFORMATION
7.1. Empilweni collects, uses and stores Personal Information of data subjects for the following specified, explicitly defined and lawful purposes:
7.1.1. to provide provide assessments and counselling for children and youth with mental health problems;
7.1.2. to respond to queries raised by the clients, employees and third parties;
7.1.3. to confirm or verify the identity and banking of the employees, clients and third parties;
7.1.4. to comply with all legislative and/or regulatory obligations governing the service provided to the clients or to Empilweni by third parties;
7.1.5. when considering employment of potential employees;
7.1.6. to comply with all legislative and/or regulatory requirements when making payment to employees, clients and/or third parties;
7.1.7. to fulfil Empilweni’s contractual obligations to the clients, employees and third parties; and
7.1.8. for any other recognised operational purposes for which such Personal Information may be required.
8. COLLECTION DIRECTLY FROM DATA SUBJECT
6
8.1. The Representative must collect the Personal Information directly from the data subject.
8.2. Should the Representative be unable to collect the Personal Information directly from the data subject, the Representative may make a written request to the Information Officer to obtain authorisation to collect the Personal Information from another source.
8.3. The Information Officer shall consider the provisions of section 12(2) of POPIA upon receipt of a request in terms of clause 8.2 above and shall apply his/her discretion in terms thereof.
8.4. Upon compliance by the Information Officer with clause 8.3 above, the Information Officer shall revert to the Representative as soon as reasonably possible.
9. QUALITY OF PERSONAL INFORMATION
9.1. The Representative shall ensure that the Personal Information of the data subject is complete, accurate and up to date.
9.2. The Representative shall ensure as far as possible that Personal Information is collected directly from the data subject in accordance with clause 8 above.
9.3. Where it is not practicable to do collect the Personal Information directly from the data subject, verify the accuracy and completeness of the Personal Information collected from another source, with the data subject and where necessary update such Personal Information.
10. NOTICE TO DATA SUBJECT WHEN COLLECTING PERSONAL INFORMATION
10.1. Where Empilweni requires Personal Information, the Representative must:
10.1.1. before to collecting Personal Information from the data subject; or
10.1.2. before to collecting the Personal Information from another source; or
10.1.3. as soon reasonably practicable after it has been collected from another source
notify the data subject and ensure that the data subject is aware of the provisions of clause 10.2.
7
10.2. The Representative must notify the data subject following:
10.2.1. the specific Personal Information being collected;
10.2.2. the purpose for which the Personal Information is being collected;
10.2.3. the other source from which Personal Information is collected (if applicable);
10.2.4. the name and address of Empilweni;
10.2.5. whether or not the data subject would supply of the Personal Information by the data voluntary or mandatory;
10.2.6. the consequences to the data subject and/or Empilweni of failure to provide the Personal Information;
10.2.7. any particular law authorising or requiring the collection of Personal Information;
10.2.8. the fact that, where applicable, Empilweni intends to transfer the Personal Information to a third country or international organisation and the level of protection afforded to the Personal Information by that third country or international organisation; and
10.2.9. any further information such as the –
10.2.9.1. recipient or category of recipients of the Personal Information such as a specific department(s);
10.2.9.2. nature or category of the Personal Information such as FICA documents;
10.2.9.3. existence of the data subject’s right to access and to rectify the Personal Information collected, in accordance with clause 22 hereof;
10.2.9.4. the existence of the right to object to the processing of Personal Information in accordance with clause 18 hereof;
10.2.9.5. The right to lodge a complaint with the Information Regulator and the contact details of the Information Regulator;
8
which is necessary having regard to the specific circumstances such as the sensitive nature of the Personal Information, in which the Personal Information is or is not to be processed, to enable processing in respect of the data subject to be reasonable and in accordance with POPIA.
10.3. The Representative shall complete the notification form and furnish copy thereof to the data subject in compliance in clause 10.1 above.
10.4. Where the data subject is already aware of the information set out in clause 10.2 hereof and has confirmed his awareness telephonically or in writing, the Representative is exempted from notifying the data subject thereof.
10.5. If the data subject has made such a confirmation telephonically, the Representative shall soon as reasonably possible thereafter, record the telephonic discussion in writing and send it to the data subject.
10.6. Where Empilweni has previously complied with clause 10.2 above, it will be regarded as having complied with the clause 10.2 in any subsequent collection of Personal Information from the data subject of the same Personal Information or Personal Information of the same kind if the purpose of collection remains the same.
10.7. A data subject may consent to non-compliance with clause 10.2 provided that such consent has made in writing to the Representative, the Representative does not have to comply with clause 10.2 hereof.
10.8. Should the data subject not consent to such non-compliance with clause 10.2 and the Representative believes that non-compliance is necessary and justified in the specific circumstances, the Representative must make a written request to the Information Officer to obtain authorisation for non-compliance.
10.9. The Information Officer shall consider the provisions of section 18(4) of POPIA upon receipt of a written request in terms of clause 10.8. above and shall apply his/her discretion in accordance with POPIA.
10.10. Once the Information Officer has complied with clause 10.9 above, the Information Officer shall communicate the decision in writing to the Representative as soon as reasonably possible.
9
11. CONSENT AND JUSTIFICATION
11.1. Personal Information shall only be processed by the Representatives if:
11.1.1. The data subject or a competent person where the data subject is a child, consents to the processing;
11.1.2. Processing is necessary for a purpose as set out in clause 7.1 hereof;
11.1.3. Processing protects a legitimate interest of the data subject; or
11.1.4. Processing is necessary for pursuing the legitimate interests of the Firm or of a third party to whom the Personal Information is supplied.
11.2. If the Representative requires further processing of Personal Information such further processing1 must be compatible with the purpose for which it was collected.
11.3. To assess whether further processing is compatible with the purpose for which it was collected, the Representative must consider the following:
11.3.1. the relationship between the purpose of the intended further processing and the purpose for which the Personal Information had been originally collected;
11.3.2. the nature of the Personal Information concerned;
11.3.3. the consequences of the intended further processing for the data subject;
11.3.4. the way the Personal Information has been collected2; and
11.3.5. any effect on any contractual rights and obligations between Empilweni and the data subject.
12. Further processing will be compatible with the purpose for which it was collected if-
1 Further processing relates to processing of Personal Information for a purpose other than the purpose for which it was originally obtained
2 whether directly from the data subject or from another source
10
12.1. The data subject or competent person has consented to the further processing of the Personal Information;
12.2. The Personal Information is available in or derived from a public record or has been deliberately been made public by the data subject.
13. Where the data subject or competent person has not consented in terms of clause 11.1.1 and/or 12.1. and the Representative intends to process or further process Personal Information for a purpose other than those listed in clause 7.1, the Representative must make a written request to the Information Officer which sets out the purpose for which the Personal Information is intended to be processed.
14. The Information Officer shall consider sections 11, 13, 14 and 15 of POPIA upon receipt of a written request in terms of clause 13 above and shall apply his/ her discretion in terms thereof.
15. Upon compliance with clause 14 above, the Information Officer shall respond in writing with his/her decision to the Representative as soon as reasonably practicable.
16. The Representative shall furnish the data subject or competent person with a copy of the “FORM 1” when he/she intends to collect Personal Information from the data subject.
17. WITHDRAWAL OF CONSENT TO PROCESSING OF PERSONAL INFORMATION
17.1. The data subject or competent person has a right to withdraw his/her consent to processing of his/her Personal Information at any time.
17.2. Where such consent has been withdrawn, the Representative shall provide written notice to the Information Officer thereof, who in return shall assess whether the lawfulness of the processing has been affected and if not, the Information Officer shall apply his/her discretion and give written guidance to the Representative on the way forward in terms of the provisions of POPIA.
18. OBJECTION TO PROCESSING OF PERSONAL INFORMATION
18.1. The data subject has a right to object to processing of Personal Information.
11
18.2. The data subject in this regard must be furnished with the “FORM 4”.
18.3. The Representative shall furnish the Information Officer with the completed form for the Information Officer to consider the objection in accordance with section 11 of POPIA.
18.4. Upon compliance with clause 18.3 above, the Information Officer shall provide a written directive to the Representative on the way forward.
19. AUTHORISATION CONCERNING PERSONAL INFORMATION OF CHILDREN
19.1. The processing of Personal Information of children is prohibited unless the processing is carried out with the prior consent of a competent person.
19.2. If Personal Information of children is to be processed by a Representative in the absence of the consent of a competent person, the Representative shall make a written request to the Information Officer setting out the purpose for which the Personal Information of the child(ren) is to be processed.
19.3. The Information Officer shall consider the written submissions of the Representative considering section 35 of the POPIA and apply his/her discretion to the provision thereof and respond in writing to the Representative as soon as reasonably practicable.
20. ACCESS TO PERSONAL INFORMATION
20.1. A data subject, having provided adequate proof of identity to the Representative has the right to –
20.1.1. request confirmation from Empilweni, free of charge as to whether it holds any Personal Information about the data subject; and
20.1.2. request from Empilweni the record or description of the Personal Information related to the data subject held by it, including information about the identity of all third parties, or category of third parties who have, or have had, access to the data subject’s Personal Information –
20.1.3. within a reasonable time;
12
20.1.4. At a prescribed fee as set out in “FORM 3”
20.1.5. On the form set out in “FORM 3” .
20.2. If the Representative in response to a request in terms of clause 20.1.1 and 20.1.2 hereof, provides Personal Information to the data subject, the data subject or competent person must be advised of his right to correct the Personal Information in accordance with clause 21 hereof.
20.3. Where a request has been made in terms of clause 20.1.1 the Representative shall respond to the data subject’s request within 2 (two) business days of such a request or as soon as reasonably possible.
20.4. Where a request has been made in terms of clause 20.1.2 above, the Representative shall make a written request for a fee estimation to the Information Officer together with a description of the category of Personal Information, as soon as reasonably practicable after a request from the data subject or competent person has been received and the Information Officer shall furnish the Representative with such a fee estimation in writing as soon as reasonably possible.
20.5. Where a request of terms of clause 20.1.2 relates to information listed under the heading of “REFUSAL OF RECORDS” in the Firm’s PAIA Manual, the Representative shall bring the aforementioned to the attention of the Information Officer and do so in writing before any further action is taken.
20.6. In addition to clause 20.5 above, the Information Officer shall provide the Representative with a written directive as to the way forward after he/she has considered the PAIA Manual of the Firm.
20.7. Upon receipt of the written fee estimation referred to in clause 20.1.2 above, the Representative shall furnish the data subject with the fee estimation to the data subject in writing, as soon as reasonably possible.
20.8. If the request (in terms of clause 20.1.2) relates to the record of Personal Information and the Representative has duly complied with clauses 20.2, 20.4 – 20.9 above, the Representative shall compile all record of Personal Information and furnish it to the data subject via electronic means or hardcopy to be collected from Empilweni’s office.
13
20.9. If the request (in terms of clause 20.1.2) relates to a description of Personal Information and the Representative has duly complied with clauses 20.2,20.4 -20.9 above, the Representative shall complete the “FORM 3” which shall be furnished to the data subject via electronic means or hardcopy to be collected from Empilweni’s office.
20.10. The Representative shall prior to furnishing the data subject with the Personal Information as referred to in clause 20.9 or completed form as referred to in clause 20.10, contact the data subject to ascertain the preferred means of communication (electronic or a hard copy to be collected from Empilweni) and record the aforementioned in writing.
21. CORRECTION OF PERSONAL INFORMATION
21.1. A data subject is entitled to request Empilweni to –
21.1.1. correct or delete Personal Information relating to the data subject in its possession and/or under control that is inaccurate, irrelevant, excessive for the purpose collected, out of date, incomplete, misleading or obtained unlawfully; or
21.1.2. destroy a record of Personal Information about the data subject that Empilweni is no longer authorised to retain in terms of clause 26 hereof.
21.2. The request as set out in clause 21.1 hereof, is to be made in the prescribed “FORM 5”.
21.3. On receipt of the completed form, the Representative shall as soon as reasonably possible, ensure that:
21.3.1. the Personal Information is corrected;
21.3.2. the Personal Information is destroyed or deleted;
21.3.3. credible evidence in support of the Personal Information so correct or destroyed or deleted is provided to the data subject to his/her satisfaction; or
21.3.4. where an agreement cannot be reached between the Representative and the data subject or competent person as to the correction of Personal Information, the Representative shall notify the Information Officer as soon as reasonably possible to obtain further instructions as to the way forward. The Information Officer must
14
consider the section 24 of POPIA and give written direction to the Representative in response to the notification.
22. PROHIBITION ON PROCESSING OF SPECIAL PERSONAL INFORMATION
22.1. The Representative shall only process Special Personal Information if the:
22.1.1. processing is carried out with the consent of the data subject or competent person;
22.1.2. personal Information has been made public by the data subject;
22.1.3. processing is necessary for the establishment, exercise or defence of a right or obligation in law;
22.1.4. processing is for historical, statistical or research purposes to the extent that –
22.1.4.1. the purpose serves a public interest and the processing is necessary for the purpose concerned; or
22.1.4.2. it appears to be impossible or would involve a disproportionate effort to request for consent.
22.2. Special Personal Information for the purposes set out in clause 22.1.4 above, shall only be processed if it sufficiently guarantees are provided to ensure that the processing does not adversely affect the individual privacy of the data subject to a disproportionate extent.
22.3. If Special Personal Information is required to be processed, written authorisation shall be obtained from the Information Officer.
15
23. SECURITY MEASURES ON INTEGRITY AND CONFIDENTIALITY OF PERSONAL INFORMATION
23.1. The Representatives must ensure the integrity and confidentiality of Personal Information in the possession and control of Empilweni by taking the following appropriate, reasonable technical and organisational measures:
23.2. Representatives that have access to Personal Information must ensure that such Personal Information cannot be accessed by unauthorised staff members and/or third parties.
23.3. Representatives must prohibit access to unauthorised staff members and/or third parties.
23.4. The Representatives must ensure that their password and passwords to various applications on their respective computer and all other electronic devices containing Personal Information are highly secured.
23.5. The Representatives must ensure that the computer and all other electronic devices used to collect, processed, and stored Personal Information are updated regularly and the latest security software available.
23.6. The Representatives must ensure that the Personal Information being transferred electronically is encrypted.
24. NOTIFICATION OF SECURITY COMPROMISES
24.1. Where the Representative has grounds to believe that the Personal Information of a data subject has been accessed or acquired by any unauthorised person, the Representative must give written notice to the Information Officer thereof immediately, alternatively as soon as reasonably practicable to do so.
24.2. The Information Officer shall in accordance with POPIA and the Policy for the Information Officer and Deputy Information Officer notify the Regulator and the data subject where possible.
16
25. RESTRICTION OF PROCESSING OF PERSONAL INFORMATION
25.1. If the accuracy of Personal Information is contested by the data subject, processing thereof must be restricted by the Representative until such time that the Representative verifies the accuracy of the Personal Information.
25.2. If the Representative no longer needs Personal Information for achieving the purpose for which the Personal Information was collected or subsequently processed, such Personal Information must be restricted to the extent that is only maintained for purposes of proof.
25.3. The Personal Information must be restricted if the data subject requests to transmit the Personal Information into another electronic processing system.
26. RETENTION AND DESTRUCTION OF RECORDS
26.1. Empilweni shall not retain any Personal Information of a data subject any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed, unless the retention of records is required or authorised by law;
26.2. Should a Representative require retention of any Personal Information for a longer period than that set out in 26.1. above, the Representative shall make a written request to the Information Officer to consider, who in return shall consider the provisions of section 14 of POPIA and revert to the Representative in writing as soon as reasonably practicable.
26.3. Where the abovementioned time periods for the retention of records lapses, Empilweni shall destroy or delete a record of Personal Information alternatively to de-identify it as soon as reasonably practicable thereafter.
26.4. Empilweni shall destroy or delete records in a manner that prevents its reconstruction in an intelligible form.
