Information Regulator warns parties to abide by POPIA rules

The date for the 2021 local government elections was confirmed by the Minister for Cooperative Governance and Traditional Affairs, Dr Nkosazana Dlamini-Zuma, on 1 November 2021. On this day, South Africans will be going to the polls to elect councils for all district, metropolitan and local municipalities in each of the country’s nine provinces. During the election season, political parties and independent candidates conduct campaigning to mobilise the public towards securing their votes. During election campaigning, the processing of personal information of data subjects, who are voters in this instance, is inevitable. Therefore, the Information Regulator reminds all political parties that they must ensure lawful processing of personal information as prescribed in the Protection of Personal Information Act (POPIA) 4 of 2013.

The Regulator is mandated to ensure the protection of personal information by monitoring and ensuring compliance of responsible parties. Political parties and independent candidates are responsible parties and must comply with the provisions of POPIA. When processing the personal information of a voter, a political party must ensure that the processing complies with the eight (8) conditions for lawful processing of personal information as prescribed in POPIA, such as

• Accountability; where a political party must take overall responsibility to ensure that it processes personal information lawfully.
• Process limitation; means that a political party may only process information that it reasonably needs and upon obtaining consent directly from a voter. Therefore, it follows that political parties may not obtain personal information from data brokers or through applications that automatically generate personal information (such as telephone numbers). A voter may at any stage object to the processing of his or her personal information. If a voter objects, then a political party may no longer process that voter’s personal information.
• Purpose specification; means that a political party can only process the personal information of a voter for purposes directly related to the objective and purpose of that political party’s mandate.
• Openness; means that a voter must be notified that a political party is processing his or her personal information.

In light of the security compromises on personal information that have riddled the country, the Independent Electoral Commission (IEC) and the political parties have a responsibility to ensure that security safeguards are put in place and that there are adequate security measures and controls to safeguard voters’ personal information against loss, damage and misuse.

Like many laws, there are some exceptions to the applicability of POPIA. Section 26 prohibits the processing of special personal information, which includes the political persuasion of voters. However, political parties may process information concerning the political persuasion of voters in accordance with section 31 of POPIA, if that information relates to members, employees or other persons belonging to the political party, and where such processing is necessary to achieve the aims and principles of the political party. In terms of section 31, a political party may process information related to the political persuasion of a voter for the purpose of forming a political party; participating in its activities; engaging in the recruitment of members; canvassing supporters or voters for an election or a referendum and campaigning for a political cause. However, a political party must still comply with the conditions for the lawful processing of personal information when processing information related to the political persuasion of a voter.

The Regulator has conducted engagements with political parties, including participation in a Special Provincial Party Liaison Committee meeting to present the importance and need to comply with POPIA and ensure the protection of voters’ personal information during the election period. The Regulator has published Guidance notes on the processing of personal information of a voter by a political party, which is obtainable on its website www.justice.gov.za/inforeg/. “To ensure that we protect the constitutional rights of the citizens of South Africa all political parties and candidates must uphold the law and comply with the requirements in POPIA. The Regulator continues to provide guidance and educate responsible parties in applying this law and protecting the rights of citizens,” emphasised Chairperson of the Regulator, Adv Pansy Tlakula.

For media inquiries contact Nomzamo Zondi on 078 674 2598 / [email protected]