Under Article 1 of POPIA, “personal information” is referred as any information relating to an identifiable, living, natural person, and, where applicable, an identifiable, existing juristic person (for example, a company or other similar legal entity).
The text also provides for an open-ended list of examples of the types of information that constitute personal information, e.g. (i) information relating to personal characteristics such as race, gender, sex and age; (ii) personal opinions and preferences; (iii) private correspondence; and (iv) the views of another individual about a data subject.
Special Category of Personal Information
The processing of special (“sensitive”) information is defined as:
- the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject; or
- the criminal behaviour of a data subject to the extent that such information relates to the alleged commission by a data subject of any offence; or any proceedings in respect of any offence allegedly committed by a data subject or the disposal of such proceedings.
The prohibition does not apply if:
- processing is carried out with the consent of a data subject;
- processing is necessary for the establishment, exercise or defence of a right or obligation in law;
- processing is necessary to comply with an obligation of international public law;
- processing is for historical, statistical or research purposes;
- information has deliberately been made public by the data subject; or
- the processing is authorized, under certain conditions, by the Personal Information Protection Act.
The Information Regulator may authorise a data controller to process special personal information if such processing is in the public interest and appropriate safeguards have been put in place to protect the personal information of the data subject.
According to the Protection of Personal Information Act ‘‘consent’’ means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information.
According to the Code of Practice of the Advertising Standards Authority “consent” means a voluntary agreement for what is being done or proposed.
All marketing interactions directed to children that include the collection, transfer and requests for personal information require the express consent of a competent adult.
Processing personal information of children is only allowed if; (i) it is carried out with the prior consent of a competent person; (ii) it is necessary for the establishment, exercise or defence of a right or obligation in law; (iii) it is necessary to comply with an obligation of international public law; (iv) it is for historical, statistical or research purposes; or (v) it is of personal information which has deliberately been made public by the child with the consent of a competent person.
The Regulator may, upon application by a responsible party and by notice in the Government Gazette, authorise a responsible party to process the personal information of children if the processing is in the public interest and appropriate safeguards have been put in place to protect the personal information of the child.
POPIA defines a child as someone under the age of 18 years, however, the Childrens Act 2005 (No. 38 of 2005) should also be consulted as different age restrictions apply depending on the type of personal information being processed.