1. Put Your Left Leg In,
Take Your Left Leg Out:
The exclusions and
exemptions of the
Protection of Personal
Information Bill
explained
Neil Kirby

2. PROTECTION OF PERSONAL INFORMATION BILL
1. Objects & purpose
- constitutional right to privacy
- processing regulation
- rights & remedies to protection personal information
- voluntary & compulsory measures to enforce rights
2. Section 14
“Everyone has the right to privacy, which includes the right not
to have –
(a) their person or home searched;
(b) their property searched;
(c) their possessions seized; or
(d) the privacy of their communications infringed.”
3. But also sections 7, 10, 12(2), 15(1), 19 and 21 of the Constitution.

3. CONSTITUTIONAL PREROGATIVES
“As a general rule any person is likely to feel violated,
harmed and invaded by the publication of unlawfully
obtained information. Any reasonable person would
probably feel less concerned if his discussion of an
upcoming metropolitan council election, or the state of
the global economy, were unlawfully intercepted and
subsequently published, than if his discussion of
intensely private matters such as family disputes or
medical records were illegally intercepted and published
for a larger audience. Similarly, on the public
interest side of the equation, the public will
certainly be interested and accordingly benefit
from discussion of matters which are clearly in
the public interest.”
See Tshabalala-Msimang and Another v Makhanya and Others 2008 (6)
SA 102 (W) at paragraph 35

4. “PUBLIC INTEREST”
“Public interest, it must be noted, is a mysterious concept,
like a battered piece of string charged with elasticity,
impossible to measure or weigh. The concept
changes with the dawn of each new day,
tempered by the facts of each case. Public interest
will naturally depend on the nature of the information
conveyed and on the situation of the parties involved.
Public interest is central to policy debates, politics and
democracy. While it is generally acclaimed that
promoting the common wellbeing or general welfare is
constructive, there is little, if any, consensus on what
exactly constitutes the public interest.”
See Tshabalala-Msimang decision at paragraph 36

5. RIGHT HOW?
“The public has the right to be informed of current news
and events concerning the lives of public persons such
as politicians and public officials. This right has been
given express recognition in section 16(1)(a) and (2) of
the Constitution, which protects the freedom of the
press and other media and the freedom to receive and
impart information and ideas. The public has the right
to be informed not only on matters which have a direct
effect on life, such as legislative enactments and
financial policy. This right may in appropriate
circumstances extend to information about public
figures.”
See Tshabalala-Msimang decision at paragraph 37

6. REALLY?!
“This is a case where the need for the truth is in fact
overwhelming. Indeed in this matter the personality involved,
as well as her status, establishes her newsworthiness. Here,
we are dealing with a person who enjoys a very high position
in the eye of the public and it is the very same public that
craves attention in respect of the information that is in the
hands of the Sunday Times. The overwhelming public
interest points in the direction of informing the public about
the contents incorporated in the medical records in relation to
the first applicant, albeit that the medical records may have
been unlawfully obtained. In these circumstances I am
unable to accede to the requests of the applicants with regard
to paragraphs 3 and 7 of their notice of motion which in effect
would impose a form of censorship in relation to any future
publication around the medical record.
See Tshabalala-Msimang decision at paragraph 49

7. “THE PRIVACY DEBATE”
“However this story does go to show that the privacy
debate around the smartphone is entering the
mainstream consciousness, and that’s something
Facebook, and the rest, will have to deal with.
Especially in privacy-obsessed Europe.”
M Butcher “Facebook Accused of Reading User’s Text Messages” at
http://techcrunch.com/2012/02/26/facebook-accused-of-reading-users-
text-messages/

8. POPI LANDSCAPE
1. Application
2. Exemptions
3. Exclusions
4. Only 5th draft: not clear but landscape is not expected
to change: three pronged inquiry
• Does it apply to me and my data?
• If so, am I or my data or both exempt?
• If not, do I or my data or both fall into an exclusion?

9. APPLICATION
1. Interpretation
• give effect to objects and purpose
• does not prevent “exercising or performing its powers,
duties and functions in terms of the law …” v “processing”
2. “processing personal information”
• entered in a record
• responsible party
• domiciled in Republic
• automated or non-automated means in Republic
3. Hierarchy of legislation

10. EXCLUSIONS I
• Section 6
• Also section 5: “lawful processing of personal information”; accountability, processing
limitation, purpose specification, further processing limitation, information quality,
openness, security safeguards, data subject participation
•
CATEGORY DEDICATED INFORMATION EXLUSION
SECTION PRINCIPLES APPLICABLE
Children 25(1) to 26(a) to (e) Apply Yes
Special personal Various: 25(2) to 32 Apply Yes
information
Direct marketing 71 Apply yes
• Exclusion test:
o What is the information about?
o Do I follow the principles?
o Am I excluded by section 6?
o Do I have a Regulator exemption for my data?

11. EXCLUSIONS II
• household activity
• de-identified “to the extent that [the data] cannot be re-
identified again”
• public body involving national security, public safety
• public body for preventing crime
• “exclusively journalistic purposes” (currently subject to 5
options)
• Cabinet and its committees
• provincial executive council
• judicial functions of a court
• Regulator exemption in terms of section 34

12. EXCLUSIONS III
Definitions –
1. “child”
2. “de-identify”
3. “personal information”
4. “processing”
5. “public body”
6. “re-identify”
7. “record”

13. EXEMPTIONS I
• Difference: exemptions attach to categories of information and are
particular as opposed to exclusions, which operate generally
•
CATEGORY EXCLUSION PROCESSOR
INFORMATION
Children Yes Consent
Religious or philosophical Yes Certain institutions
beliefs
Race or ethnic origin Yes Essential purpose & BEE
Trade union membership Yes Trade union
Political opinions Yes Political party

14. EXEMPTIONS II
CATEGORY INFORMATION EXCLUSION PROCESSOR
Health or sexual life Yes Medical professions in confidence and
insurance companies, medical aid
schemes, medical aid scheme
administrators, managed healthcare
organisations, schools, Minister of
Correctional Services, pension-related
persons, Minister of Justice
Criminal behaviour Yes 1. Law enforcement bodies
2. “responsible parties who process the
information for their own lawful
purposes …”(?)
Special personal information Yes 1. Consent
2. Regulator exempt
3. One of categories in section 26
DNA Yes 1. Serious medical condition prevails
2. Historical, statistical or research
activity

15. REGULATOR
• Section 34: authorises a responsible party to process
otherwise protected information
• Regulator must assess circumstances: any one or more of the
following –
“public interest” outweighs privacy; OR
“a clear benefit” to data subject or a third party outweighs privacy
• “public interest”
national security
crime
important economic or financial interest of public body
international or national interests
historical, statistical or research activity
• Conditions may be imposed

16. SO WHAT?
1. Compliance
2. Complaints
3. Investigations by Regulator: onerous
4. Search & seizure
5. Assessments in relation to compliance
6. Information notices: determine interference
7. Enforcement notice: interfered
8. Fines

17. THANK YOU
Neil Kirby
March 2012
Nothing in this presentation should be construed as formal
legal advice from any lawyer or this firm. Readers are
advised to consult professional legal advisors for guidance
on legislation which may affect their businesses.
© 2011 Werksmans Incorporated trading as Werksmans
Attorneys. All rights reserved.