Exemptions from POPIA's processing conditions
The Information Regulator ("Regulator") has published a Guidance Note on Exemptions from the Conditions for Lawful Processing of Personal Information, describing two instances where a responsible party will be exempt from complying with one or more of the conditions for the lawful processing of personal information by or for the responsible party in terms of the Protection of Personal Information Act, 2013 ("POPIA").
These two instances are:
- exemption on application (section 37 of POPIA); and
- exemption in respect of certain functions (section 38 of POPIA).
Exemption on application
Provided a responsible party qualifies to apply for an exemption (detailed below), it may submit an application to the Regulator to be exempt from complying with a specific processing condition, even if such processing is in breach of any of the processing conditions or any measure that gives effect to such processing condition.
To qualify for such an exemption, the responsible party must satisfy the Regulator that its processing either:
- is in the public interest, and the public interest is so significant that it outweighs the data subject's right to the protection of their personal information (examples given in the Guidance Note include:
- national security;
- the prevention, detection and prosecution of offences;
- important economic and financial interests of a public body; and
- freedom of expression; or
- involves a clear benefit to the data subject, which benefit outweighs, to a substantial degree, any interference with the privacy of the data subject or third party that could result from such processing.
An exemption granted by application may not be a full exemption from all the processing conditions, and the Regulator may only grant the exemption for one or some of the processing conditions. In addition, the Regulator may impose reasonable conditions in respect of any exemption granted.
Exemption in respect of certain functions
Where a responsible party processes personal information for the purpose of performing certain functions (this means either a function performed by a public body, or conferred by law), it may be exempt from complying with limited processing conditions only. The scope of exemptions is limited to:
- the data subject's right of objection (sections 11(3) and 11(4));
- the obligation to ensure that personal information is collected directly from the data subject (section 12);
- the requirement that further processing must be compatible with the initial purpose of collection (section 15); and
- the requirement to notify the data subject when collecting their personal information (section 18).
To qualify for an exemption, the nature of the functions performed by the responsible party must be performed with a view to protect members of the public against:
- financial loss due to dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate; or
- dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons authorised to carry on any profession or other activity.
Please contact us if you would like to determine whether your company qualifies for an exemption, and if so, we are happy to assist with your company's application to the Regulator, if applicable.
Technology, Media and Telecommunications | Executive
+27 82 509 6565
Corporate Commercial | Associate
+27 72 662 4355