Everybody knows about POPI, the Protection of Personal Information Act 4 of 2013. Most people will probably think of it in a generally positive light. But it does have a downside, almost humorously so.
True story. The author of this article was sent the minutes of the Annual General Meeting for a non-profit company of which he is a member. When it came to the record of attendance at the meeting the page was almost blank except for a note that said, paraphrasing, “the record of the members attending has been omitted in terms of the POPI Act.” What? That’s nonsense. Since when do you have a meeting of the members of a company registered in terms of the Companies Act and you do not note those in attendance? No problem thought the author. The POPI Act falls under the auspices of the Information Regulator. As luck had it the author had a meeting very close to the Information Regulators’ offices. Just pop in and get them to verify. Very nice and helpful lot. But what they said sounded straight out of Mary Poppins. You know, the London lady who can fly with the use of an umbrella. [S11] notes that personal information can only be collected under certain conditions. “Personal Information” is defined as information relating to an identifiable, living natural person………” So if they record Malcolm as attending the meeting it is no problem as Malcolm is not identifiable – there are lots of them. Malcolm Larsen is now different. Malcolm Larsen is now identifiable. So according to the Regulator the minutes of the meeting were correct in terms of the POPI Act.
Mary Poppins was more believable than this! So, I asked the staff of the Regulator if, by the same reasoning, the same would apply to a directors meeting of the same company. They affirmed in the positive. So, you have a situation where the minutes of a meeting would note “ a certain person said this” “another person disagreed”. No organisation would, or should, allow such loose governance.
How would you work your way around this? [S11(1)a] allows for the processing of the information if the data subject consents to the processing. Before a meeting starts – get consent. Or buy an umbrella.
