POPIA — POPIA Guidance Note: Guidance Note on Processing of Personal Information of Voters and Countering Misinformation and Disinformation During Elections (current version dated 14 May 2024) (source: https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-GUIDANCE-NOTE-ON-THE-PROCESSING-OF-PERSONAL-INFORMATION-OF-VOTERS-AND-THE-COUNTERING-OF-MISINFORMATION-AND-DISINFORMATION-DURING-ELECTIONS.pdf) GUIDANCE NOTE ON THE PROCESSING OF PERSONAL INFORMATION OF VOTERS, AND THE COUNTERING OF MISINFORMATION AND DISINFORMATION DURING ELECTIONS Table of Contents Definitions; ......................................................................................................................................................... 3 1. Introduction .............................................................................................................................................. 4 2. Scope And Application Of The Act .......................................................................................................... 4 3. Are Political Parties And Independent Candidates Responsible Parties?................................................ 4 4. Can The Personal Information Of A Voter Be Processed For Purposes Of Political Persuasion? ......... 4 5. Conditions For Lawful Processing Of Personal Information ................................................................... 5 6. Can Political Parties And Independent Candidates Request Donations Through Direct Marketing? ... 13 7. Requirements For Political Parties And Independent Candidates To Approach A Prospective Donor In Person Or By Mail To Request A Donation. ......................................................................................... 14 8. Requirements For Political Parties And Independent Candidates To Use Unsolicited Electronic Communication To Request A Donation From A Prospective Donor ................................................... 15 9. Manner Of Obtaining Consent When A Telephone, Sms, Email Or Automated Calling Machine Is Used For Purposes Of Obtaining A Donation ................................................................................................. 16 10. Other Information Policy Issues That Political Parties & Independent Candidates Need To Be Aware Of During The Elections ........................................................................................................................ 17 11. Misinformation And Disinformation........................................................................................................ 18 12. What Can Political Parties And Independent Candidates Do To Mitigate Against Misinformation & Disinformation?...................................................................................................................................... 18 13. Legal Effect Of The Guidance Note……………………………………………………………………...…..19 14. Contact Details…………………………………………………………………………………………………20 DEFINITIONS; ‘Consent’ means any voluntary, specific, and informed expression of will in terms of which permission is given for the processing of personal information ‘Data subject’ means the person to whom personal information relates ‘Direct Marketing’ means to approach a data subject, either in person or by mail or electronic communication, for the direct or indirect purpose of – (a) promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject; or (b) requesting the data subject to make a donation of any kind for any reason ‘Electronic means any text, voice, sound, or image message sent over an Communication’ electronic communications network which is stored in the network or in the recipient’s terminal equipment until it is collected by the recipient ‘Person’ means a natural person or juristic person ‘Private Body’ means (a) a natural person who carries or has carried on any trade, business or profession, but only in such capacity; (b) a partnership which carries on any trade, business or profession or (c) any former or existing juristic person but excludes a public body ‘Processing’ means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including— (a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; (b) dissemination by means of transmission, distribution or making available in any other form; or (c) merging, linking, as well as restriction, degradation, erasure or destruction of information ‘Public record’ means a record that is accessible in the public domain, and which is in the possession of or under the control of a public body, whether or not it was created by that public body ‘Responsible Party’ means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information 1. INTRODUCTION 1.1 The purpose of the document is to guide political parties and independent candidates in respect of the scope and applicability of the Protection of Personal Information Act, 4 of 2013 (POPIA) and measures that can be taken to comply with the provisions of POPIA, whilst ensuring the free flow of accurate and reliable information to achieve free and fair elections. 2. SCOPE AND APPLICATION OF THE ACT 2.1. POPIA regulates the processing of personal information by responsible parties. POPIA also provides for the eight (8) conditions for the lawful processing of personal information which responsible parties must comply with. 2.2. This guidance note explains how political parties and independent candidates must comply with these conditions. These eight (8) conditions for the lawful processing of personal information in relation to political parties and independent candidates are discussed below. 3. ARE POLITICAL PARTIES AND INDEPENDENT CANDIDATES RESPONSIBLE PARTIES? 3.1 A responsible party is defined in POPIA as “a public and private body or “any other person” which, alone or in conjunction with others, determines the purpose of and means for processing personal information”. A person is defined in POPIA as “a natural person” or “a juristic person”. Political parties are juristic persons and independent candidates are natural persons. Both are therefore responsible parties. 4. CAN THE PERSONAL INFORMATION OF A VOTER BE PROCESSED FOR PURPOSES OF POLITICAL PERSUASION? 4.1. Section 26 of POPIA prohibits the processing of special personal information concerning the political persuasion of voters. Political persuasion of a voter means persuading a voter to join a political party or canvassing support of a voter for a political party or independent candidate. 4.2. Section 31 of POPIA creates an exception to this rule. It allows political parties to collect and use personal information of a voter for the purpose of forming a political party, participating in its activities, recruiting its members, canvassing supporters or voters or campaigning. It allows independent candidates to collect and use personal information of a voter for the purpose of canvassing supporters or voters or campaigning for national, provincial or local government elections or a referendum. 5. CONDITIONS FOR LAWFUL PROCESSING OF PERSONAL INFORMATION Political parties and independent candidates who collect and use personal information of voters for the purpose of campaigning must comply with the following eight (8) conditions for lawful processing of personal information as stipulated in POPIA: 5.1. CONDITION 1 – ACCOUNTABILITY (SECTION 8) Accountability means that political parties and independent candidates must take responsibility for how they collect and use the personal information of voters. In particular, they must ensure that they comply with all the conditions for lawful processing of personal information and all measures which give effect these conditions.1 5.2. CONDITION 2 - PROCESS LIMITATION (SECTION 9 – 12) This condition limits the scope and ambit of the processing of personal information by requiring political parties and independent candidates to comply with the following requirements – 5.2.1 Lawfulness They must process the personal information of a voter lawfully. This means that there must be a legal basis for processing such personal information. They must do so in a reasonable manner that does not infringe the privacy of a voter2. Section 8 of POPIA Section 9 of POPIA 5.2.2 Minimality They must only collect adequate, relevant and minimal information they require for campaigning purposes3. For example, they can collect the names and contact details of a voter for the purpose of campaigning but not the medical history of such a voter. Therefore, political parties and independent candidates must process only information that is necessary. 5.2.3 Consent, justification and objection They must obtain the consent of a voter to collect and use their personal information for campaigning purposes. However, a voter who has given consent can withdraw their consent at any time, in which case the collection and use of their personal information must stop4. For example, a political party or independent candidate who uses a phone to campaign must first obtain consent from a voter to receive campaign messages. If a voter informs them that they are not interested in receiving such messages, they must immediately stop. If an automated calling machine is used for campaigning purposes, the voter must be given the option to opt out at the end of the automated message. Their decision must be recorded. In exceptional circumstances, political parties and independent candidates may collect and use the personal information of a voter for campaigning purposes without their consent if they can prove that such collection and use protects the legitimate interest of a voter or pursues the legitimate interest of such political parties and independent candidates5. 5.2.4 Political parties and independent candidates who rely on legitimate interest to collect and use personal information of a voter as stipulated above, must bear in mind that such a voter can always object to the collection and use of their personal information. Once a voter has objected, then a political party and an independent candidate must immediately stop collecting and using their personal information6. Section 10 of POPIA Section 11(1)(a) of POPIA Section 11 (1)(d and f) of POPIA Section 11(3)(a) of POPIA 5.2.5 Political parties and independent candidates must collect the personal information of a voter directly from a voter.7 They, therefore, cannot obtain the personal information of a voter from data brokers, lead generators or through applications that generate personal information such as telephone numbers automatically. It is not necessary for political parties and independent candidates to obtain personal information of a voter directly from them if such personal information is contained in a public record (example the voters roll), or if a voter has deliberately made their personal information public 8 (example where an estate agent’s details are contained on a ‘for sale sign’)9 or if a voter has consented to the collection of their personal information from another source10. 5.3. CONDITION 3 - PURPOSE SPECIFICATION (SECTION 13 – 14) 5.3.1 Collection for specific purpose Political parties and independent candidates must collect and use the personal information of a voter for a specific, explicitly defined and lawful purpose related to a function or activity of such political parties and independent candidates, which in this instance is for campaigning purposes only11. 5.3.2 Retention and restriction of records Political parties and independent candidates must not retain records of personal information of a voter any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed unless – a) the retention of the record is required or authorised by law; b) political parties and independent candidates reasonably require the record for lawful purposes related to their functions or activities; Section 12 of POPIA Section 12(2)(a) of POPIA E Stadler Overthinking the Protection of Personal Information Act p276 Section 12 (2)(b) of POPIA Section 13 of POPIA c) retention is required by the contract between the voter and a political party or independent candidate where applicable; or d) a voter has consented to the retention. Accordingly, the general rule is that political parties and independent candidates may only keep the personal information of a voter for the period that is necessary to achieve the purpose for which it was collected. However, political parties and independent candidates may retain records of personal information for longer periods if the personal information will be used solely for historical, statistical or research purposes, provided that the political parties and independent candidates have established appropriate safeguards against the records being used for any other purpose.12 5.4. CONDITION 4 - FURTHER PROCESSING LIMITATION (SECTION 15) 5.4.1 Further processing to be compatible with the purpose of collection Political parties and independent candidates cannot collect and use the personal information of a voter for a purpose different from the one for which such personal information was originally collected and used unless the new purpose is compatible with the original purpose13. Example: If a political party or independent candidate collects personal information of voters in general (in contrast to their members) for the purpose of attendance at an event, the personal information of voters cannot be used for campaigning purposes. However, the personal information of a voter can be used for a new purpose even if that purpose is different from the original purpose if the voter has consented to such use14. 5.4.2 Political parties and independent candidates can also collect and use the personal information of a voter for a purpose different from the purpose for Section 14(2) of POPIA. Section 15(1) of POPIA Section 15(3)(a) of POPIA which such personal information was originally collected for or used if such personal information is available in or derived from a public record or has deliberately been made public by such voter15. Political parties and independent candidates cannot supply personal information of a voter collected and used for campaigning purposes to third parties without the consent of such a voter16. Example: personal information collected for campaigning purposes cannot be supplied to an organisation conducting election polling surveys without the consent of a voter. 5.5. CONDITION 5 - INFORMATION QUALITY (SECTION 16) Quality of Information Political parties and independent candidates must take reasonably practicable steps to ensure that the personal information of voters they possess is complete, accurate, not misleading and updated, where necessary.17 5.6. CONDITION 6 – OPENNESS (SECTION 17 – 18) 5.6.1 Documentation Political parties and independent candidates must develop and maintain a privacy policy because that is the first point of contact and medium through which voters can gain insight into how and why political parties or independent candidates process their personal information. They must maintain documentation of all processing operations when collecting and using personal information18. 5.6.2 Notification to data subject when collecting personal information- The general rule is that political parties and independent candidates must Section 15(3)(b) of POPIA Section 31(2) of POPIA Section 16(1) of POPIA. Section 17 of POPIA collect and use the personal information of a voter for a specific, explicitly defined and lawful purpose related to their functions and activities, as already stated above.19 Political parties and independent candidates must ensure that they take the following steps to ensure that the voter is aware of the purpose of collection of their information20: a) If the personal information of a voter is collected, then political parties and independent candidates must ensure that the voter is aware that their personal information is being collected and where it is not collected directly from a voter, the source from which it is collected21, the name and address of the political party or independent candidate who collected the information22 and the purpose for which personal information is being collected23. b) Political parties and independent candidates must ensure that voters are aware of information such as: i) recipient or category of recipients of the information; ii) nature or category of the information; iii) existence of the right of access to and the right to rectify the information collected; iv) existence of the right to object to the processing of personal information as referred to in section 11(3); and v) right to lodge a complaint to the Regulator and the contact details of the Regulator. Section 13(1) of POPIA Section 13(2) of POPIA Section 18(1)(a) of POPIA Section 18(1)(b) of POPIA Section 18(1)(c) of POPIA The steps referred to in paragraph 5.6.2 above must be taken if the personal information is collected directly from the voter, before the information is collected, unless the voter is already aware of the information or in any other case, before the information is collected or as soon as reasonably practicable after it has been collected.24 Political parties and independent candidates that have previously taken steps referred to in paragraph 5.6.2 are deemed to be compliant with the requirements set out in paragraph 5.6.2 in relation to the subsequent collection and use of the same kind of information from the voter if the purpose of the collection of the information remains the same.25 It is not necessary for political parties and independent candidates to comply with the requirements in paragraph 5.6.2 above if: a) the data subject has provided consent for the non-compliance; b) non-compliance would not prejudice the legitimate interests of the data subject as set out in terms of this Act; 5.7. CONDITION 7 - SECURITY SAFEGUARDS (SECTION 19 – 22) 5.7.1 Security measures on integrity and confidentiality of personal information of person information Political parties and independent candidates must secure the integrity and confidentiality of personal information in their possession or under their control. They must take appropriate, reasonable, technical and organisational measures to prevent – a) loss of, damage to or unauthorised destruction of personal information; and b) unlawful access to or processing of personal information. Section 18(2) of POPIA Section 18(3) of POPIA To ensure that they comply with this condition, political parties and independent candidates must take reasonable measures to – a) identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control; b) establish and maintain appropriate safeguards against the risks identified; c) regularly verify that the safeguards are effectively implemented; and d) ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.26 5.7.2 Information processed by an operator or person acting under authority and security measures regarding the information processed by the operator Where political parties and independent candidates make use of an operator to process the personal information of voters on their behalf, the political parties and independent candidates must ensure that they have a written contract with an operator to ensure that such an operator establishes and maintains security measures to secure the integrity and confidentiality of personal information in its possession or under its control.27 5.7.3 Notification of security measures Political parties and independent candidates must notify the Information Regulator (Regulator) and an affected voter of any security compromise they have suffered.28 5.8. CONDITION 8 - DATA SUBJECT PARTICIPATION (SECTION 23 – 25) 5.8.1 Access to personal information Political parties and independent candidates must, upon request by a voter who has provided adequate proof of identity: Section 19(2) of POPIA. Section 21 of POPIA Section 22(1) of POPIA a) confirm free of charge whether they are holding the personal information about that voter29; and b) provide such a voter with the record or a description of the personal information about the voter which they hold, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information.30 5.8.2 Correction of personal information Political parties and independent candidates must upon request by a voter: a) correct or delete personal information about such voter that is in their possession or under their control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully31; or b) destroy or delete a record of personal information about a voter that they are no longer authorised to retain. Political parties and independent candidates must notify a voter, who has made a request of the action they have taken as a result of the request.32 6 CAN POLITICAL PARTIES AND INDEPENDENT CANDIDATES REQUEST DONATIONS THROUGH DIRECT MARKETING? 6.1 Direct marketing is defined in POPIA as “approaching a data subject, either in person or by mail or electronic communication in the ordinary course of business for the purpose of offering or promoting any goods or services to the data subject or requesting a data subject to make a donation of any kind for any reason”.33 6.2 Campaigning for votes does not constitute the promotion of any service and does not fall within the definition of direct marketing. Section 23 of POPIA Section 23(1)(b) of POPIA Section 24(1)(a) of POPIA Section 24(4) of POPIA Section 1 of POPIA 6.3 However, requests for donations by political parties and independent candidates constitute direct marketing. This means that political parties or independent candidates can approach any person by mail or in person or by electronic communication for the purpose of requesting a donation. 6.4 POPIA draws a distinction between two types of direct marketing; namely: a) Direct marketing other than by means of unsolicited electronic communication in terms of section 11 of POPIA. Examples of this type of direct marketing include: (i) By mail; (ii) In person; b) Direct marketing by means of unsolicited electronic communication in terms of section 69 of POPIA. Examples of this type of direct marketing include34: (i) Telephone; (ii) Automatic calling machines (iii) Facsimile machines (iv) SMSs; or (v) E-mail. 7 REQUIREMENTS FOR POLITICAL PARTIES AND INDEPENDENT CANDIDATES TO APPROACH A PROSPECTIVE DONOR IN PERSON OR BY MAIL TO REQUEST A DONATION. 7.1 Political parties and independent candidates may approach a prospective donor in person or by mail to request a donation. However, political parties and independent candidates must first obtain the consent of a prospective donor before approaching them for a donation.35 Section 69 (1) of Protection of Personal Information Act no 4 of 2013 (POPIA) Section 11(1)(a) of POPIA 7.2 Political parties and independent candidates bear the onus of proving that a prospective donor had given their consent.36 7.3 A voter who has given consent can withdraw their consent at any time. 7.4 In exceptional circumstances, political parties and independent candidates may collect and use the personal information of a prospective donor for purposes of obtaining a donation without their consent if they can prove that such collection and use pursues the legitimate interest of such political parties and independent candidates.37 However, a prospective donor can object at any time in the prescribed manner to the collection and use of their personal information.38 7.5 Political parties and independent candidates must compile and maintain a database of all prospective donors who withdrew their consent or objected to the collection and use of their personal information for purposes of requesting donations. 8 REQUIREMENTS FOR POLITICAL PARTIES AND INDEPENDENT CANDIDATES TO USE UNSOLICITED ELECTRONIC COMMUNICATION TO REQUEST A DONATION FROM A PROSPECTIVE DONOR 8.1 Political parties and independent candidates cannot collect and use the personal information of voters for the purposes of requesting a donation by means of unsolicited electronic communication unless such voters have consented to the collection and use of their personal information39. 8.2 Political parties and independent candidates requesting a donation from a voter by means of any form of unsolicited electronic communication, including automated calling machines, fax, email, SMS, or telephone, must first obtain the consent of a prospective donor and can do so only once for the purpose of Section 11(2)(a) of POPIA Section 11 (1)(f) of POPIA Section 11(3)(b) of POPIA Section 69(1) of POPIA obtaining their consent40. 8.3 This means that a prospective donor who was previously approached for consent and withheld such consent cannot be approached again41. 8.4 Political parties and independent candidates must compile and maintain a database of prospective donors who have withheld their consent to ensure that they are not contacted again. 9 MANNER OF OBTAINING CONSENT WHEN A TELEPHONE, SMS, EMAIL OR AUTOMATED CALLING MACHINE IS USED FOR PURPOSES OF OBTAINING A DONATION 9.1 Political parties and independent candidates who use methods of communication such as a fax machine, an SMS, or an email may obtain consent from a prospective donor in the following manner: a) Use of the words “opt in”/”yes” or “opt out”/”no” to obtain consent. b) Use of the words “opt-out”/”no” to withhold consent. 9.2 Where a telephone call or automated calling machine is used to obtain consent, the prospective donor’s response must be recorded. 9.3 The consent of the prospective donor must be requested in the manner and form prescribed by the Regulator. 42 This form can be obtained on the Regulator’s website.43 9.4 Political parties and independent candidates bear the onus of proving that consent was obtained from such donor. Section 69(2) of POPIA Section 69(2)(a)(ii) of POPIA Section 69)2)(b) of POPIA www.inforegulator.org.za 9.5 A prospective donor who has given consent to receive requests for donations by means of unsolicited electronic communication can withdraw their consent at any time. 9.6 Political parties and independent candidates must ensure that they compile and maintain a database of all persons who have withheld or withdrawn their consent to ensure that they are not approached again for a donation. 9.7 Communication sent by political parties and independent candidates to prospective donors for the purpose of obtaining a donation must contain the following: a) details of the identity of the sender or the person on whose behalf the communication has been sent; and b) an address or other contact details to which the recipient may send a request that such communications cease.44 10 OTHER INFORMATION POLICY ISSUES THAT POLITICAL PARTIES & INDEPENDENT CANDIDATES NEED TO BE AWARE OF DURING THE ELECTIONS 10.1 During the election period, there is heavy reliance on various digital platforms to disseminate information about the electoral process. On the positive side, this enables voter education material to reach many people in a short period, using fewer resources. On the negative side is the fact that the use of digital platforms to disseminate information can enable the spread of misinformation and disinformation relating to the electoral process. 10.2 The phenomenon of misinformation and disinformation, enabled by new technologies, has the potential to disrupt the free flow of credible, reliable, and accurate information necessary for making an informed choice, especially during elections. 10.3 On one hand, the phenomenon of misinformation and disinformation violates Section 69(4) of POPIA the right of access to information and creates barriers to accessing information needed to make informed electoral decisions. On the other hand, it also violates the right to privacy, as it relates to the protection of personal information of a person whose voice and/or image is used without their consent to spread fake messages, particularly in instances where generative artificial intelligence is used. 10.4 For members of the public to exercise agency as voters in a democratic system, they need full, accurate and reliable information about the electoral process and options available to them when they cast their vote. 11 MISINFORMATION AND DISINFORMATION 11.1 What is misinformation? Misinformation is false, inaccurate or misleading information that is disseminated regardless of intent to cause harm, and that may cause harm with or without the disseminators’ knowledge. Misinformation may not be illegal in terms of the law unless it harms human rights, including those essential to the integrity of elections. 11.2 What is disinformation? Disinformation is false, inaccurate or misleading information designed, presented and promoted to deceive and intentionally cause public harm. 12 WHAT CAN POLITICAL PARTIES AND INDEPENDENT CANDIDATES DO TO MITIGATE AGAINST MISINFORMATION & DISINFORMATION? 12.1 Political parties and independent candidates should develop policies, strategies and action plans to reduce and respond to misinformation and disinformation practices in the rollout of their electoral campaigns. These policies, strategies and action plans should ensure that the election is not undermined by these practices and any other online harm throughout the election period. 12.2 Political parties and independent candidates should promptly investigate and take disciplinary action against their officials and members who use digital and social media in violation of the right of access to information and to infringe on the privacy of others or engage in online harm, such as the spreading of misinformation and/or disinformation which undermine the integrity of the elections. 12.3 Political parties and independent candidates are encouraged to develop and adopt statements of commitment to mitigate misinformation and disinformation. Such statements of commitment must provide for, among others, monitoring of the use of technologies such as data harvesting, microtargeting, deep fakes, and AI-generated content in their election campaigns. 12.4 Political parties and independent candidates must also develop evaluation mechanisms for compliance with their policies, strategies and action plans for mitigating misinformation and disinformation. 12.5 Political parties and independent candidates who use or allow their platforms to be used to spread disinformation and disinformation may be investigated for violating POPIA. 12.6 The Electoral Commission should consider compiling and issuing a code of conduct to address misinformation and disinformation in digital platforms to promote free, fair and orderly elections in terms of section 99(2) of the Electoral Act. 13. LEGAL EFFECT OF THE GUIDANCE NOTE 13.1 The Guidance note is advisory in nature. Accordingly, the Guidance Note shall not be construed to limit or restrict the Regulator’s administration and enforcement of POPIA. 13.2 The provisions of POPIA and the Regulations will prevail over the Guidance Note in the event of any inconsistency. The Guidance note should be read in conjunction with other Guidance Notes issued by the Regulator. 13.3 This Guidance note does not constitute legal advice. 14. CONTACT DETAILS The offices of the Information Regulator are situated at: JD House 27 Stiemens Street Braamfontein Johannesburg Operating hours: 08h00 to 16h30 Monday to Friday only. For any enquiries related to the guidance note or any other POPIA related enquiry, kindly lodge same via [email protected] To lodge a complaint against any political party or independent candidate pertaining to a possible contravention of POPIA, kindly complete a form 5 obtained from our website and submit same to [email protected] Issued by: THE INFORMATION REGULATOR (SOUTH AFRICA) MAY 2024

---