POPIA — POPIA Guidance Note: Guidance Note on the Processing of Personal Information by Political Parties (source: https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-GuidanceNote-PPI-PolParties-1.pdf)
Address: 316 Thabo Sehume Street
Tel: 012 406 4818
Fax: 0865003351
E-mail:
[email protected]
28 January 2019
GUIDANCE NOTE ON THE PROCESSING OF PERSONAL INFORMATION
OF A VOTER BY A POLITICAL PARTY IN TERMS OF THE PROTECTION
OF PERSONAL INFORMATION ACT, 4 OF 2013
INTRODUTION
1. The purpose of the document is to guide political parties with regards to the scope and
applicability of the Protection of Personal Information Act, 4 of 2013 (POPIA) in relation to
political parties. Although certain sections of POPIA are not yet in operation, political
parties are urged to comply as POPIA gives effect to the constitutional right to privacy.
SCOPE AND APPLICATION OF THE ACT
2. POPIA regulates the processing of personal information by responsible parties. POPIA
further provides for the eight (8) conditions for the lawful processing of personal
information which responsible parties must comply with.
ARE POLITICAL PARTIES RESPONSIBLE PARTIES?
3. The definition of a responsible party in POPIA refers to a public and private body or “any
other person” which, alone or in conjunction with others, determines the purpose of and
means for processing personal information.
4. In My Vote Counts NPC V Minister of Justice and Correctional Services and Another
(2018) ZACC 17) the Court held that political parties and independent candidates do not
fall under the category of the “state, public body and private body”.
Adv. FDP Tlakula (Chairperson), Adv. LC Stroom Nzama (Full-time Member), Adv. JC Weapond (Full-time
Member), Prof T Pistorius (Part-time Member), Mr SL Snail ka Mtuze (Part-time Member).
5. In accordance with the My Vote Counts judgment, “any other person” includes political
parties and independent candidates. It therefore follows that political parties are
responsible parties in terms of POPIA and must comply with the provisions of POPIA.
CONDITIONS FOR THE LAWFUL PROCESSING OF PERSONAL INFORMATION
6. When processing personal information of a voter a political party must ensure that the
processing complies with the following eight (8) conditions for lawful processing of
personal information:
Accountability – a political party must take overall responsibility to ensure that it
processes personal information lawfully.
Process limitation – a political party may only process information that it reasonably
needs upon obtaining consent directly from a voter. It therefore follows that political
parties may not obtain personal information from data brokers or through applications
that generate personal information (such as telephone numbers) automatically. A
voter may at any stage object to the processing of his or her personal information. If
a voter objects, then a political party may no longer process that voter’s personal
information.
Purpose specification – a political party can only process the personal information of
a voter for purposes directly related to the object and purpose of that political party’s
mandate.
Further processing limitation – Any further processing of the personal information
of voters must be compatible with the purpose for which the information was originally
obtained.
Information quality – A political party must take practical reasonable steps to ensure
that personal information it processes is correct, up to date and complete.
Openness – A voter must be notified that his or her personal information is being
processed by a political party.
Security safeguards – A political party must put in place adequate security measures
and controls to safeguard the personal information of voters against loss, damage and
misuse. A political party must notify the Information Regulator (Regulator) and an
affected voter of any security breach.
Data subject participation – A political party must, upon request by a voter confirm
whether it is processing the personal information of that voter. It must also correct,
destroy and/or delete the personal information of a voter upon request.
DO POLITICAL PARTIES HAVE TO COMPLY WITH CONDITIONS FOR THE LAWFUL
PROCESSING OF PERSONAL INFORMATION?
Yes, political parties must comply with POPIA as indicated above.
ARE THERE ANY EXCEPTIONS APPLICABLE TO POLITICAL PARTIES?
7. Section 26 of POPIA prohibits the processing of special personal information which
includes the political persuasion of voters. However, political parties may process the
political persuasion of voters in accordance with section 31 of POPIA. The political
persuasion of a voter relates to the fact that a voter supports a specific political party.
8. In terms of section 31 a political party may process the political persuasion of a voter for
the purpose of forming a political party; participating in its activities; engaging in the
recruitment of members; canvassing supporters or voters for an election or a referendum
and campaigning for a political cause.
9. Section 31 is an exception to the prohibition on the processing of a voter’s political
persuasion. A political party must still comply with the conditions for the lawful processing
of personal information mentioned above when processing the political persuasion of a
voter. This means that a political party may not bombard voters with messages without
first obtaining the voter’s consent to process his or her other personal information (such
as a telephone number or an e-mail address).
MAY A POLITICAL PARTY SEND A VOTER DIRECT MARKETING MESSAGES
THROUGH UNSOLICITED ELECTRONIC COMMUNICATION?
10. Section 69 of POPIA prohibits the processing of personal information of a data subject for
purposes of direct marketing by means of unsolicited electronic communication subject to
two (2) exceptions, namely where the data subject has consented to the processing or
where the data subject is a customer of the responsible party.
11. Direct marketing is defined in POPIA to include the offering of goods or services to a data
subject in the ordinary course of business or requesting a data subject to make a donation
of any kind for any reason.
WOULD CANVASSING OF VOTES BY POLITICAL PARTIES FALL WITHIN THE AMBIT
OF DIRECT MARKETING?
12. Campaigning and or canvassing of votes by a political party does not fall within the ambit
of promoting or offering goods and services in the ordinary course of business.
13. Any approach by a political party requesting a donation from a voter through unsolicited
electronic communication would fall within the definition of direct marketing and is
prohibited unless a voter has consented to such marketing.
14. A political party must note that it may approach a voter only once to request consent to
send direct marketing to the voter. This also means that a political party must obtain the
contact details of the voter in a lawful manner. It therefore follows that a political party may
also not obtain personal information for direct marketing form data brokers or through
applications that generate personal information (i.e. telephone numbers) automatically
15. Furthermore, the political party must obtain the contact details in a lawful manner.
CONCLUSION
16. A political party may ask a voter only once to obtain his or her consent for soliciting
donations through electronic communications.
17. A voter may also object to direct marketing other than through electronic communication.
i.e. canvassing for donations door to door or through person to person phone calls.
18. It is unlawful for a political party to continue processing the personal information of a voter
once such a voter has objected.
19. Section 31 only gives a political party the right to process a voter’s political persuasion
and it must obtain consent to process the voter’s other personal information.
20. A political party must collect personal information of a voter directly from him or her unless
it is collected from a public record or a record deliberately made public by a voter.
21. Lastly, the further processing of the personal information of voters for the purposes of data
manipulation or profiling is strictly prohibited.
Information Regulator
Trespass Act, 1959
