Popia enforcement gains teeth, but a critical loophole remains

You can also listen to this podcast on iono.fm here.

JEREMY MAGGS: Now, Popia [Protection of Personal Information Act] seems to be entering a much tougher phase. The Information Regulator has imposed R5 million fines on both the Justice and Basic Education departments, while warning that South Africa’s rate of data breaches is becoming alarming.

But with major penalties still being fought in court, I guess the question is whether enforcement is genuinely changing behaviour or simply producing bigger headlines.

Joining us now is Advocate Pansy Tlakula, who’s chair of the Information Regulator of South Africa. Advocate, a very warm welcome to you. So has Popia finally got teeth, or are these fines more symbolic than punitive?

PANSY TLAKULA: Popia has always had teeth. I think the problem that we have is that it gives private bodies or public bodies that violate it, a grace period within which to comply, and it is only if they fail to comply, or if they take us to court to challenge our enforcement notice that we cannot impose, we cannot go ahead with the fines.

Read: Third-party cyber risks emerge as weak link for banks after data breach concerns

So that grace period for us is a problem, because if you look at our counterparts elsewhere in the world, once they find that the legislation has been infringed or violated, they impose a fine that has to be paid immediately.

So that grace period is the one that is problematic for us.

ADVERTISEMENT

CONTINUE READING BELOW

JEREMY MAGGS: So if that is an issue and when government departments themselves challenge the regulator, as is happening, is there a sense then that that is undermining the authority that you have?

PANSY TLAKULA: Not necessarily, because there are two scenarios. One scenario is that, once we investigate, issue an enforcement notice, then there’s compliance, which is good.

But on the other hand, you find that people then instead of complying, they challenge us in court, which probably is also their right to do so.

But we are looking at amendments to Popia so that we are able to do away with that grace period.

Because the legislation has now been enforced, the enforcement powers of the regulator came into effect in 2021.

What concerns us is that you have the SAPS (South African Police Service), I can mention them, we investigated them, found that they violated Popia, issued an enforcement notice and they complied fully. A year thereafter they violated Popia again and in the same manner that they did before.

So it means they will comply and then after that they still violate. So that’s why we feel strongly about us doing away with that grace period.

JEREMY MAGGS: Advocate, on a wider canvas, if I’ve read this correctly, you’ve received more than 8 000 data breach reports. Are breaches getting worse or are organisations reporting them more honestly?

PANSY TLAKULA: Let me correct the 8 000. The 8 000 is since the enforcement powers came into effect. For this financial year, we have received almost 1 700, and the financial year only started five months ago. So it means that by the end of the financial year, we are likely to receive 3 000.

I think the reason is twofold.

We have made it easier for public bodies and private bodies to notify us because the notification process is now electronic, but at the same time, there is also an increase in the data breaches in this country.

ADVERTISEMENT:

CONTINUE READING BELOW

Read: Health data breaches loom as employers ignore new Popia rules

I am not sure whether we are investing enough resources to dealing with public bodies and private bodies, in particular public bodies, if government bodies are investing in enough resources to put in place security measures that will ensure that the personal information in their possession is secured.

So we think that is the problem.

But having said that, we also have to accept that hackers have become very sophisticated. Even with bodies that have very sophisticated security measures in place in the private sector, Standard Bank is a case in point, they still suffered a major data breach.

JEREMY MAGGS: Advocate, be that as it may, and I want to focus particularly on the public sector, you suggest that there may be doing less than the private sector to protect information. It does raise the question, does it not, why citizens should trust government with their personal data if there are deficiencies here?

PANSY TLAKULA: Yes, that’s what we see. I think the reason is quite simple, that for the private sector, a data breach has huge consequences for the business. There’s reputational risk. There’s also the bottom line that can be affected by the data breach.

But in government those considerations do not necessarily apply.

I think government has to do more to deal not only with putting resources in place to address data breaches, but also to implement Popia and privacy by default.

I’m saying this because we’re seeing instances where laws are amended, systems are put in place that are not compliant with Popia.

So I’m not even sure whether the issue of privacy by design is applicable or is a consideration in the public sector when a law is introduced, a regulation is introduced or a system is being developed.

ADVERTISEMENT:

CONTINUE READING BELOW

Read: SA’s digital ID: Progress or privacy nightmare?

For instance, I would have expected that before a digital ID is even piloted by the government, that we would have been approached to say, this is what we intend to do, can you look at the Popia implications before we roll out or pilot the system.

But that’s what we see. So we always have to raise our hands to say, hey, we are here, Popia is here, can we check if what we are doing is compliant or not?

JEREMY MAGGS: Advocate, just the final one, how do you decide what an appropriate fine is? What makes one breach worth R100 000 and another R5 million?

PANSY TLAKULA: There is a clearly spelled criteria for Popia, which we apply in terms of that to say how many people have been affected, how serious was the breach and so on, and what was its impact.

Just to give you an example, with the DoJ (Department of Justice) data breach, it almost brought the whole justice system to a standstill because the system was encrypted and could not function.

Read:

SA’s government departments are sitting ducks for cyberattacks
State spends billions, IT systems still failing

It affected the courts, it affected maintenance, it affected even us, because at that time we were using the systems of the Department of Justice.

JEREMY MAGGS: Advocate Pansy Tlakula, thank you very much indeed. You are the chair of the Information Regulator of South Africa. I appreciate the time. Thank you.

#Popia #enforcement #gains #teeth #critical #loophole #remains