GDPR vs. POPIA: Comparing South African Version
Articles 3, 4(1)
Recitals 22-25
The GDPR applies to controllers or processors established in the EU, regardless of whether the processing takes place in the EU or not. It also applies to organizations that are not established in the EU but monitor individual’s behavior, as far as their behaviour occurs in the EU or offer goods or services to data subjects in the EU.
Section 3
POPIA applies to organizations domiciled in South Africa. It also applies to organizations not domiciled in South Africa but process personal information in South Africa unless such processing is only used to forward the information through the country.
- Data subjects have the right to request erasure of their personal data that must be responded to without undue delay.
- The right to erasure applies when the personal data is no longer necessary, when a data subject withdraws consent, when the data was unlawfully processed, or when data has to be erased for compliance with legal obligation.
- The right to erasure does not apply to the extent that the processing is necessary
-
- For exercising the right of freedom of expression or information
- For compliance with a legal obligation
- For reasons of public interest
- For establishment, exercise or defence of legal claims
- For archiving purposes in the public interest, scientific or historical purposes or statistical purposes
Sections 24
- Data subjects have the right to request destruction or deletion of their personal data that must be responded to as soon as reasonably practicable.
- The right to erasure applies when personal data is inaccurate, irrelevant or excessive, out-of-date, incomplete, misleading or obtained unlawfully.
- POPIA does not provide any specific scenarios when the right to erasure cannot be exercised.
Articles 13, 14 Recital 58
- Certain information relating to personal data processing must be provided to data subjects, whether or not personal data is collected directly from data subjects.
- It includes the information on identity and contact details of the controller, controller’s representative where applicable, controller’s data protection officer where applicable, the purposes of the processing, the lawful basis of the processing, the recipients or categories of recipients of personal data, and where applicable if the controller intends to transfer personal data outside the EU along with the mechanism used for the transfer as well as information necessary to ensure fair and transparent processing.
- Data controllers are also required to inform data subjects of the existence of data subjects’ rights.
Section 18
- Organizations must take reasonably practicable steps to provide data subjects certain information in connection to their personal data prior to the collection or as soon as reasonably practicable after the information has been collected.
- It includes information on personal data being collected, the source from which data is collected (where data is not collected from the data subject), the name and address of the controller, the purpose, whether or not the supply of personal data is voluntary, the consequences for not providing the personal data, data controller’s intention of transfer of data to a third country where applicable, and data recipients, nature or category of personal data.
- Data controllers are also required to inform data subjects of the existence of their rights.
Articles 21
Recitals: 69, 70
- Data subjects have the right to object to the processing of their personal data where the processing is based on legitimate interests or public interest. As a consequence of any valid objection, the data. controller must no longer process the data subject’s personal data unless it can demonstrate compelling and legitimate grounds for the processing. These grounds must be sufficiently compelling to override the interests, rights, and freedoms of the data subject.
- Data subjects also have the right to object to their data being processed for direct marketing purposes.
Sections 11
- Data subjects have the right to object, at any time, to the processing of personal information where the processing is based on legitimate interest of the data subject, performance of public law duty by a public body, or the legitimate interest of the controller or third party. The objection must be based on reasonable grounds relating to the data subject’s particular situation and may be refused if legislation provides for such processing.
- Data subjects also have the right to object to their data being processed for direct marketing purposes.
Article: 15
Recital: 63
- The right of access includes the right to obtain confirmation from the controller as to whether or not personal data is being processed and access to the personal data. Data controllers are required to include certain information in their response to an access request including the categories of personal data, data recipients, the purposes and retention periods.
- Deadline to respond is one month which can be extended to 2 further months depending on the complexity and number of the requests.
- A data controller can refuse to act on a request under certain circumstances. For example, the request to obtain a copy of personal information may be refused if granting it will adversely affect the rights and freedoms of others.
- The right to access can be exercised free of charge. However, a controller may charge a reasonable fee on manifestly unfounded or excessive requests, in particular because of their repetitive character. For example, an administrative fee may be charged for any further copies requested by the data subject.
Section 23
- Data subjects have the right to confirm, free of charge, whether the organization holds any personal information concerning them. They also have the right to request the record or description of their personal information as well as the identity of all third parties or categories of third parties who have or had access to the information.
- Requests must be responded to 'within a reasonable time'. There is no specific time frame under the POPIA.
- A data controller may refuse to act on a data access request on grounds for refusal of access to records set out in the applicable sections of the Promotion of Access to Information Act.
- The right to confirm that a responsible party holds information must be provided free of charge. A prescribed fee may be charged for responding to a request concerning access of record or description of personal data.
Article 18
Recital 67
Data subjects have the right to obtain restriction of processing where accuracy of data is contested, processing is unlawful, the controller no longer needs the data for the purposes of the processing, or the data subject has objected to data being processed for direct marketing and objection is pending the verification.
Section 14(6)
Data subjects have the right to obtain restriction of processing where accuracy of data is contested, processing is unlawful, the controller no longer needs the data for the purposes of the processing, or the data subject has requested to transmit the data into another automated processing system.
Article 16
Recital 65
Data subjects have the right to obtain from the controller the rectification of inaccurate personal data and to have incomplete personal data completed.
Section 24
Data subjects have the right to request correction of their personal data. Data controllers must correct the information as soon as reasonably practicable.
Articles: 12, 20, 28
Recitals: 68, 73
Data subjects have the right to receive data in a structured, commonly-used, and machine-readable format and transmit the data to another controller.
Section 14(6)
Under Section 14(6), POPIA allows data subjects to request to transmit the personal data into another automated processing system. It does not contain any further information on data portability.
Article 22
The GDPR provides data subjects the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them.
This prohibition against automated decision-making does not apply if the processing is authorized by law, necessary for the preparation and execution of a contract, or done with the data subject’s explicit consent. In such situations, the GDPR requires data controllers to implement suitable measures to safeguard the data subject’s rights, freedoms, and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Section 71
The POPIA provides data subjects the right not to be subject to a decision which results in legal consequences for him/her/it, or which affects him/her/it to a substantial degree, which is based solely on the basis of the automated processing of personal information intended to conduct profiling.
This prohibition against automated individual decision-making does not apply if the processing is done in connection with the conclusion or execution of a contract or is governed by a law or code of conduct in which appropriate measures are specified for protecting the legitimate interests of data subjects.
Articles: 83, 84
Recitals: 158, 149
- Fines may be issued directly by the relevant supervisory authority that also has a variety of other administrative and investigative powers.
- Depending on the circumstances of each individual case, the type of infringement and the severity of the violation, the administrative fine may be up to either: 2% of global annual turnover or €10 million; or 4% of global annual turnover or €20 million (whichever is higher).
- The GDPR does not specify any provisions for imprisonment. However, data subjects have a right to an administrative remedy including the right to lodge a complaint with the relevant supervisory authority as well as the right to an effective judicial remedy against a controller or processor.
Section 74,
- Fines may be issued directly by the Information Regulator that has a variety of other corrective and advisory powers.
- Depending on the circumstances of each individual case, the fine may be up to ZAR 10 million or imprisonment up to 10 years for certain violations.
- Data subjects have a right to lodge a complaint with the Information Regulator or to request the Information Regulator to institute a civil action.
Products
Solutions
Systems
Newsletter
