True or false: if you do not have the person’s consent, you cannot use his personal information? From a lot of articles available on the internet, it would seem that the answer to this question must be ‘true’. But is this really the case? Can it be true that unless, for example, I consent to you collecting on debt (money that I owe you and that you are entitled to collect from me in terms of the law) you may not process my personal information and you may not share it with debt collectors? Surely this cannot be the case.
The answer lies in section 11 of the Protection of Personal Information Bill (POPI), which is anticipated to soon come into effect. Section 11, “Consent, justification and objection”, forms part of the second condition for lawful processing, named “processing limitation”. The aim of this condition is, in general, to make the responsible party aware of the fact that that there are some limitations on the processing of personal information and gone are the days where a responsible party could process personal information as and how it pleased.
A lot of people make the mistake of only reading section 11(1)(a) which states that: “Personal information may only be processed if— (a) the data subject or a competent person (where the data subject is a child) consents to the processing”. These people then take the view that if there is no consent, the processing will not be allowed. However, section 11 also makes provision for other justification grounds – meaning that even though there is no consent, the responsible party can “justify” why he is processing the personal information through other means.
The other justification grounds include the following:
1. If the processing is necessary for concluding a contract to which the data subject is a party or it is necessary to perform under such contract;
2. If the processing complies with an obligation imposed by law on the responsible party (an example might be processing for purposes of complying with legislation such as RICA or FICA);
3. If the processing protects a legitimate interest of the data subject;
4. If the processing is necessary for the proper performance of a public law duty by a public body;
5. If the processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.
From this it is clear that even if you do not have the data subject’s consent to process personal information in a particular situation, the law may still allow you to process it if you are able to rely on one of the grounds listed above.
It is important to understand however that different rules will apply to electronic direct marketing. This is dealt with in a separate section of the Bill – section 69. We will provide more information on this in a separate post in due course
