LEGAL
LEGAL
POPI and you
POPI ’ s impact on the property industry
BY MARLON SHEVELEW
The Protection of Personal Information Act ( POPI ) – Number 4 of 2013 – and its impact on the rental property industry cannot be understated .
‘ Personal Information ’ is widely defined and includes , inter-alia , race , a name , date of birth , phone number ( home and cellular ), work and home address , identity number , passport number , banking information or income ( of a company or individual ), gender , contact details , personal opinions , private correspondence and financial information . Personal information applies to all individuals and entities .
Be careful when screening or entering into leases with tenants - of an individual ’ s right to privacy .
Personal information must be processed lawfully and reasonably , in a manner that does not infringe upon the privacy of the tenant by gathering as little tenant information as possible and reasonable in the
“ POPI dictates how such information may be stored , recorded , used and disclosed .”
circumstances , and with the tenant ’ s consent .
POPI governs how landlords may collect , store , record , use and disclose personal information of tenants . Landlords must notify tenants of their purpose for the collection , storage , recordable use and disclosure of personal information .
Moreover , there is now a duty on landlords to have a high standard of security when storing information electronically , whether in the cloud or on the
landlord ’ s own Information Technology systems . The landlord must protect a tenant ’ s personal information in the landlord ’ s custody by adopting safeguards to prevent unauthorized access , use , disclosure , loss , destruction , copying or modification of any personal information .
A landlord must tell the tenant how their personal information has been used and to whom it has been disclosed . POPI is quite clear that the tenant ’ s consent needs to be obtained before disclosing personal information to third parties ( with certain exceptions , such as state security ).
To conclude , non-compliance with POPI can lead to claims for civil damages ( including punitive damages ), administrative fines of up to R10 million or criminal prosecution where unlimited fines and imprisonment of between one and 10 years are prescribed .
A FEW PRINCIPLES ON WHICH POPI OPERATES REQUIRE THAT PERSONAL DATA SHALL :
1 Only be stored by the data controller to the extent necessary to achieve the purpose for which the information was explicitly collected ;
2 Only be stored in such a manner that the storage does not intrude on the privacy of the data subject to an unreasonable extent ;
3 Be adequate , relevant and not excessive for those purposes ; 4 Be used for a lawful purpose only ; 5 Not be processed contrary to the purpose for which it was collected .
RESOURCES
Marlon Shevelew and Associates Inc .
40 Commercial Handbook 2016 www . reimag . co . za