The Protection of Personal Information Act 4 of 2013 (POPIA) came into effect on 1 July 2020, with a one-year grace period, following much anticipation. Its commencement brought a frenzy with it, as businesses rushed to ensure their compliance. A chief concern was around the information already held by businesses, including the contact information of past and current clients. For law firms, the impact of s 57 (in particular s 57(1)(b)) on the day-to-day functioning of legal practitioners may have been overlooked. In this article, I discuss how this section affects the work that legal practitioners do and what can be done to cure the potential crisis that could unfold.

POPIA terminology

Responsible party: The person or entity processing the personal information.

• Processing personal information: This includes gathering, using, storing, and destroying the personal information.
• Data subject: The person or entity whose personal information it is.
• Third party: Not the data subject or the responsible party.
• Regulator: The Information Regulator oversees the monitoring and enforces the compliance of POPIA.

What does the section say?

• Section 57(1) makes it clear that ‘the responsible party must obtain prior authorisation from the Regulator, in terms of section 58, prior to any processing if that responsible party plans to–

…

(b) process information on criminal behaviour or on unlawful or objectionable conduct on behalf of third parties’.

• Section 57 and section 58 are ‘not applicable if a code of conduct has been issued and has come into force in terms of chapter 7 in a specific sector or sectors of society’ (s 57(3)).

All processing of such information must cease until a report is given by the Regulator or they give notice of the need for further investigation (s 58(2)).

The initial notification by the Regulator may take up to four weeks, the investigation may take up to 13 weeks and then the report is to be issued (s 58(4)).

• Contravening the prior authorisation requirement and the processing ban are both an offence subject to a fine or imprisonment for a period not exceeding 12 months (s 59 read with s 107).

How does it impact the profession?

Attorneys and advocates process information on criminal, unlawful and objectionable behaviour on a regular basis, some daily. For example, a firm which specialises in criminal law engages with evidence of criminal behaviour daily. A firm specialising in motor vehicle accident claims regularly processes information regarding which party caused the car accident by their negligent or criminal behaviour. A firm which specialises in consumer law, regularly processes information on the cause of defects in goods, the supply of defective goods, or the providing of defective services, all those categories presumably qualify as objectionable behaviour. Even a conveyancing firm encounters situations where building regulations were breached, estate agents acted unethically, officials expected bribes etcetera.

Seeking this approval, even though only once-off approval is required, would significantly impede the functioning of attorneys and advocates as the Act requires cessation of any processing of the relevant personal information for the period during which the approval request is being processed by the Regulator. The deadlines set in s 58 of POPIA allow the Regulator to take 17 weeks (four months) to complete the investigation.

Such a cessation of activities would compromise a firm’s solvency, case outcomes and their ability to retain clients. On the other hand, failure to comply could render a firm liable for a hefty fine or even prison time.

Where to from here?

Legal practitioners already have the Code of Conduct for all Legal Practitioners, Candidate Legal Practitioners and Juristic Entities set by the Legal Practice Council (LPC) as envisioned in s 57(3) of POPIA. It may not meet the specific criteria of POPIA, but the structure is already there.

I strongly suggest that the Legal Practice Council update this Code to reflect the necessary POPIA criteria and then register this Code with the Regulator so that the exception applies in favour of the legal profession and the work of attorneys and advocates is not hampered by this section of POPIA.

• See LSSA News ‘LSSA Exco Member appointed member of Information Regulator’ on p 5.

Trudie Broekmann BA LLB (Stell) Dip International Law (University of Antwerp, Belgium) LLM (Tax Law) (UCT) is a legal practitioner at Trudie Broekmann Attorneys in Cape Town.

This article was first published in De Rebus in 2022 (Jan/Feb) DR 9.