The General Data Protection Regulation (or GDPR) has been adopted by the European Parliament in early 2016. South Africa’s data protection law, the Protection of Personal Information Act (POPIA) was enacted in 2013. What does the GDPR mean for the POPI Act? Is the POPI Act going to be amended? Must you comply with both of them? And, if you do, does POPIA create any extra compliance requirements on an organisation in addition to what the GDPR requires? What happens if there is a conflict between them? And if you have been busy with a POPI Act compliance project, what should you be doing differently? Which one should you be doing first?
The GDPR POPI debate: Flavours of the same thing?
The good news is that the GDPR and POPIA are simply different flavours of data protection laws. They are actually quite similar to each other. Obviously, when South Africa enacted POPIA, South Africans did not know what the GDPR would look like. The concern was that the GDPR would be radically different from POPIA and it would mean that Parliament would need to change POPIA significantly. The GDPR is more an update to data protection law, rather than a complete overhaul. There is much debate whether this is a good thing and whether the GDPR protects data privacy in the world we live in.
But for those who have already done much to comply with POPIA, it is good news. You won’t need to start again. But you will need to tweak what you have been doing. And in some cases, the GDPR will even help you by providing answers to questions we have been asking.
For those of you who have not started, focus on GDPR first and not POPIA. You first need to work out whether you need to comply with the GDPR.
POPI must be brought in line with the GDPR
Considering the EU is one of South Africa’s biggest trade partners, South Africa is going to have to bring POPIA more in line with the GDPR. This could be done by Parliament amending POPIA or the Information Regulator interpreting it in line with the GDPR.
Do their timelines overlap?
The GDPR will came into force on 24 May 2016 and the two-year grace period will end on 25 May 2018. The POPIA commencement date will probably be towards the end of 2018. This means that their timelines are not going to overlap. The GDPR deadline is 25 May 2018. The POPIA deadline will be at some point in 2019.
You might have to comply with the GDPR
The General Data Protection Regulation applies to any data processing activities that are done by a controller in the EU. It also applies to all processing of personal data subjects residing in the EU even if the entity processing the data is not in the EU. So, if any entity is offering goods and services to EU citizens or monitoring their behaviour they will be required to comply with the GDPR. Find out whether you must comply.
How they are the same
They are the same in many ways. Most of the definitions are close – you have an information officer and a data protection officer – a controller and a responsible party. The conditions or principles are also similar. The problem is that they are slightly different in some very important ways. For example, regards security:
GDPR says “The controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected”.
POPIA says “A responsible party must secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures”.
Which one do you follow?
How they are different
The GDPR does not protect legal entities. It also does not create such serious penalties for failing to protect an account number. It exempts some SMEs from having to keep records. SMEs can find a useful infographic for SMEs on the website of the European Commission. The GDPR also makes it obligatory for some organisations to have a data protection officer, whereas POPIA provides that every organisation has one by default.
And it deals with the right to be forgotten and data portability. The GDPR has a definition of genetic data and requires data controllers to do data protection impact assessments. The fines are much bigger in the GDPR but there no criminal offences in the GDPR.
You must take a global view
There is a good chance that you will need to comply with multiple different data protection laws (like the GDPR, the ePrivacy Regulation, POPIA and the Privacy Shield). This is why it is important that you take a global view and comply with what is common among them.
Empower yourself with practical knowledge by attending a POPI Act workshop, GDPR webinar or GDPR workshop.
Comply with data protection law by joining a Data Protection Compliance Programme.
Get a GDPR POPI comparison report
We can provide you with a GDPR POPI comparison report that will help you to see the differences between the two and help you to:
implement better programmes to protect personal information or data,
comply with both laws,
fit your POPIA compliance effort in with the global data protection compliance programme,
avoid having to do things twice.
Interested?
If you are interested, please send an email to admin@eskilz.co.za and enquire now. We will reply to find out more about your requirements and give you a quote.
