The Information Regulator said that it may exempt some public or private bodies from the conditions for the processing of certain personal information in certain circumstances.
Stakeholders can, under Section 37 of the Protection of Personal Information Act (Popia), which comes into effect on July 1, apply for exemption as long as it is in the public interest or there is “clear benefit” to the data subject.
Popia prescribes eight conditions for the lawful processing of personal information, however, it provides for exemptions in terms of Section 37 or if the processing is in accordance with Section 38.
Exemption will be granted, on a case-by-case basis and subject to reasonable conditions, if the regulator is satisfied that the public interest in the processing of personal information in question exists and the public interest is so significant that it outweighs the data subject’s right to the protection of their personal information.
Further, the processing exemption needs to involve a clear benefit to the data subject that outweighs, to a substantial degree, any interference with the privacy of the data subject or third party that could result from such processing.
“An exemption in terms of Section 37 of Popia may not be a full exemption from all the conditions for the lawful processing of personal information but may only be granted for one or some of the conditions for the lawful processing of personal information,” the regulator outlines in the Guidance Note on Exemptions.
The conditions applied may include, for example, the requirement for a responsible party to implement certain appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information.