LEGAL
POPI and you
POPI’s impact on the property industry
BY MARLON SHEVELEW
T
he Protection of Personal Information
Act (POPI) – Number 4 of 2013 –
and its impact on the rental property
industry cannot be understated.
‘Personal Information’ is widely defined
and includes, inter-alia, race, a name, date of
birth, phone number (home and cellular), work
and home address, identity number, passport
number, banking information or income (of a
company or individual), gender, contact details,
personal opinions, private correspondence and
financial information. Personal information
applies to all individuals and entities.
Be careful when screening or entering into
leases with tenants - of an individual’s right to
privacy.
Personal information must be processed
lawfully and reasonably, in a manner that does
not infringe upon the privacy of the tenant
by gathering as little tenant information as
possible and reasonable in the circumstances,
and with the tenant’s consent.
POPI governs how landlords may collect,
store, record, use and disclose personal
information of tenants. Landlords must notify
tenants of their purpose for the collection,
storage, recordable use and disclosure of
personal information.
Moreover, there is now a duty on landlords
to have a high standard of security when
storing information electronically, whether in
the cloud or on the landlord’s own Information
Technology systems. The landlord must
protect a tenant’s personal information in the
8
Residential E-Book 2016
landlord’s custody by adopting safeguards to
prevent unauthorized access, use, disclosure,
loss, destruction, copying or modification of
any personal information.
A landlord must tell the tenant how their
personal information has been used and to
whom it has been disclosed. POPI is quite clear
that the tenant’s consent needs to be obtained
before disclosing personal information to third
parties (with certain exceptions, such as state
security).
To conclude, non-compliance with POPI can
lead to claims for civil damages (including
punitive damages), administrative fines of up
to R10 million or criminal prosecution where
unlimited fines and imprisonment of between
one and 10 years are prescribed.
A FEW PRINCIPLES ON WHICH POPI OPERATES
REQUIRE THAT PERSONAL DATA SHALL:
1 Only be stored by the data controller to the extent
necessary to achieve the purpose for which the
information was explicitly collected;
2 Only be stored in such a manner that the storage
does not intrude on the privacy of the data subject
to an unreasonable extent;
3 Be adequate, relevant and not excessive for those
purposes;
4 Be used for a lawful purpose only;
5 Not be processed contrary to the purpose for
which it was collected.
www.reimag.co.za