Who is the Information Officer?
In terms of South African law, the role of the Information Officer stems from the Promotion of Access to Information Act (PAIA), which, at its core, aims to uphold the right to access information (Section 32) as enshrined in the Constitution. POPIA, on the other hand, promotes and aims to protect the right to privacy as set out in Section 14 of the Constitution. Therefore, these two pieces of legislation aim to coincide and find a balance between the right of any person to have access to information (PAIA), versus the right of a person to have their own personal information and privacy protected (POPIA).
No matter the turnover, number of employees, or type of body (public or private), every organisation is required to appoint and register an Information Officer. Information Officers are appointed automatically in terms of PAIA. What this means is that every public body (e.g. national department, provincial body and municipality) and every private body (e.g. a company, a trust, or a close corporation) has an Information Officer by default and no one is exempt.
POPIA defines an Information Officer as follows:
- In relation to a public body: an Information Officer or Deputy Information Officer as contemplated in terms of Section 1 or 17 of POPIA; or
- In relation to a private body: the head of a private body as contemplated in Section 1 of PAIA.
PAIA provides that a ‘head’ of a private body means:
- In the case of a natural person: that natural person or any person duly authorised by that natural person;
- In the case of a partnership: any partner of the partnership or any person duly authorised by the partnership; or
- In the case of a juristic person: the chief executive officer (CEO) or equivalent officer of the juristic person or any person duly authorised by that officer; or the person who is acting as such or any person duly authorised by such acting person.
The Information Officer of a public body is the head of that public body. This means that for a national or provincial government department it is the Director-General or the equivalent official of that department who is the Information Officer. For a municipality, the municipal manager is the Information Officer. In the case of any other public body, the CEO is the Information Officer.
In the case of a private body, the Information Officer is by default the owner of the business. Therefore, based on the type of private body, the Information Officer may be the sole trader, a partner in a partnership, or the CEO (or equivalent) in a company or close corporation.
The duties and responsibilities of the Information Officer
In general, the role of the Information Officer is to ensure the responsible party’s compliance with both POPIA and PAIA. Therefore, the Information Officer fulfils this compliance leadership role and is tasked, in general, to ensure that the responsible party (i.e. the body/organisation) meets its processing compliance obligations under both POPIA and PAIA.
In terms of PAIA, an Information Officer of a responsible party is in essence tasked with:
- Encouraging and ensuring compliance with PAIA;
- Developing, updating and monitoring a PAIA manual for the body (that is if the organisation is required to have such a manual and does not fall under the current exemptions1); and
- Assessing and providing outcomes, within the applicable time periods, to application requests which are received by the organisation, on the grounds of PAIA, to be given access to information held by the organisation.
In terms of Section 55 of POPIA, an Information Officer has the duty and responsibility to:
- Encourage compliance by the body with the conditions for the lawful processing of personal information in terms of POPIA;
- Deal with requests made to the body in terms of POPIA;
- Work with the Information Regulator in relation to investigations conducted in relation to the body; and
- Otherwise ensure compliance by the body with the provisions of POPIA.
The Regulations relating to the Protection of Personal Information (the POPIA Regulations) provide details on what the duties and responsibilities of an Information Officer are and specify that the Information Officer is responsible for ensuring that:
- A compliance framework is developed, implemented, monitored, and maintained by the responsible party;
- A personal information impact assessment is done to ensure that adequate measures and standards exist in order to comply with the conditions for the lawful processing of personal information;
- Subject to the aforementioned exemptions, that a manual is developed, monitored, maintained and made available as prescribed in terms of POPIA and PAIA;
- Internal measures are developed together with adequate systems to process requests for information or access thereto; and
- Internal awareness sessions are conducted regarding the provisions of POPIA.
What are the qualifications, if any, that the Information Officer is required to have?
Neither POPIA nor PAIA specifically provide for the qualifications that a person should have to hold the position of Information Officer. However, from the abovementioned duties and responsibilities it is evident that such a person is bestowed with great responsibility and duty to ensure that the body, whether private or public, fulfils its POPIA and PAIA mandate.
Must we register our Information Officer and with who?
An Information Officer is required to be registered with the Information Regulator, prior to the person formally commencing his or her duties in terms of POPIA.
What about Deputy Information Officers?
POPIA, read together with the provisions of Section 17 of PAIA, provides for the delegation of authority through the appointment of Deputy Information Officers, to assist the Information Officer with the performance of his or her responsibilities and duties towards the responsible party, and the proper fulfilment of his or her mandate. The number of Deputy Information Officers that can be appointed to assist the Information Officer is not limited and such persons are also required to be registered with the Information Regulator prior to taking up their functions.
The Deputy Information Officer of a public or private body is an employee of that body to whom the Information Officer has delegated their powers and duties. This means that the Deputy Information Officer will receive requests for information, facilitate these requests, and provide the necessary assistance to applicants on behalf of the Information Officer.
The Information Officer still maintains direction and control over the Deputy Information Officer(s), meaning that the Information Officer as the head of the public or private body who determines the purpose of and the means for processing personal information, remains responsible for the decisions of his or her authorised deputies. This delegation of powers must be done in writing for it to be valid.
The Draft Guidelines relating to the Registration of Information Officers
On 17 July 2020, the Information Regulator published Draft Guidelines relating to the Registration of Information Officers (the Draft Guidelines). The Draft Guidelines provide, inter alia, for:
- The obligations and liability of Information Officers;
- Required training;
- Who should be registered as an Information Officer;
- Duties of an Information Officer;
- The designation and delegation of authority to Deputy Information Officers; and
- The proposed procedure for registration of an Information Officer with the Information Regulator.
The extended deadline for the public to submit comments in relation to the Draft Guidelines expired in August 2020 and, currently, the Information Regulator is in the process of reviewing and considering the comments received. It is anticipated that the Final Guidelines in respect of Information Officers (the Final Guidelines), will be issued by the Information Regulator’s office during the first quarter of 2021, prior to the effective date of POPIA on 1 July 2021.
In terms of the Draft Guidelines the following aspects are noted:
- An Information Officer may be held personally liable for the failure to adequately perform his or her responsibilities and/or duties in terms of POPIA or the POPIA Regulations. The proposed penalty levied in this regard is a fine and/or imprisonment, with the fine capped at a maximum of R3 000 per infringement; however, the proposed imprisonment time is not stipulated in the Draft Guidelines.
- The Responsible Party must register its Information Officer with the Information Regulator and, prior to doing so, the appointment of the role and of any deputies must be effected in writing. The Draft Guidelines propose at this stage that a manual hardcopy application form be completed and submitted for registrations and further that the Information Officer of the responsible party must be registered with the Information Regulator by 31 March 2021. The form for submission is included in the Draft Guidelines.
Notwithstanding the above, the Information Regulator’s office has, in terms of feedback given to queries raised in ongoing awareness panel presentations, indicated that the Information Regulator plans to develop an electronic portal enabling responsible parties to register their Information Officers and deputies online. This aligns with the Information Regulator’s Readiness Plan for the Implementation of the Protection of Personal Information (the Readiness Plan), which indicates that the proposed timeframe in terms of which persons will be able to access the electronic register of Information Officers is 3 March 2021.
Unfortunately, apart from making it mandatory to have the Information Officer role catered for, providing for prescribed proposed timelines, the delegation of authority and what the respective duties and responsibilities of the Information Officer are, POPIA, the POPIA Regulations, PAIA and the Draft Guidelines provide little guidance on how to approach the appointment of an Information Officer practically, especially where the default position (e.g. CEO in the case of a private body) is deviated from.
It is therefore anticipated that clarification regarding who is eligible to be an Information Officer in certain circumstances will be provided once the Information Regulator’s office has finalised their review of the comments received to the Draft Guidelines and relevant stakeholder participation has been considered. Some lingering concerns in relation to the role include, inter alia:
- Whether the role may be outsourced;
- Whether the role of the Information Officer can be centralised in the case of a group structure; and
- Whether, in the case of a global group structure, the Information Officer has to be positioned locally in South Africa.
These are all pertinent questions which the Information Regulator shall hopefully address in terms of the Final Guidelines. In the circumstances, being able to outsource the role, and being able to centralise the role in the case of a group structure, should arguably be allowed and it is thought that the Information Regulator will take guidance from the interpretation and implementation of the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR) made by supervisory authorities and courts, as far as the role of data protection officers is concerned. However, recent public engagements with representatives of the Information Regulator’s office have indicated that this might not be so and, therefore, this remains to be clarified in terms of the Final Guidelines. An organisation’s own circumstances will need to be considered to determine what the best possible setup for the Information Officer role may be.
This article is intended for information purposes only and is a brief exposition of the abovementioned legal position. Mention is not necessarily made of all the finer nuances as set out in the abovementioned legislation. This article should not be construed as formal legal advice. Contact VDT Attorneys at the details below for legal support and advice. © VDT Attorneys
www.vdt.co.za |012 – 452 1300 |info@vdt.co.za
