Here are the questions we disucssed:
PAIA MANUAL FAQ’s
1. What is a PAIA Manual?
A PAIA Manual is a document that every private and public body must prepare and publish in terms of section 51 of the PAIA Act (The Promotion of Access to Information Act, No. 2 of 2000).
2. What information must be included in a PAIA manual?
The manual must include, inter alia:
(i) details of the private body;
(ii) details of the head of the private body, the head also being the information officer, to whom requests for information must be submitted;
(iii) a description of the records held by the private body;
(iv) details on how to access a record of the body;
(v) details of the subjects from whom the body collects information and the categories of information relating to those subjects;
(vi) a description of who receives the personal information;
(vii) information about the security measures taken to protect personal information collected.
3. What is a private body?
In terms of the legislation, a private body is defined as a natural person or a partnership who carries or has carried on any trade, business or profession, or any former or existing juristic person. For the purposes of this discussion we will only focus on private bodies.
4. By when must a private body prepare their PAIA Manual?
To date only “large private companies” meeting certain employee and turnover thresholds, and public companies have been required to prepare and lodge their PAIA manuals. This means that sole proprietors, partnerships, “small private companies” and other juristic persons such as trusts, have enjoyed long standing exemptions in this regard.
In light of the enforcement of the POPI Act from 1 July 2021, the Minister for Justice and Correction Services, by way of Government Gazette, published on 18 December 2020, extended that exemption only until 30 June 2021.
This means that all previously exempted private bodies, must now prepare and lodge their PAIA manuals by 30 June 2021.
5. What is the purpose of the PAIA Act?
Section 32 of the Constitution affords everyone the right of access to information held by the state and other persons that may be required to enforce or exercise any rights. PAIA came into operation on 9 March 2001 for these purposes, assisting everyone to request information from public and private bodies.
Of course, there are many rights in the Constitution which compete with one another and require balancing. In this case, the counter right would be the right to privacy of the Private Body which must be balanced with the right to information of the public.
This Act sets out the principles relating to, amongst other things:
(i) what information a requester can request;
(ii) the formal procedure that must be followed to facilitate that request;
(iii) the grounds for refusal of a request; and
(iv) the process for lodging an appeal where information has been denied.
6. Will the public have access to private and confidential information as a result of PAIA Manuals?
The public’s rights to access to information and privacy are fairly well balanced between the POPI Act and PAIA. Certain information is privileged and will not be accessible on request, whilst other information, as prescribed may be requested from a private body at a small fee as prescribed by PAIA.
7. I understand you have called your Manual an Information Manual. Why is that?
The document we prepare comprises two parts and not only complies with the provisions of section 51 of PAIA but also section 18 of the POPI Act. Section requires any person (whether natural or juristic) who collects personal information to make certain disclosures to any data subject, regarding the information to be collected, prior to collection of any personal information.
These disclosures include the purpose for collection of the information and the consequences of not furnishing the private body with that information. With these disclosures made in your Manual you will be able to refer all data subjects to your Manual (published on your website) and instruct them to read the Manual prior to making any disclosures to the private body instead of having to physically make those disclosures to each and every person that you collect information from.
8. What do we do with our completed manuals?
All PAIA manuals are to be:
(i) lodged with the South African Human Rights commission;
(ii) made available on the website of the private body if such a website exists;
(iii) kept at the business premises of the private body; and
(iv) made available on reasonable request.
It is important to note that the Human Rights Commission will hand over all matters relating to PAIA manuals to the newly established statutory body known as the Information Regulator on 1 July 2021, which statutory body will be responsible for the enforcement of the provisions under both PAIA and the POPI Act.
9. What will happen if we miss the 30 June 2021 deadline?
If the deadline of 30 June 2021 is missed, the Information Regulator may find the head of the private body guilty of an offence and the head of that private body then becomes liable on conviction to a fine, or to imprisonment for a period not exceeding two years. These penalties are specific to the non-submission of the manual.
10. How often must we update our manual?
These Manuals must be updated as regularly as any of the information recorded in it changes or as regularly as any additional requirements become effective in terms of the POPI Act or Regulations to PAIA.
11. If you have a PAIA Manual, are you fully POPIA compliant?
Unfortunately not. While the PAIA manual does contain elements contained in the POPI Act it is a stand alone requirement in this PAIA Act. POPIA compliance is something entirely different. The POPI act sets out eight principles with subcategories and guidelines that every person collecting personal information from another must comply with, also by no later than 30 June 2021.
12. What is the link between the POPI Act and a PAIA Manual?
The PAIA legislation facilitates requests for information by the public from private and public bodies. The POPIA legislation sets out the principles of protection of personal information.
The POPI Act came into effect much later than PAIA, but certain provisions of the POPI Act has amended section 51 of PAIA, thereby amending the required information that must be included in the PAIA Manual, which essentially means that every business that had already prepared a PAIA manual before the enactment of the POPIA legislation will have to review their manual and ensure that it is amended to comply with the amended provisions of section 51 of PAIA.
13. So ahead of the looming 30 June deadline what must clients do?
Clients can get in touch with us through your contact form. We will then assist them with the preparation and lodgement of their Manual and make the entire process painless.
In respect of POPIA compliance, our associated law firm, will walk with the client, conduct an assessment of their business and assist them with a risk assessment and the development and implementation of any policies which may be required following which they will issue them with a POPIA compliance badge which guarantees POPIA compliance.
