22 June 2020

Media Monitoring Africa (MMA) welcomes the President’s announcement that the outstanding
provisions of the Protection of Personal Information Act 4 of 2013 (POPIA) will commence on
1 July 2020. Responsible parties, which includes both public and private sector entities, will
now have until 30 June 2021 to ensure compliance with POPIA.

The commencement of the outstanding provisions of POPIA is an issue in which MMA has been
directly engaged. On 2 March 2020, MMA – represented by Power Singh Inc. – wrote to the
President and the Minister of Justice and Correctional Services, arguing that the failure to bring
the substantive provisions of POPIA into force was a consequent failure to realise the right to
privacy in South Africa, as guaranteed in section 14 of the Constitution. MMA also drew
attention to section 237 of the Constitution, which requires that all constitutional obligations
must be performed diligently and without delay.

Following subsequent correspondence, MMA’s most recent letter on 9 June 2020 called for the
Office of the Presidency to provide clear and specific timeframes for when the inoperative
provisions of POPIA would be brought into force, failing which MMA would approach the courts
to enforce the state’s obligation to respect, protect and fulfil the right to privacy diligently and
without delay. MMA provided a deadline of 30 June 2020 for this demand to be met.

MMA is therefore delighted that this deadline has been complied with, and that there is now
clarity on when the inoperative provisions of POPIA will be brought into force. POPIA is an
important piece of legislation for the realisation of the rights to privacy and access to
information, and contains much-needed safeguards for the processing of personal information.
Moreover, POPIA seeks to protect the rights of all data subjects, and provides a mechanism
through which data subjects can seek to vindicate their rights if their personal information has
not been processed lawfully.

MMA remains concerned by the ongoing data violations that are occurring in South Africa,
including data breaches and data exploitation of some of the most vulnerable members of
society. The COVID-19 pandemic has highlighted the urgent need for a comprehensive and
effective data protection framework to be put in place, as personal information of all personals
in South Africa (such as location information and sensitive health information) has been
rendered vulnerable and at risk by the failure to do so.

MMA will continue to work with all relevant stakeholders, including the Information Regulator,
to strive towards an effective data protection framework that gives meaningful effect to the
right to privacy, vindicates the rights of data subjects, and is updated and relevant in the digital
era.