The Protection of Personal Information Act (POPIA) has been in force since the 1st of July 2021. By now, most South African organisations should have designed, developed, and implemented their POPIA compliance program. However, constraining factors are already emerging, and the local government sector is especially feeling the pressure.
Organisations need to appreciate the fact that security is not privacy – and privacy is not security. Yes, POPIA does provide for the confidentiality, integrity, and availability of personal information (i.e., security), but it also provides for certain conditions for processing of personal information. This is the privacy aspect.
A major factor preventing many local government authorities from efficiently administering POPIA requirements is the infrastructure divide. While most metropolitan and urban municipalities have high capacity for implementing sound electronic management systems, municipalities with inferior infrastructure are faced with a capacity challenge. However, those with sound security cannot rest, assuming that that is all that’s required.
For those local authorities that lag behind on technology infrastructure, particularly in rural areas where smaller municipalities are still largely reliant on paper-based processes, this presents more of a challenge. Without the essential human and financial resources to properly implement POPIA, they will find it difficult to collect, catalogue, digitise and safeguard vast amounts of data. But regardless of these circumstances, the fact remains – all municipalities must comply with POPIA.
Since municipalities are often the primary interface between citizens and government, it is crucial that they fulfil their duty to protect the right to privacy of clients and the citizens whom they serve. This means ensuring that appropriate technical and organisational measures, policies, procedures and processes are in place to protect personal information.
Municipalities must urgently educate and train their staff on incorporating POPIA into their daily operations and on implementing adjusted technology solutions. Internal education sessions may be needed to ensure that all officials are fully aware of the requirements of POPIA.
Of the processing conditions, accountability tops the list – and it is the Municipal Manager who is accountable for ensuring that the POPIA compliance program is implemented.
Municipalities also need to be transparent and place on record their reasons for collecting personal information, as well as informing their clients as to what they do with their personal information, how they protect it and who they might share it with.
Secure information technology systems will further allow municipalities to comply to POPIA. The appropriate security measurements will allow systems to:
- Identify internal and external risks.
- Establish and maintain safeguards against identified risks.
- Regularly verify if safeguards are effective and continuously update them to respond to new risks.
- Deploy effective security and access controls – this includes all devices used onsite as well as offsite (such as work-from-home-scenarios).
- Install data encryption, authentication measures, and effective anti-virus and anti-malware software.
- Back up all data in offsite locations.
- Achieve data privacy and integrity with efficient and secure electronic document management and storage.
- Maintain a secure network safeguarded from security threats and cyber-attacks.
- Achieve total email protection.
Municipalities must take steps to ensure that they do not fall behind on implementing the required security measurements and privacy policies.
The bonus is that they will derive great value by addressing the challenges of POPIA in this way, gaining the opportunity to simplify, review and streamline their business operations, policies and processes. Which is why a solutions-driven approach to implementing POPIA compliance will play a pivotal role in building big picture capacity at local government level.
If your municipality requires assistance with POPIA compliance, chat to us about our POPIA services.
Inzalo EMS is a government-centric technologies company based in Centurion, Gauteng. We focus on current leading technologies and public policies to incite technology innovation in the municipal space. Learn more at www.inzaloems.co.za.