InfoReg Pansy Tlakula: POPIA Fines Challenged By Grace Period

• InfoReg chairperson Pansy Tlakula identified a grace period for public bodies as a key weakness in POPIA enforcement.
• Public entities often comply within given timeframes or challenge fines in court, preventing the full imposition of penalties.
• The InfoReg issued its highest fines to date, R5 million each, to the Department of Justice and Constitutional Development and the Department of Basic Education.
• A R500,000 fine against Blouberg Local Municipality was reduced to R250,000 by a court, citing it as a first offense.
• Other fines include R100,000 each for the Electoral Commission, Lancet Laboratories (both paid), and a R200,000 fine for FT Rams Consulting (for direct marketing), for which court proceedings have been initiated due to non-payment.

The Information Regulator has identified a significant hurdle in its enforcement efforts against public bodies: a grace period provision within the Protection of Personal Information Act (POPIA) that allows institutions to either rectify violations or challenge penalties in court.

The Information Regulator (InfoReg) recently convened a media briefing at its new Woodmead headquarters, where its chairperson, Advocate Pansy Tlakula, shed light on significant challenges in enforcing the Protection of Personal Information Act (POPIA). A primary concern articulated by Tlakula is a specific "grace period" provision within POPIA, which she identifies as a key weakness hindering the regulator's ability to impose and collect substantial fines, particularly from public sector entities.

Since its enforcement powers became active on July 1, 2021, following a year-long grace period for all organizations to achieve compliance, the InfoReg has indeed issued several high-value, seven-figure fines to POPIA violators. However, these penalties have frequently failed to materialize as initially intended. Instead, public bodies found to be in breach often opt to challenge these enforcement actions through legal channels, leading to protracted court proceedings and a reduction or complete avoidance of the proposed financial penalties.

Advocate Tlakula elaborated on the practical implications of the grace period, explaining that when the InfoReg identifies a POPIA breach by a public institution, it first grants a specific timeframe for that institution to rectify the violation and achieve compliance. A critical aspect of this provision is that if the public body successfully complies within the allotted period, the InfoReg is then unable to proceed with the fine.

Should an institution fail to comply, or if it disputes the regulator's findings, it retains the right to challenge the enforcement action in court. This legal recourse means the InfoReg must await the conclusion of judicial processes before any penalty can be finalized or collected. POPIA itself establishes a robust framework for data protection, outlining potential penalties for breaches that include fines up to R10 million and imprisonment for up to ten years, depending on the severity of the offense. However, the current operational dynamic, particularly concerning public bodies, often circumvents the full application of these maximum penalties.

Despite these challenges, the Information Regulator has actively pursued enforcement actions, issuing notable fines against several entities. In a landmark move in July 2023, the InfoReg imposed its first R5 million fine on the Department of Justice and Constitutional Development for a POPIA breach. Similarly, the Department of Basic Education was also hit with a R5 million fine, marking these as the highest penalties issued by the regulator to date.

Other entities have also faced penalties, with the Electoral Commission (IEC) of South Africa and Lancet Laboratories each receiving R100,000 fines, which both organizations subsequently paid. A significant case involved the Blouberg Local Municipality in the Western Cape, which was initially fined R500,000. Upon the municipality's refusal to pay, the InfoReg sought court verification, leading to the fine being reduced to R250,000. The court justified this reduction by deeming the original amount excessive for a first offense. Additionally, the InfoReg imposed a R200,000 fine against FT Rams Consulting for direct marketing violations under Section 109 of the Act, and has initiated court proceedings as the company failed to pay.

The InfoReg's executive for POPIA, Advocate Tshepo Boikanyo, provided further details on some of these specific cases, confirming the R100,000 fines for the IEC and Lancet Laboratories, and the court-mandated reduction for Blouberg Municipality. Chairperson Pansy Tlakula acknowledged the progress made in issuing fines but also candidly expressed that the regulator "could do better" in its enforcement efforts.

The ongoing challenges underscore the complexities faced by the Information Regulator South Africa in fully implementing and enforcing POPIA. While the regulator has demonstrated its capacity to identify breaches and levy substantial penalties, the statutory grace period and the subsequent legal avenues available to public bodies present a persistent hurdle to the consistent and full realization of these fines. The InfoReg continues its work from its new headquarters. striving to strengthen its enforcement capabilities amidst these operational realities.

Lawyers advising public bodies should note the Information Regulator's stated challenge in enforcing fines due to the POPIA grace period, which allows for compliance within timeframes or court challenges that can reduce penalties. This highlights a potential avenue for mitigating enforcement actions for public sector clients, while also indicating the regulator's ongoing efforts to strengthen its enforcement capabilities.

Source: Insights from a recent media briefing.