The Information Regulator of South Africa (“Regulator”) held a media briefing on the outcomes of high-profile investigations under the Promotion of Access to Information Act 2 of 2000 (“PAIA”) and the Protection of Personal Information Act 4 of 2013 (“POPIA”). The Regulator shed insight on its enforcement work thus far, the matters it has investigated under PAIA and POPIA, and the compliance complaints it has received against various private and public entities.
Advocate Pansy Tlakula began with a statistical overview of the general compliance with PAIA and POPIA amongst public and private entities including universities, political parties, the South African Police Service (“SAPS”), national and provincial governments, and JSE listed companies.
During the 2023/2024 financial year, the Regulator conducted 8 (eight) investigations under its PAIA division. Five of the investigations have been finalised, two are still pending before the Enforcement Committee, and one is ready for determination by members of the Regulator. The PAIA division further conducted 108 own-initiative assessments.
Amongst the 13 represented parties in Parliament the Regulator found about 54% of the parties to have been non-compliant with PAIA and about 46% having some level of compliance, with room for improvement. Of the 27 JSE listed companies assessed for PAIA compliance, all 27 were found to be generally compliant, however with room for improvement on areas including the designation of Deputy Information Officers and the compilation of compliant PAIA Manuals. About 13 universities were found to have compiled PAIA Manuals, however, not all the PAIA Manuals were compliant with PAIA and only 40% of the universities made their PAIA Manuals publicly available. The Regulator raised concerns that only 40% of the universities submitted their section 32 Reports as required by PAIA. About 27 national and 27 provincial government departments were assessed, except the State Security Agency which is exempt from publishing a PAIA manual. The Regulator raised concerns that less than half of the government departments complied with the section 32 reporting requirements.
In relation to POPIA, the Regulator received 982 complaints and 14 responsible parties were assessed for compliance. Of these, 682 complaints were resolved, and 10 assessments were completed and are ready for determination by the Regulator through the issuing of enforcement notices.
In terms of its enforcement work, the Regulator concluded its investigation into TransUnion, Dischem, and the SAPS. All three entities were found to have complied with the Regulator’s enforcement notices, and the matters have now been closed.
Currently, the Regulator at its own initiative is pursuing investigations into the Companies and Intellectual Property Commission (“CIPC“), SAPS, and the Competition Commission. We look forward to the outcomes of these investigations.
Contact us for more good, clear, precise advice.
