POPIA: is your sectional title scheme compliant?

De Lucia Group, sectional title property experts, unpacks how POPIA will impact the running of your scheme. 

POPIA in simple terms

POPIA is a legal framework that sets guidelines for the collection and processing of personal information from individuals.

POPIA was created to alter how businesses and other organisations handle the information of those that interact with them.  The regulation has introduced big changes but builds on previous data protection principles.  The crucial thing about what constitutes personal data is that it allows a person to be identified.

POPIA overview

The President has proclaimed 1 July 2020 to be the POPI/POPIA commencement date. It is important because a grace period of one year starts running from that date.  The majority of the POPIA Act (especially the sections that create compliance requirements) commence from the date as aforementioned.  These sections are sections 2 to 38; sections 55 to 109, section 111; and section 114(1), (2), and (3).

At the core of POPIA there are eight key conditions, which have been designed to guide how people's data can be handled.  They don't act as hard rules, but instead as an overarching framework that is designed to layout the broad purposes of POPIA. 

The eight conditions to comply with as set out below-

1. Accountability  - The responsible person must comply with all relevant regulations.
2. Processing limitation - You can only process information that is relevant and only to the point that it is needed.
3. Purpose specification - You must have a specific lawful purpose for collecting personal information
4. Further processing Limitation - Once you have collected the information, you can only process it in a way that it is necessary, relevant and in keeping with its original stated purpose
5. Information quality - Information must be updated, accurate and may not be misleading
6. Openness - Detailed records must be kept of personal information and the data subject must be made aware of factors such as the process.
7. Security safeguards - Data must be properly secured so that it is not lost, destroyed or accessed without authorisation.
8. Data subject participation - the data subject is allowed to understand all processes in place, why the information is being held, for what purpose and if any third party has access to the information as well as their details

Under POPIA there are also a few special categories of sensitive personal data that are given greater protection. This personal data includes but is not limited to information about racial or ethnic origin, political opinions, religious beliefs and biometric data.  Information in respect of minors also requires special consent.

The regulation also gives individuals the power to get their personal data erased in some circumstances. This includes where it is no longer necessary for the purpose it was collected.

You can read more about the Act by clicking here.

Why POPIA matters for sectional title schemes

In the normal course of their duties scheme executives are required to collect the personal information of the owners and occupiers of the scheme, and the owners and residents have a concomitant obligation to furnish this information to them. For example, section 13(1)(f) of the Sectional Titles Schemes Management Act, 8 of 2011 obliges the owner of a unit "to notify the body corporate of any change in ownership or occupancy of his or her section and of any mortgage without delay".

Prescribed Management Rule 27(2)(b) states that the Body Corporate must obtain the following information, which must be kept updated:

• lists of trustees, members and tenants with their full names, identity numbers or, in the case of non-South African citizens, their passport numbers; and
• section addresses and mailing addresses, if different;
• telephone numbers; and
• email or other electronic addresses.

All scheme executives, in this case Trustees, have a statutory and common law fiduciary obligation to act in good faith, and with due diligence and care in the interests of their community scheme at all times.

Understanding the impact 

Schemes are expected to put in place comprehensive but proportionate governance measures.  Ultimately, these measures should minimise the risk of breaches and uphold the protection of personal data.  Failure to do so carries with it the potential for grave financial consequences (fines of up to R10 million), including reputational damage and in more serious cases lead to imprisonment. 

POPIA's requirements for sectional title schemes

There is no one size fits all approach to preparing for POPIA compliance. Rather, each scheme needs to know what exactly needs to be achieved to comply. 

We set out hereunder as brief guideline -

• An Information Officer must be appointed to oversee compliance with the Act by the scheme;
• An impact awareness assessment must be undertaken;
• A compliance framework must be developed, implemented, and monitored;
• A PAIA (Promotion of Access to Information Act) manual must be developed, monitored, maintained, and made available;
• Special consents where required must be obtained with specific reference to minors and biometric systems, where applicable;
• Contracts entered into with third parties and suppliers must be amended to include non-disclosure procedures and policies;
• WhatsApp Groups and websites must include consents and disclaimers and be carefully monitored.

These requirements can seem overwhelming for sectional title schemes. However, with a driven Information Officer and managing agent, you can ensure your scheme is compliant. 

Role of the Information Officer in sectional title schemes

One of the key requirements of POPIA is the appointment of an Information Officer within your sectional title scheme. This individual will be tasked with championing the aims of the legislation - and compliance with it.

PAIA automatically designates the head in an "organisation" as an information officer. In the case of a scheme, by default, the Chairperson is designated. The designation and delegation of authority must be in writing and allows for the Information Officer to delegate some of his/her duties to the Deputy Information Officer. However, the Information Officer will still retain the accountability and responsibility for the functions delegated to the Deputy Information Officer. The Information Officer must be registered with the Regulator.

The full role and responsibilities of the Information Officer are set out in Section 55 of POPIA.

The presentation of material in this publication do not imply the expression of any opinion whatsoever on the part of the De Lucia Group. Every effort has been made to ensure the accuracy of the information.

Neither the De Lucia Group nor the author or contributors shall be liable for any claim, loss or damage directly or indirectly resulting from the use of or reliance upon the information,  directly or directly or indirectly resulting from errors, inaccuracies or omissions.

Get your sectional title scheme POPIA compliant

By law, your sectional title scheme must meet its POPIA obligations and ensure all measures are in place to protect the processing of personal information and special information. De Lucia Group is assisting our clients to get compliant, and are ready to help other schemes achieve their POPIA goals. To get on track, send a message to De Lucia Group, call Michael De Lucia directly on 082 493 1089, or email michaeldl@delucia.co.za.

- visit our website

- like and view us on Facebook

- connect via LinkedIn

- visit our Instagram

- view our location

- sign up to our newsletter