Do PoPI and Paia overlap?
LAW: WHAT DOES IT MEAN FOR OWNER?
Thorough understanding of how the Acts work in tandem is necessary.
Legislation in a country is the centre piece of governance but sometimes governments create redundant legislation that overlaps or contradicts an already standing piece of legislation. A good case can be made of the recently introduced Protection of Personal Information Act (PoPI) which can be assumed to contradict the Promotion of Access to Information Act (Paia) of 2000.
On the one hand, Paia advocates for the access to information for a myriad of reasons such as research, statistics, population data, and income groups; whereas PoPI denounces the dissemination of personal information in an attempt to protect our privacy. Could we therefore assume government made an error by contradiction? Not at all. Careful consideration went into PoPI and throughout the Act there is a complementary theme to Paia with such phrases as ‘with provisions to Paia’ which clearly shows that PoPI is not meant to contradict but rather complement and, more importantly, hinder those that might misuse Paia to gain personal information.
Therefore, how does Paia work in relation to PoPI? Because as much as organisations are scrambling to come into compliance with PoPI they must not forget that Paia is still an Act that must be complied with. Well, the underlying purpose of Paia is accessibility of information from those that hold it. Organisations across the country possess incalculable personal information that is necessary for statistics amongst other functions. And, essentially, Paia dictates the lawful means of requesting records for lawful use from public and private bodies.
But what does this mean for a business owner? Clearly both Acts impact businesses and a thorough understanding of how the Acts work in tandem is necessary for proper implementation. To start, you must understand what qualifies as records necessary to be accessed. Only then can you determine whether or not the information being requested is within the scope of access to information. Thereafter you must determine the purpose of the requester and if at all there is any legitimacy behind their request.
It is therefore prudent to have policies that dictate the issuance of requested information and at the same time protects personal information. Additionally, Paia speaks of a manual of processes of how organisations assess and adjudicate either granting or withholding records from a requester. This allows you to have set guidelines that requesters must follow if they are to be given access to your records.
Access to information is very important, but so is protection of personal information. Therefore a systematic balancing act is required. Otherwise, you might find yourself facing damage claims for distributing personal information to the wrong parties for the wrong reasons.
Munya Duvera is CEO at Duvera Elgroup
Paia dictates law for requesting records