Current legal Popi legislation is wobbly

TECHNOLOGY is advancing much more quickly than most people anticipated even a decade ago. This begs the question as to whether or not our social, economic and political institutions and structures are equipped, or have developed sufficiently, to deal with the ethical and legal challenges that these advancements have brought and are ever more rapidly bringing.

My view is that the law is not at present up to the task.

It is true that South Africa started recognising electronic communications as legally valid early in the 21st century, but there have been few developments since then.

In this context, the most important piece of legislation passed since the Electronic Communications and Transactions Act came into effect is the Protection of Personal Information (Popi) Act.

Protection This prescribes, in essence, the conditions under which “personal information” can be collected, processed, stored and reused and ascribes responsibility for the protection of personal information between the parties that come into contact with such information.

But there is an argument that even Popi is somewhat lacking in the nuance and sophistication needed to tackle the type of issues that might arise in the digital world.

Personal information, which is the key ingredient needed to trigger the application of Popi, is defined as information relating to an identifiable, living person, including (but not limited to) information about such a person’s age, race and sex; his/her biometric information; information about his/ her educational or medical history; information about his/her personal opinions, views and preferences; and information that is routinely collected by apps and websites, like online identifiers and location information.

Definition It is not clear, for example, that this definition captures images or video of a person when there is no other identifier present (other than the person’s face and physical features).

Furthermore, “big data” is not necessarily concerned with identifying individual users; it routinely aggregates information to give insights into the collective desires, motivations and preferences (both explicit and implicit) of various groups, thereby allowing companies to tailor their products and services and, importantly, their marketing efforts to these groups accordingly.

The recent US elections featured some discussion about the way in which the Democrats and Republicans targeted campaign messaging to sections of the populace using aggregated big data.

There was a general unease about the extent to which this sort of practice was socially acceptable.

Fundamental Popi is potentially too narrowly framed to deal with either of the examples given above.

Recognition of the insights which aggregated data does provide, and the uses to which those insights can be put, is fundamental to ensuring that law and policymakers are better equipped to make decisions about the extent to which the legal framework does require amendment or extension.

My intention is not to make some normative claim about the value of technological advances and developments, but rather to draw attention to the fact that our current legal infrastructure has shortcomings in this regard that have not necessarily been appreciated until now.

We need a robust debate about these issues, so that we can, if necessary, enact policy to deal with whatever is deemed socially undesirable.