The South African Law Reform Commission is currently involved in an investigation into privacy and data protection. As a first step in this process the Commission hereby releases an issue paper for comment and discussion.
Privacy is a valuable aspect of personality. While potential invasions of privacy can come from many sources, a chief concern in recent years has been information privacy. Information privacy has been defined as the claim of individuals, groups or institutions to determine for themselves how, when and to what extent information about them is collected, stored or communicated to others.
Information about people and their activities can range from medical records, purchasing habits and property ownership to borrowing habits at the video store, cell phone conversations and surfing practices on the Internet - all mostly recorded in digital form. It is clear that personal information has acquired a market value.
In South Africa the right to privacy is protected in terms of both our common law and in section 14 of the Constitution. The recognition and protection of the right to privacy as a fundamental human right in the Constitution provides an indication of its importance.
The constitutional right to privacy is, like its common law counterpart, not an absolute right but may be limited in terms of law of general application and has to be balanced with other rights entrenched in the Constitution.
In protecting a person=s personal information consideration should therefore also be given to competing interests such as the administering of national social programmes, maintaining law and order, and protecting the rights, freedoms and interests of others, including the commercial interests of industry sectors such as banking, insurance, direct marketing, health care, pharmaceuticals and travel services. The task of balancing these opposing interests is a delicate one.
Concern about data protection has increased worldwide since the 1960s as a result of the expansion in the use of electronic commerce and the technological environment. The growth of centralised government and the rise of massive credit and insurance industries that manage vast computerised databases have turned the modest records of an insular society into a bazaar of data available to nearly anyone at a price. The question could no longer be whether information could be obtained, but rather whether it should be obtained and, where it has been obtained, how it should be used.
There are now well over thirty countries that have enacted data protection statutes at national or federal level and the number of such countries is steadily growing. The investigation into the possible development of data privacy legislation for South Africa is therefore in line with international trends.
Early on, it was, however, recognised that information privacy could not simply be regarded as a domestic policy problem. The increasing ease with which personal data could be transmitted outside the borders of the country of origin produced an interesting history of international harmonisation efforts, and a concomitant effort to regulate trans-border data flows.
Two crucial international instruments evolved in 1981, namely the so-called CoE (Council of Europe) Convention and the OECD (Organization for Economic Cooperation and Development)1981 (OECD) Guidelines. These two agreements have had a profound effect on the enactment of national laws around the world, even outside the OECD member countries. They incorporate technologically neutral principles relating to the collection, retention and use of personal information.
$ destroyed after its purpose is completed.
These principles are known as the APrinciples of Data Protection@ and form the basis of both legislative regulation and self-regulating control.
In 1995, the European Union furthermore enacted the Data Protection Directive which is important since articles 25 and 26 of the Directive stipulate that personal data from Europe should only flow outside the boundaries of the Union to countries that can guarantee an Aadequate level of protection@ (the so-called safe-harbour principles).
Privacy is therefore an important trade issue, as data privacy concerns can create a barrier to international trade. Considering the international trends and expectations, information privacy or data legislation will ensure South Africa=s future participation in the information market, if the country is regarded as providing Aadequate@ data protection by international standards.
The effectiveness of data protection provisions in protecting an individual=s personality rights will, however, depend largely on how they are applied and interpreted in practice. Four models aimed at the protection of personal information can be identified. Depending on their application, these models can be complementary or contradictory. In most countries several are used simultaneously.
First of all, there is a general law that governs the collection, use and dissemination of personal information by both the public and private sectors. An oversight body then ensures compliance. This is the preferred model for most countries adopting data protecting laws and was adopted by the European Union to ensure compliance with its data protection regime.
Secondly, some countries have avoided enacting general data protection rules in favour of specific sectoral laws governing, for example, video rental records and financial privacy. In such cases, enforcement is achieved through a range of mechanisms. A major drawback with this approach is that it requires that new legislation be introduced with each new technology - protection therefore frequently lags behind. There is also the problem of a lack of an oversight agency.
Thirdly, data protection can also be achieved - at least in theory - through various forms of self-regulation, in which companies and industry bodies establish codes of practice and engage in self-policing. This is currently the policy promoted by the governments of the United States and Singapore.
Finally, with the recent development of commercially available technology-based systems, data protection has also moved into the hands of individual users. It is possible to employ a range of programs and systems that provide varying degrees of privacy and security of communications.
Governments may find that proposed measures to protect privacy meet the staunch opposition of business interests which see such safeguards as an expense and an unjustified constraint on their right to conduct their business affairs as they wish. On the other hand, business interests may be enhanced by a statutory data protection regime. Many countries, especially in Asia, have developed or are currently developing data protection laws in an effort to promote electronic commerce. These countries recognise that consumers are uneasy with the increased availability of their personal data, particularly with new means of identification and forms of transactions, and therefore that their personal information is being utilised worldwide. Data privacy laws are therefore being introduced, not from a human rights perspective, but rather as part of a package of laws intended to facilitate electronic commerce by setting up uniform rules.
It should be noted that the promulgation of data protection legislation in South Africa will necessarily result in amendments to other South African legislation, most notably the Promotion of Access to Information Act 2 of 2000 and the Electronic Communications and Transactions Act 25 of 2002. Both these Acts contain interim provisions regarding data protection in South Africa.
Whether privacy and data protection should be regulated by legislation.
How the general principles of data protection could be developed and incorporated in the legislation.
Whether a statutory regulatory agency should be established.
If it is a viable option to promote a flexible approach in terms of which industries will develop their own codes of practice (in accordance with the principles set out in the legislation) which could be overseen by the regulatory agency.
The issues raised need to be debated thoroughly. The issue paper states questions which have presented themselves as relevant to the investigation. The manner in which the investigation will further progress will primarily depend on the response received to the paper.
The issue paper is obtainable free of charge from the Commission on request.
A questionnaire is also available in interactive format on the Commission=s web page at http://www.law.wits.ac.za/salc/salc.html thereby enabling respondents to submit their contributions to the Commission directly via e-mail.