Publications
Partners
Cape Town - The Protection of Personal Information Bill (Popi) is expected to be passed before the end of the year and many South African businesses are scrambling to ensure that their operations are compliant – particularly with regards to their call centre operations.
Jana van Zyl of Dommisse Attorneys in Cape Town foresees that call centres would need to review their current business operations.
“The bill will change how call centres use, share and retain their customers’ and prospects’ information. This will include operations for specific campaigns run on behalf of clients,” she said.
There are close to 1 900 call centres in South Africa of which about 40% of the outsourced ones are dedicated to outbound sales and telemarketing.
“Physical security measures as well as technical security measures would need to be addressed. Access control is crucial,” warned Van Zyl.
“If there is a breach of data, under Popi it will still not rid you of your own responsibilities and accountability, even if you can hold your IT service provider accountable contractually.”
Bruce von Maltitz, director of 1Stream, a hosted call centre technology provider, added that in terms of Popi the “responsible party” must prove or disprove the claims made against them.
Call centres would have to prove that they had implemented “reasonable organisational measures” to protect data.
Popi states that call centres are also obliged to only use information for the purposes for which it had been collected.
If a person signed up for a specific campaign only, and the call centre collected the data to use for that campaign only, the person should not be contacted for a different campaign.
If someone only opted in to receive SMS communication, the call centre should use that channel and that channel only.
In terms of Popi a person also has a right to obtain a copy of the record of personal information that a call centre might have on him.
If the company was not by law entitled to have that information, they may ask for it to be deleted.
Companies will also need to disclose security breaches, for example where personal information has been hacked or lost, said Van Zyl.
In the UK a fine was imposed where sensitive information was sent to the wrong person.
Another reported incident was a laptop containing personal information, which was not enrcypted, being lost.
It is important to realise the implications of non-compliance with the act and take the necessary steps to secure data and information, according to Bertus Korb, managing director of Nashua Finance.
“In today’s technologically connected office environment, information and data flow more freely through an organisation than ever before,” said Korb.
“This scenario has resulted in the personal information of both employees and clients becoming ever-present and instantly accessible to numerous people.”
“Popi is regarded as a well-balanced piece of legislation, in line with similar legislation existing in about 70 to 80 countries,” continued Korb.
“The scope of the act is extremely wide and the personal information of every legal entity and individual person closely protected through the enforcement of the statute.”
He explained that the act primarily relates to the way information is used and re-used by the recipients of the information.
It is the responsibility of the party gathering the information to ensure it is accurate, current and not misleading.
Information may only be processed if voluntary, specific and informed consent had been obtained.
Contravention of the act could include fines of up to R10m and prison sentences of between one and ten years.
- Fin24
Jana van Zyl of Dommisse Attorneys in Cape Town foresees that call centres would need to review their current business operations.
“The bill will change how call centres use, share and retain their customers’ and prospects’ information. This will include operations for specific campaigns run on behalf of clients,” she said.
There are close to 1 900 call centres in South Africa of which about 40% of the outsourced ones are dedicated to outbound sales and telemarketing.
“Physical security measures as well as technical security measures would need to be addressed. Access control is crucial,” warned Van Zyl.
“If there is a breach of data, under Popi it will still not rid you of your own responsibilities and accountability, even if you can hold your IT service provider accountable contractually.”
Bruce von Maltitz, director of 1Stream, a hosted call centre technology provider, added that in terms of Popi the “responsible party” must prove or disprove the claims made against them.
Call centres would have to prove that they had implemented “reasonable organisational measures” to protect data.
Popi states that call centres are also obliged to only use information for the purposes for which it had been collected.
If a person signed up for a specific campaign only, and the call centre collected the data to use for that campaign only, the person should not be contacted for a different campaign.
If someone only opted in to receive SMS communication, the call centre should use that channel and that channel only.
In terms of Popi a person also has a right to obtain a copy of the record of personal information that a call centre might have on him.
If the company was not by law entitled to have that information, they may ask for it to be deleted.
Companies will also need to disclose security breaches, for example where personal information has been hacked or lost, said Van Zyl.
In the UK a fine was imposed where sensitive information was sent to the wrong person.
Another reported incident was a laptop containing personal information, which was not enrcypted, being lost.
It is important to realise the implications of non-compliance with the act and take the necessary steps to secure data and information, according to Bertus Korb, managing director of Nashua Finance.
“In today’s technologically connected office environment, information and data flow more freely through an organisation than ever before,” said Korb.
“This scenario has resulted in the personal information of both employees and clients becoming ever-present and instantly accessible to numerous people.”
“Popi is regarded as a well-balanced piece of legislation, in line with similar legislation existing in about 70 to 80 countries,” continued Korb.
“The scope of the act is extremely wide and the personal information of every legal entity and individual person closely protected through the enforcement of the statute.”
He explained that the act primarily relates to the way information is used and re-used by the recipients of the information.
It is the responsibility of the party gathering the information to ensure it is accurate, current and not misleading.
Information may only be processed if voluntary, specific and informed consent had been obtained.
Contravention of the act could include fines of up to R10m and prison sentences of between one and ten years.
- Fin24
