Controlling the transfer of personal information from South Africa to foreign Countries!

The Act controls the transfer of personal information from South Africa to foreign Countries and prohibits this unless: (point 71)

The person receiving the information is subject to similar laws;
The subject has agreed to the transfer of information;
Such transfer is part of the performance of a contract which the subject is a party; or
Transfer is for the benefit of the subject and it is not reasonably practicable to obtain their consent and that such consent would be likely to be given. (point 72)

One of the key provisions under POPIA relates to cross-border information flows, where a responsible party in South Africa transfers personal information about a data subject to a third party in a foreign country outside of South Africa.

This occurs, for instance, where personal information is sent outside of South Africa to a customer or client, to a service provider or sub-contractor, or when making use of cloud storage hosted outside of South African borders.

Think about the data you share on social media and chat platforms: do you know where the servers that contain your data are located?

In the global digital age, where significant amounts of trade and commerce take place online and across multiple jurisdictions, cross-border data transfers are necessary and unavoidable for most businesses.

Relevant in this regard is point 72 of POPIA.

This section of POPIA is not yet in force, but will require, once it is in order for cross-border transfers of personal information to be permissible, one of the following must be present:

Adequate legal protection: The recipient of the personal information must be subject to a law, binding corporate rules or binding agreement which provide an adequate level of protection that effectively upholds the principles for reasonable processing, and that include provisions that are substantially similar to the conditions for the lawful processing of personal information and for the further transfer of personal information.
Consent: The data subject consents to the transfer.
Necessary for the performance of a contract: The transfer is necessary for the performance of a contract between the data subject and the responsible party, or for the implementation of pre-contractual measures taken in response to the data subject’s request.
Interests of the data subject: The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the responsible party and a third party.
Benefit of the data subject: The transfer is for the benefit of the data subject in circumstances where it is not reasonably practicable to obtain the consent of the data subject for the transfer, and the data subject would be likely to give consent had it been obtained.

These are not cumulative requirements, and only one of the above would need to be present in order for the cross-border data transfer to pass muster.

The experience in other jurisdictions has shown that one of the easiest and most convenient ways to effect cross-border data transfers is where the transfer takes place to a country with a law which provides “an adequate level of protection”, with principles for processing that are “substantially similar to the conditions for the lawful processing of personal information”, as contemplated under section 72(1)(a) of POPIA.

The question of the adequacy of legal protection in the foreign country is also specifically relevant if a responsible party intends to transfer data that falls into one of the following two categories: (i) special personal information (as set out in section 26 of POPIA, and includes, for instance, information relating to race, health, biometric information or criminal behaviour); or (ii) the personal information of children. In these circumstances, section 57(1) of POPIA provides that if such information is being transferred to a third party in a country that does not provide an adequate level of protection, the responsible party is required to obtain prior authorisation from the Regulator, prior to any processing taking place.

Determining whether the legal protection is adequate:

While the crux of the assessment is whether the law in the foreign country is adequate, POPIA provides little guidance on what this entails.

The United Kingdom (UK) Information Commissioner’s Office (ICO) has provided some guidance in this regard that may be useful when interpreting POPIA, given the similarities of the provisions in the UK and the South African laws.

Notably, the UK ICO identifies six criteria to take into consideration:

The nature of the personal data: This consideration recognises that some types of personal data will pose little risk to the rights and freedoms of data subjects, whilst the required level of protection may be higher if one is transferring special personal information, for instance.
The purposes for which the data is intended to be processed: Some purposes will carry greater risks than others. For instance, according to the UK ICO, data processed for internal company or group purposes only may involve less risk than if the data is distributed more widely.
The period during which the data is intended to be processed: The UK ICO notes that if the data is only processed once or for a short period and then destroyed, the risks arising from any lack of protection for data subjects’ rights may be less than if they are processed on a long-term basis. While this does not mean that once-off transfers may be carried out without putting any protections in place, the requirements for such protections may nevertheless be less onerous.
The country or territory of origin of the information contained in the data: Consideration must be given to circumstances where information may have been obtained in a third country, and the expectations that such data subjects may have for the level of protection that they will enjoy.
The country or territory of final destination of the information: Given that transfers may be made in several stages, the adequacy of protection of the final destination is also relevant in assessing the adequacy of protection associated with the transfer.
Any security measures taken in respect of the data in the country or territory of destination: Responsible parties exporting data may be able to ensure that personal data is protected by technical measures, such as encryption, to assist in safeguarding the personal information.