POPIA gives a broad interpretation to “personal information”, and defines it in its Section 1 as information relating to an identifiable, living, natural person, or relating to an identifiable, existing juristic person. It follows that POPIA does not apply to the personal information of deceased persons, or to personal information that has been ‘de-identified’ (in other words, when one is no longer able to identify a person by means of the information, eg. by converting a name to a random number).
So, if you process “personal information”, you must at all times do this compliant with POPIA’s conditions.
BUT, for some information, POPIA sets the bar even higher:
- Section 26-35 POPIA: unless you fall into a particular category and you comply with the special conditions listed in sections 26-35 POPIA, you MAY NOT process “special personal information” concerning the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, and criminal behaviour of a data subject, or personal information of children (<18).
- Section 57-59 POPIA: if you intend to process information listed in section 57 POPIA, including further processing and linking of unique identifiers, criminal behaviour, credit reporting, or transferring “special personal information” to a third party in a foreign country, you need to apply for “prior authorisation” from the Information Regulator.
Personal information means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to—
- (a) information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
- (b) information relating to the education or the medical, financial, criminal or employment history of the person;
- (c) any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;
- (d) the biometric information of the person;
- (e) the personal opinions, views or preferences of the person;
- (f) correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
- (g) the views or opinions of another individual about the person; and
- (h) the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person;