The start of the dormant provisions of the Protection of Personal Information (PoPI) Act 4 of 2013 is possibly being delayed, owing to the establishment of the Office of the Information Regulator, which will be a watchdog for the new Act, suggests business law and litigation firm Fasken Martineau partner Melanie Hart.

The Act will demand that employers implement more stringent measures when processing personal information of their employees.

While certain provisions of PoPI were signed into law with effect from April 11, 2014, the date on which the remaining provisions take effect is yet to be determined by the President and there is currently no certainty as to when this will be, with previous speculation that it would happen by the end of 2015, says Hart.

It also dictates that employers must be held accountable for the way in which they process personal information of employees and it forces them to ensure that such information is processed only with the consent of the data subject, or employee.

PoPI also stipulates that an employer has to be exercising a legitimate purpose before personal information can be requested and that the processing of the information must be compatible with the purpose. There is a prohibition on the processing of special personal information that is generally regarded as discriminatory, such as race or ethnic origin and religious or philosophical beliefs.

The processing of information is defined broadly as any activity related to personal information, including the collection, storage, retention and deletion thereof.

Employers will have one year from the date on which the dormant provisions come into effect to comply with the Act, which is why Fasken Martineau recommends that employers begin taking steps towards compliance now.

Hart states that companies could, for instance, start considering whether there is a legitimate and justifiable purpose for the collection of certain employee information and should remain cautious about doing so, even when the expectation of privacy in relation to certain information is questionable.

She further advises companies to designate an information officer to oversee compliance with the Act and suggests that companies prepare an official policy to govern the processing of personal information throughout the employment life cycle.

Companies are responsible for ensuring that the information remains accurate and secure and that employees can access their personal information at all times, Hart adds.

PoPI covers the entire employment spectrum, from recruitment to retirement, as it governs the pre-employment screening of job applicants, the processing of personal information of employees during employment and retaining such information of employees after employment.

This will require companies to review job application forms to ensure that the forms contain the requisite consent from the prospective employee so that the pre-employment screening checks are conducted legally by the employer or a third party on behalf of the employer.

Hart adds that companies should compile a data-processing consent form for existing employees, which authorises the processing of their personal information.

She explains that PoPI designates the employer as the responsible adherent to the Act and, in cases where a potential employer hires a recruitment agent, the onus is on the employer to ensure that the recruitment process is conducted in accordance with the Act.

Hart advises companies to establish adequate safeguards when appointing recruiters to conduct the pre-employment screening checks to ensure that they comply with PoPI provisions on the employer’s behalf, such as requiring a warranty that the recruiter must obtain the necessary consent from the job applicant to conduct the screening checks.

Many similar laws that secure the privacy of employees have been passed in foreign juris- dictions and South Africa has lagged behind in this regard, she states.

Hart adds that PoPI matches more closely the values supported by the conventions of the International Labour Organisation, which South Africa has ratified, and concludes that joining the international trend has become more pertinent, owing to the increased cross-border flow of information.