As part of our series of articles discussing POPI, in this article we provide insight into the requirements set out in Condition 4.
Condition 4: Further Processing Limitation
Ø Further processing to be compatible with purpose of collection
Insight: Before personal information may be processed for any other purposes than it was originally collected for, the data subject’s consent must be obtained. However, as with other conditions regarding processing and collection of personal information, there are certain exemptions to this requirement, including but not limited to:
- Where the affected person (whose personal information will be processed) has explicitly consented.
- Where law requires the secondary processing.
- Where further processing is in accordance with the original purpose. To assess the relationship between the secondary processing purpose and the original purpose for collection a number of factors must be considered and weighed to ensure informed and responsible choices are made.
To manage your company’s information processing practices in line with the Act’s requirements and related legislative requirements, it is important to identify, keep track of and assess what personal information has been collected and why (e.g. a formal log of information assets, why it is processed and how it was collected originally). This should ideally form part of a broader information lifecycle management strategy and should also align with the company’s business processes and needs.
Examples of business functions likely to be affected include and are not limited to:
- Direct marketing
- Cross selling, up selling
- Research and Development
- Customer surveying
- Profiling/ segmenting
NOTE: The insight in this article is not aimed at providing legal advice. Further the content of this article may be subject to change based on amendments to the Protection of Personal Information Act, No. 4 of 2013 and requirements of related industry legislation and codes of conduct.
Download: Mobius POPI SIG Article 4 – Condition 4