PAIA and POPIA: Access to Information and Data Protection

Introduction

The Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 4 of 2013 (POPIA) are complementary statutes that give effect to constitutional rights. PAIA gives effect to the right of access to information (section 32 of the Constitution), while POPIA gives effect to the right to privacy (section 14). Together, they regulate the flow of information in South African society.

PAIA: Access to Information

PAIA provides a right of access to records held by the state and, in certain circumstances, by private bodies. The Act requires public bodies to publish information about their functions and operations. Any person may request access to a record, and the body must respond within 30 days. PAIA provides for mandatory and discretionary grounds for refusing access, including the protection of personal privacy, commercial confidentiality, and law enforcement.

Constitutional Foundation

Section 32 of the Constitution guarantees the right of access to any information held by the state and any information held by another person that is required for the exercise or protection of any right. PAIA gives effect to this right. The Constitutional Court has emphasised the importance of access to information for democratic accountability.

POPIA: Data Protection

POPIA provides comprehensive regulation of the processing of personal information. The Act establishes eight conditions for lawful processing: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation.

The Information Regulator

POPIA establishes the Information Regulator, an independent body responsible for enforcing both PAIA and POPIA. The Regulator may investigate complaints, conduct assessments, issue enforcement notices, and impose administrative fines of up to R10 million.

Automated Decision-Making

Section 71 of POPIA provides that a data subject has the right not to be subject to a decision based solely on automated processing that has legal consequences or significantly affects them. This provision is particularly relevant to artificial intelligence and algorithmic decision-making.

The Relationship Between PAIA and POPIA

PAIA and POPIA operate in a complementary relationship. PAIA provides access to information, while POPIA protects personal information. The two statutes must be interpreted harmoniously. The Information Regulator has issued guidance on the interaction between the two statutes, including the application of PAIA exemptions relating to personal information.

Conclusion

PAIA and POPIA together provide a comprehensive framework for information law in South Africa. PAIA ensures transparency and accountability through access to information, while POPIA protects privacy through the regulation of personal information processing. The Information Regulator ensures the effective implementation of both statutes.