Content area

Full text

Abstract: Data protection and management of personal Information has become an integral aspect for organisations and individuals In conducting business in the modern era. It has also become a major issue for legislators, regulators and consumers worldwide due to the widespread repercussions when personal information Is negligently or maliciously used. Despite increased attention on personal Information and the existence of data protection legislation internationally, data breaches remain a common occurrence. It has become crucial now, more than ever, for organisations to manage and safeguard personal information. As a nation, South Africa has addressed the need for increased protection - the Protection of Personal Information (PoPI) Act was signed into law in November 2013. This paper presents a comparison between the South African PoPI Act and other international data protection laws in order to highlight similarities and differences. These privacy legislations will be compared based on the principles set out by the PoPI Act. Other areas to be considered include data protection officers, enforcement, electronic marketing, online privacy and the year enacted. Data protection compliance is not straightforward and having the correct measurements and procedures In place is of utmost importance. These findings can be applied in future work to examine where South Africans can make use of already established international best practices to best enforce their privacy regulation.

Keywords: data breach, compliance, personal information, PI I, PoPI Act, privacy laws

1. Introduction/background

The risk of breaching data protection legislation and regulation has grown significantly with the increase of the amounts of personal data being kept by various organisations and individuals (The Privacy Advisor, 2008). Since it is a global right for individuals to have their personal information protected against any unlawful collection, retention, dissemination and use, a significant number of data protection laws have been enacted internationally. Europe, for example, adopted the European Union's (EU) Data Protection Directive (DPD) already in 1995 (Birnhack, 2008). This Directive has been revised in 2015 and unified into a law known as the General Data Protection Regulation (GDPR). The United Kingdom (UK) adopted the Data Protection Act (DPA) in 1998 (United Kingdom Government Gazette, 1998), together with the EU DPD and was implemented in 2000. The United States does not have a specific data protection legislation, but has enacted...

Show less