South Africa Privacy Chief Nominee Sets Sights on Text Spam

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Edwin Naidu

Sept. 20 — The nominee to be South Africa’s first chief privacy regulator—Pansy Tlakula—told Bloomberg BNA that if confirmed she plans to make spam texts one of her primary issues for enforcement.

Companies sending direct marketing materials without the consent of recipients may face fines up to 10 million rand ($702,807) and a maximum of 10 years in prison, Tlakula said in her first interview since being nominated by Parliament to become chairwoman of the commission charged with implementing the country's privacy law.

“We are being bombarded with information, there are many firms who have private information that is being used for annoying direct marketing, that is the biggest problem we will have to deal with,” Tlakula said.

Pansy Tlakula 2

If approved by the Minister of Justice and Correctional Services and president, Tlakula, an attorney, will become the chief enforcer of the country's framework data protection law, the Protection of Personal Information Act (PoPI). The law was passed in an attempt to make the country competitive in the global information economy.

Dominic Cull, an information and communications technology attorney at Ellipsis Regulatory Solutions in Cape Town, South Africa, told Bloomberg BNA that PoPI “will make it easier and less risky for multinationals” doing business in the country. “Many have resisted doing business due to a lack in data protection laws, that could leave them exposed to data breach and it dire consequences,” he said.

The nomination of Tlakula is another step forward in the slow process of implementing PoPI and “should be welcomed,” he said. But much must still be done “before obligations and protections under the Act are available to South Africans,” he said.

Impact on Multinationals

PoPI was enacted in 2013, but will only start to become effective with the confirmation of a chief privacy regulator.

Multinationals doing business in South Africa and companies engaged in transferring personal data out of the country would fall under Tlakula's jurisdiction. “As long as firms operating in South Africa keep information of the country’s citizens, they will have to comply,” she said.

Wale Arewa, the CEO of Xperien a leading African information technology security and asset disposal company, said in a statement that he is excited that PoPI is getting closer to effective implementation. In particular he pointed to provisions in the law to allow individuals to seek recourse if their personal information is breached.

But Roger Hislop, communications chairman of the Wireless Access Providers’ Association of South Africa, told Bloomberg that the nomination of Tlakula doesn't mean that PoPI will take immediate effect. It may be a long time until the nomination process is complete and something concrete happens, he said.

Seeking Dialogue With Companies

Tlakula said she was mindful of the challenges that lay ahead, and the need for education and advocacy to spread the word about PoPI which outlines the need for security safeguards for personal information.

While there is a general privacy and information oversight role, Tlakula said her duties would not be limited to monitoring. The law authorizes the privacy office to conduct searches and seizures in investigations of companies, subpoena companies for information and levy fines, she said “Monitoring and enforcement are key aspects of the job,” she said.

But Tlakula said she isn't set on becoming a draconian enforcer but instead is looking forward to a conversation with business. “The last thing we want is an adversarial relationship, we need good cooperation” with companies, she said.

Tlakula said she isn't a technology expert. “I am a technology user, like most consumers,” she said.

Access to Information

Tlakula has been a human rights activist for many years and is the head of the African Commission on Human and Peoples’ Rights. She said that in that position her work on access to information issues will prove useful.

Tlakula, who also serves as the ACHPR’s Special Rapporteur on Freedom of Expression and Access to Information, said people regard PoPI as just legislation about privacy but it is also about promotion of access to information. “Information must be available, it is an enabler to all rights,” she said.

Tlakula's travel around the continent in support of information access rights keeps her busy. “Every week, I am on a plane, I am tired, and have had not much time to think or be excited” about the nomination to be privacy chief, she said.

To contact the reporter on this story: Edwin Naidu in Johannesburg at

To contact the editors responsible for this story: Donald G. Aplin at ; Jimmy H. Koo at

Copyright © 2016 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law Privacy and Data Security