Certain aspects of the Residential Communities Industry Protection of Personal Information Act (POPIA) Code of Conduct may not be aligned strictly with the Act, according to Cliffe Dekker Hofmeyr (CDH).
Sadia Rizvi, Associate in the Corporate & Commercial practice, and Technology & Communications sector at the legal support firm, said, for example, the overreliance on consent as a ground for the lawful processing of personal information and the retention period for visitor records were some of the Code’s aspects they believed may not be aligned with the POPIA.
“Furthermore, there are gaps in the code relating to the practical monitoring and compliance of the implementation of the code. We hope that these issues will be addressed in the final version,” Rizvi said.
POPIA is a piece of legislation which governs the law of data protection and privacy in South Africa.
In May, the Information Regulator published the draft Residential Communities Industry POPIA Code of Conduct, initiating a 14-day public comment period.
This Code aims to ensure that members of the Residential Communities Council (RCC) and the National Association of Managing Agents (NAMA) comply with the Protection of Personal Information Act (POPIA) and establish robust frameworks for managing the processing of personal information within residential communities.
The firm stated that, although there has been no further correspondence on the code of conduct, the 14-day period for the public to comment on the draft has lapsed. CDH added that the Information Regulator is likely to be reviewing these comments and making amendments to the code.
“The Information Regulator may not issue a code of conduct unless it has considered all the submissions made and is satisfied that all affected persons have been given a reasonable opportunity to make submissions. The final code of conduct may be amended based on public comments.”
Rizvi said taking into account that the code is not yet finalised, the draft attempts to streamline the way in which residential communities process personal information.
She said once finalised, all body corporates and body corporate schemes must process personal information in line with the code.
“Enforcement mechanisms may apply in the finalised code of conduct if these bodies do not comply with the code. It will also provide a uniform approach to personal information management, helping them to avoid the confusion or risk of inconsistent practices across different organisations,” Rizvi said.
The associate said depending on the final version of the code of conduct as it is being finalised, entities that are bound by the Code must abide by it.
Currently, enforcement measures in the draft state that members who fail to comply with the Code may face a review of their compliance with the Code by an assessor or independent adjudicator appointed by the RCC, she said.
BetterBond acknowledges the ongoing development of the Residential Communities Industry Code of Conduct under POPIA and recognises efforts to foster responsible data governance, says Bradd Bendall, BetterBond’s national head of sales.
“We remain supportive of initiatives that promote the protection of personal information and are attentive to any proposed changes.
“Should these introduce new considerations for our operations, we will seek meaningful opportunities to engage with the process in a way that reflects our commitment to shaping outcomes that best serve our clients and stakeholders, and ensure our practices remain aligned with applicable data protection requirements,” Bendall said.
Independent Media Property
