POPIA grace period limits regulator’s fines

The Protection of Personal Information Act (POPIA) introduced a grace period for public bodies to correct violations, but this leniency has become a significant weakness in the legislation, according to the Information Regulator (InfoReg). Since the regulator's enforcement powers became active on July 1, 2021, several high-value fines totaling over R20 million have been issued to organizations in violation of POPIA.

However, these fines have not been collected as public bodies have challenged them in court, with the InfoReg chairperson, advocate Pansy Tlakula, stating that the grace period is the issue. Under POPIA, companies must adhere to strict guidelines to prevent fines, potential criminal prosecution, and reputational damage. The Act provides for fines of up to R10 million and up to a 10-year prison sentence based on the severity of the breach.

The InfoReg can impose a grace period for public bodies to rectify violations before taking further enforcement actions. In July 2023, the regulator imposed its first R5 million fine on the Department of Justice and Constitutional Development for POPIA breaches. Other fines issued include R5 million for the Department of Basic Education, R100 000 for the Electoral Commission, and R100 000 for Lancet Laboratories.

The Blouberg Local Municipality's fine was reduced from R500 000 to R250 000 after a court ruling deemed it excessive for a first-time offense. FT Rams Consulting is currently under investigation for direct marketing violations, with a R100 000 fine imposed.