InfoReg unpacks regulatory complexities posed by AI
South Africa’s Information Regulator was established nearly a decade ago, but the data environment it oversees has changed significantly, says chairperson advocate Pansy Tlakula.
The Information Regulator (InfoReg) in South Africa faces growing regulatory challenges due to the rapid advancement of artificial intelligence (AI) and its integration into various industries. Established in December 2016, InfoReg is responsible for enforcing compliance with data protection laws such as the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA). However, the regulator now operates in a vastly different landscape compared to when these laws were enacted.
AI technologies, including ChatGPT, have become ubiquitous, raising questions about compliance and privacy. These technologies enable automated decision-making, biometric identification, and data processing at an unprecedented scale. While AI presents opportunities for economic growth, innovation, and improved service delivery, it also introduces risks to privacy, transparency, accountability, and human rights.
InfoReg chairperson advocate Pansy Tlakula highlighted the complexities surrounding AI, such as managing consent, data retention, maintaining transparency, and addressing the lack of a national AI policy in South Africa. She pointed out that some forms for the Consumer Protection Act opt-out registry request non-compliant information, which contradicts the principle of privacy by default and the proper conduct of personal information impact assessments.
Tshepo Boikanyo, InfoReg's executive for POPIA, emphasized that AI models often retain personal information beyond its intended purpose, violating POPIA principles. This raises concerns about how personal data should be handled and stored when using AI technologies.
The InfoReg was established to monitor and enforce compliance with data protection laws, ensuring responsible handling of personal information by public and private bodies. Breaching these regulations can result in severe penalties, including fines and jail sentences, depending on the severity of the violation.
Despite the challenges, InfoReg believes that POPIA does not hinder innovation. Tlakula stressed the importance of viewing data protection as integral to human rights, not just information technology (ICT). She called for a paradigm shift in how data privacy is perceived and integrated into the development of AI systems from the outset.
Mukelani Dimba, InfoReg's executive for education and communication, emphasized the need for thorough audits of AI system development and personal information processing within the South African market. Dimba stressed that there is an insufficient focus on understanding where AI systems are developed, who develops them, and how they process personal information. The regulator must be vigilant in ensuring compliance with legislation during the development phase.
Tlakula concluded that InfoReg remains committed to balancing technological progress with responsible governance, ensuring innovation is accompanied by accountability and the protection of fundamental rights.
Written by urgent.news from ITWeb's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
