The scope of application of PAIA is triggered when the conduct of a body (public or private) affects the rights of South Africans. Specifically, a body must comply with PAIA when a person may require access to the records it holds to exercise or protect their rights. This also applies to foreign-domiciled private bodies.
A private body under PAIA includes any juristic person, whether existing or former.
A private body (like a company) holds information for PAIA purposes if it controls the information, decides how and why it is used, or can access, retrieve, or disclose it, even if the private body stores the information offshore. PAIA applies to all South African public bodies (like the government) and private bodies incorporated or domiciled in South Africa. There is no doubt about this, since these bodies fall under the direct territorial jurisdiction of the South African Courts.
The right of access to information in South Africa applies to both public and private bodies. This broad scope of application sets South Africa apart from most jurisdictions, where this right only applies to public bodies.
Foreign-domiciled private bodies, on the other hand, may question whether the absence of incorporation, establishment, or physical operations in South Africa means they need not comply with PAIA. The answer is no, PAIA does not apply merely because a private body is domiciled in South Africa. PAIA applies if the body’s conduct may impact the rights of South Africans.
The right of access to information is guaranteed in section 32 of the Constitution
The Constitution is supreme and all-encompassing, binding natural and juristic persons. It guarantees every person the right to access information held by another when that information is required to exercise or protect any right. Legislation giving effect to constitutional rights must be interpreted to promote access rather than limit it. This is why the right of access to information is broad. It encompasses all information, not just personal information, and is guaranteed to all persons, including natural and juristic persons.
In a competition law case, the Court held that if a company alleges to have a record in its possession, it cannot refuse to produce it when requested, even if it is a foreign-domiciled entity — Unilever SA (Pty) Ltd v Polagric (Pty) Ltd 2001 (2) SA 329 (C) p24.
One of the reasons the right of access to information is so broad is that it is grounded in the need for transparency that arose from the secrecy of pre-democratic South Africa. This means the right of access to information is a right that courts will readily uphold.
Application of the Constitution to foreign-domiciled private bodies
The Constitution applies to foreign-domiciled organisations where there is a jurisdictional link between their conduct (providing digital services) and the consequences (affecting the exercise or protection of a right). Given the right and the nature of the duty it imposes, a wide interpretation of that right must be adopted to promote the spirit and purpose of the Bill of Rights. So in some instances, the Constitution may apply to you. The SCA confirmed that South African law may apply to foreign entities where there is a sufficient jurisdictional link between the conduct and the consequences in South Africa.
PAIA gives effect to the constitutional right of access to information
PAIA operationalises the right of access to information and applies to any former or existing juristic person. Among other things, PAIA sets out how requesters can exercise their right of access to information. This means private bodies have a responsibility to put in place mechanisms to provide access to the records they hold.
PAIA does not apply merely because a private body is domiciled in South Africa. PAIA applies if a private body’s conduct affects the exercise or protection of a right of a person in South Africa.
When must foreign-domiciled private bodies comply with PAIA?
PAIA does not require a private body to be registered or incorporated in South Africa to apply. So, regardless of where you are domiciled or established, PAIA may apply to you. From a practical perspective, let’s look at three different buckets.
It’s worth noting that PAIA will not apply to you if you do not hold the records requested.
No effects in South Africa
A foreign entity whose conduct has no effect in South Africa need not comply with PAIA. For example, a pizza restaurant in New York. They are not domiciled or registered in South Africa. Their conduct is making and selling pizza. Their business has no impact on South Africans in South Africa. There is no connection to South Africa. The owner of the pizza restaurant does not know where South Africa is on a map. The pizza restaurant does not affect the rights of South Africans.
Direct and substantial effects in South Africa
A foreign entity whose conduct has effects in South Africa has to comply with PAIA. Let’s look at some examples.
- A multinational tech company registered in the EU that provides digital services to South Africans in South Africa and charges a fee.
- A social media company registered in Ireland that offers services to South Africans at no cost.
- A company registered in Mauritius providing goods or services to South Africans.
- A US company that monitors the behaviour of South Africans in South Africa.
- An oil drilling company with operations just outside of South African waters, but whose operations could have an environmental impact on South Africa.
Some possible effects in South Africa
What happens if it is not clear whether a private body’s conduct has direct, substantial, and reasonably foreseeable effects in South Africa? This is the tricky scenario. Know whether your organisation must comply by contacting Michalsons for an opinion.
You cannot afford to ignore PAIA
Geographic distance does not place you beyond PAIA’s reach. The Information Regulator has multiple enforcement channels at its disposal, and it is increasingly willing to use them. Most recently, the Information Regulator has been laying criminal charges against non-compliant entities, specifically against the information officer of those companies. The head of the company is, by default, the information officer under PAIA. The implications of that should not be underestimated: no executive, no board member, and no company wants an outstanding criminal charge or warrant in any jurisdiction. So, before you overlook PAIA, think about how the reputational and legal cost of non-compliance dwarfs whatever inconvenience compliance might require.
Actions you can take
If PAIA applies to you, you should comply with its requirements.
- Have a representative in South Africa by authorising a ZA IO representative.
- Comply with the requirement to register by registering with the Information Regulator.
- Comply with the requirement by drafting a PAIA manual.
- Receive requests and decide how to respond to them (whether to grant or refuse them) by joining the Michalsons Access to Information Programme.
Some scenarios of when PAIA applies are obvious, but even where they are not, PAIA may apply to you. You probably should comply. Contact us, and find out what you should do.
