The Protection of Personal Information Bill (POPI or PPI Bill) has been a topic of discussion in the industry for many years now. Many people have been wondering when it will become law and what its current status is.  There has understandably been a lot of interest.

we are now waiting for the new Minster of Justice to apply his mind to it

The current position is that the project committee of the South African Law Reform Commission (SALRC) submitted its report to the Minster of Justice prior to the elections and we are now waiting for the new Minster of Justice to apply his mind to it. That depends on how high or low it is on his agenda. This we do not know from our reading of articles in the press. Once this happens, the draft PPI Bill should be formally submitted for processing through Cabinet.

One of the most pressing issues is that it is unlikely that the Bill will be enacted before the 2010 Soccer World Cup when thousands of foreigners will visit South Africa – many from countries within the European Union (EU).   Member States of the EU are required to follow the EU Directive (Directive 95/46/EC) on Data Protection.  According to article 25 of the Directive:

“Member States shall provide that the transfer to a third country

[like South Africa] of personal data [personal information about visitors] which are undergoing processing or are intended for processing after transfer may take place only if, …, the third country in question ensures an adequate level of protection.”

Our comments are added in square brackets and highlighted in bold.

Without POPI, South Africa does not have an adequate level of protection and personal data cannot be transferred to South Africa. Potentially a big issue for the successful hosting of the 2010 Soccer World Cup.  Apparently, to try to provide adequate protection, SARS and the Department of Home Affairs have drawn up some amendments to their Acts as a workaround.