The Information Regulator of South Africa (IRSA) says political parties have the responsibility to protect the personal information of voters. The Regulator says during election season and campaigning,  the processing of personal information of data subjects, who are voters in this case, is unavoidable.

Personal information of voters and the way it should be processed is protected in terms of the Protection of Personal Information Act. The implementation of the Act became effective on the 1st of July 2021.

Information Regulator Chairperson Adv Pansy Tlakula says the regulator, therefore, wants to remind all political parties that they must ensure lawful processing of personal information of voters as required by the POPI Act. She says the Regulator is mandated to ensure the protection of personal information by monitoring and ensuring compliance of responsible parties. Tlakula says political parties and independent candidates are responsible parties and must comply with the provisions of the POPI Act.

She says when processing the personal information of a voter, a political party must ensure such processing complies with the eight conditions for lawful processing of personal information as prescribed in the Act.

“Accountability: where a political party must take overall responsibility to ensure that it processes personal information lawfully. Process limitation: means that a political party may only process information that it reasonably needs and upon obtaining consent directly from a voter. Therefore, it follows that political parties may not obtain personal information from data brokers or through applications that automatically generate personal information such as telephone numbers. A voter may at any stage object to the processing of his or her personal information. If a voter objects, then a political party may no longer process that voter’s personal information. Purpose specification: means that a political party can only process the personal information of a voter for purposes directly related to the objective and purpose of that political party’s mandate. Openness: means that a voter must be notified that a political party is processing his or her personal information,” Tlakula explains.

Tlakula says it is the responsibility of the Independent Electoral Commission and political parties to safeguard the personal information of voters against loss, damage and misuse of personal information.

“In light of the security compromises on personal information that have riddled the country, the Independent Electoral Commission and the political parties have a responsibility to ensure that security safeguards are put in place and that there are adequate security measures and controls to safeguard voters’ personal information against loss, damage, and misuse. Like many laws, there are some exceptions to the applicability of POPIA. Section 26 prohibits the processing of special personal information, which includes the political persuasion of voters. However, political parties may process information concerning the political persuasion of voters in accordance with section 31 of POPIA, if that information relates to members, employees or other persons belonging to the political party, and where such processing is necessary to achieve the aims and principles of the political party.”

She says when it comes to the persuasion of voters,  political parties must still follow the law when processing personal information:

“In terms of section 31, a political party may process information related to the political persuasion of a voter for the purpose of forming a political party; participating in its activities, engaging in the recruitment of members, canvassing supporters or voters for an election or a referendum and campaigning for a political cause. However, a political party must still comply with the conditions for the lawful processing of personal information when processing information related to the political persuasion of a voter. The Regulator has conducted engagements with political parties, including participation in a Special Provincial Party Liaison Committee meeting to present the importance and need to comply with POPIA and ensure the protection of voters’ personal information during the election period.”

The Regulator says it has published guidelines on its website www.justice.gov.za/inforeg/ on the processing of personal information of a voter by a political party.

“To ensure that we protect the constitutional rights of the citizens of South Africa all political parties and candidates must uphold the law and comply with the requirements in POPIA. The Regulator continues to provide guidance and educate responsible parties in applying this law and protecting the rights of citizens,” Tlakula concluded.

Millions of eligible voters are expected to cast their ballots in the 5th democratic municipal elections on the 1st of November 2021.

POPIA | Protection of Personal Information Act comes into effect 1 July:

POPIA | Protection of Personal Information Act comes into effect 1 July Part 2: