South Africa: POPIA: The Mandatory Suspension Of Processing For Credit Reporting: A Credit Crisis In The Making?

The Information Regulator has published a Guidance Note on Application for Prior Authorisation, in order to guide responsible parties who are currently or intend to process personal information that is subject to prior authorisation.

Section 57 of the Protection of Personal Information Act, 2013 ("POPIA") requires that prior authorisation be obtained if a responsible party plans to process information for the purposes of credit reporting. To this end, the Guidance Note provides that any credit bureaus registered with the National Credit Regulator or any person processing personal information for credit reporting purposes may apply for prior authorisation.

Unless a Code of Conduct applies to a responsible party, the responsible party must submit its application to the Information Regulator prior to processing or any further processing.

The method for obtaining prior authorisation is set out in section 58 of POPIA, which provides that the relevant information processing must be notified by the responsible party to the Regulator.

Responsible parties may not carry out information processing that has been notified to the Regulator until the Regulator has completed its investigation or until they have received notice that a more detailed investigation will not be conducted. Responsible parties can however assume a decision in their favour if no response in received from the Regulator within the prescribed time frames.

Under section 114(3), this provision does not apply to processing that takes place on the date of commencement of POPIA, until the Regulator determines otherwise by notice in Gazette. It seems as if the Regulator may intend for this provision to commence on 1 July 2021. If that is the case, all processing of personal information for credit reporting purposes by credit bureaus, credit providers and the like will have to stop for around four weeks (and possibly up to 13 weeks in case the Regulator decides to conduct a more detailed investigation). To our minds, this may cause havoc in the credit market.

In terms of section 59 of POPIA, failure to obtain prior authorisation is an offence and upon conviction may lead to a fine or to imprisonment for a period not exceeding 12 months, or to both a fine and imprisonment.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.