The operator register: the POPIA gap that is never the clause

Almost every organisation has operators it has never identified - the payroll bureau, the cloud host, the shredding company. The section 21 agreement is the easy half.

Ask an organisation how it manages POPIA with its service providers and you will usually be shown a contract. Often it is a perfectly good one. Somebody found or commissioned a data processing agreement, the supplier signed it, and it has been in a folder ever since.

Ask the next question, which is who all the operators are, and the conversation slows down. In our experience that second question is where the real exposure sits.

Who counts as an operator

POPIA defines an operator as a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party. The definition of processing is just as wide. It starts with collection, receipt and storage and it ends with erasure or destruction.

Read the two definitions together and the list gets long quickly. The payroll bureau is an operator. So is the company that hosts your email and files, the IT support firm with remote access to the server, the off-site records store, the outsourced call centre and the agency that sends the newsletter. The shredding company that empties the paper bins is an operator too, because destroying a record is processing it.

Not every supplier belongs on the list. A responsible party is the body that determines the purpose of and means for processing, so a supplier that decides for itself why and how it uses the information is a responsible party in its own right and not your operator. Working out which is which, supplier by supplier, is part of the exercise.

What the Act asks for

Three provisions do the work.

Section 20 says an operator must process personal information only with the knowledge or authorisation of the responsible party, and must treat it as confidential.

Section 21(1) says the responsible party must, in terms of a written contract, ensure that the operator establishes and maintains the security measures referred to in section 19.

Section 21(2) says the operator must notify the responsible party immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

Notice where the duty in section 21(1) lies. It is on the responsible party, not the supplier. If there is no written contract, the party in breach is you.

Why the register comes before the contract

A contract can only be signed with a supplier somebody has thought of. That sounds too obvious to say, yet it is the commonest gap we see: three careful agreements with the three largest suppliers, and nothing at all with the fifteen smaller ones that also hold information about staff, clients or members.

The register matters for reasons that go beyond section 21.

1. Security. Section 19(2) requires a responsible party to identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control, to put safeguards in place and to verify regularly that they work. Information sitting with a supplier is still under your control. You cannot verify a safeguard at a supplier you have not listed.
2. Breach notification. Under section 22 the responsible party must notify the Regulator and the affected data subjects as soon as reasonably possible after discovering a compromise. When the compromise happens at a supplier, your clock depends on how quickly you hear about it, and on knowing whom to phone.
3. Liability. Section 99 allows a data subject, or the Regulator at the data subject’s request, to bring a civil action for damages against the responsible party, whether or not there was intent or negligence. The section lists the defences available. That a supplier was at fault is not one of them.
4. Your PAIA manual. Section 51(1)(c) of PAIA requires the manual of a private body to set out the recipients or categories of recipients to whom personal information may be supplied, and any planned transborder flows. That part of the manual cannot be written accurately without knowing who the operators are and where they keep the information.

Building it

Start with the creditors’ ledger and not the contracts folder. Take every supplier paid in the last twelve months and ask one question of each: does this supplier see, store or handle information about identifiable people on our behalf? Then ask whoever looks after IT for a list of every system staff log in to, because free and low-cost tools never reach the ledger.

For each operator the register needs one line recording:

• who the operator is and what it does for you;
• what personal information it handles, and about whom;
• where the information is held, including the country;
• whether there is a written contract, its date, and whether it carries the section 21 terms;
• whether the operator passes the information on to anyone else;
• the person to contact if something goes wrong;
• what happens to the information when the relationship ends;
• who inside your organisation owns the relationship, and when it was last checked.

For a small organisation this is an afternoon’s work. For a larger one it is a few weeks of asking, and it tends to turn up at least one supplier nobody remembers appointing.

Then the clause

Once the register exists, the agreement is the easy half. It needs the section 20 and 21 terms, sensible provisions on sub-contractors, return or deletion at the end, and help with requests from data subjects.

One drafting point is worth watching. Supplier paper often promises notice of a breach “without undue delay”. The Act says “immediately”. Hold to the Act’s word.

Where we come in

This article is general commentary and is not legal advice. MBM Valkyrie Advisory (Pty) Ltd is a consultancy and not a law firm.