In PART 1 we briefly referred to the use of employee information by an employer and when it would be a breach of employee privacy in terms of the Protection of Personal Information (POPI) Act No. 4 of 2003.
The purpose of this article (PART 2) is to elaborate and focus, in more detail, on employer responsibilities regarding employee information. However, employers must first understand what is meant with ‘information’ or ’employee information’.
WHAT EMPLOYMENT RELATED INFORMATION IS PROTECTED IN TERMS OF POPI?
What information is covered?
POPI covers all information that employers might collect, retain or archive on any individual who might wish to work, work, or have worked for the employer. This includes both personal and special personal information.
What is ‘personal information’?
What is ‘personal information’?
Personal information is information which is about a living identifiable person (a ‘data subject’) and affects that person’s privacy (whether in his/her personal or family life, business or professional capacity) in the sense that the information has the person as its focus or is otherwise biographical in nature and identifies a person, whether by itself, or together with other information in the employer’s possession or that is likely to come into its possession.
Personal information likely to be covered by POPI may include details of an employee’s salary and bank account, e-mails about an incident, a supervisor’s notebook, an individual employee’s personnel file, leave records, performance reviews, a set of leave cards depending upon how they are kept and a set of completed application forms filed in a particular order.
What is ‘special information’?
What is ‘special information’?
Special personal information is information concerning an individual’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information, the criminal behaviour of a person subject to the extent that such information relates to the alleged commission by the employee of any offence or any proceedings in respect of any offence allegedly committed by an employee or about the disposal of such proceedings.
Special personal information processed by an employer might typically be about an employee’s physical or mental health as a part of medical records, records obtained as part of a pre-employment medical questionnaire or examination, various drug or alcohol test results, pre-employment screening records relating to criminal convictions and any aspect of special personal information.
Special personal information processed by an employer might typically be about an employee’s physical or mental health as a part of medical records, records obtained as part of a pre-employment medical questionnaire or examination, various drug or alcohol test results, pre-employment screening records relating to criminal convictions and any aspect of special personal information.
‘Data subjects’: who are they within an employment context?
POPI refers to the persons to whom personal information relates, as “data subjects”. Within an employment context, this includes applicants and former applicants (successful or unsuccessful), former or current employees, Temporary Employment Services staff, casual staff, staff on secondment and those on work experience placements. The personal information of all of these people must be dealt with in accordance with POPI.
What manifestations of information are covered by POPI?
POPI applies to any personal information entered into any record by an employer. A record includes any writing on any material, labels, books, maps, plans, graphs, drawings and photographs, films, negatives, tapes or other devices where visual images are stored.
Personal information about individuals that is kept by an employer on a computerised system in the employment context will fall within the scope of the POPI subject to some exceptions.
In our next article, PART 3, we shall discuss what does ‘processing’ or ‘further processing’ of information mean and when will it be lawful to process information.
Personal information about individuals that is kept by an employer on a computerised system in the employment context will fall within the scope of the POPI subject to some exceptions.
In our next article, PART 3, we shall discuss what does ‘processing’ or ‘further processing’ of information mean and when will it be lawful to process information.
