Protection of Personal Information Bill: An International Perspective

1. Protection of Personal Information Bill: An International Perspective

2. International origins • Information privacy not a domestic policy problem: worldwide expansion of telecommunications technology • CoE Convention and EU Data Protection Directive • OECD Guidelines • APEC, Commonwealth, United Nations • ISO and IEC privacy framework

3. Council of Europe (CoE)’s objectives • To create a common democratic and legal area throughout the whole of the continent, ensuring respect for its fundamental values: human rights, democracy and the rule of law. • Given effect iro information privacy in CoE Convention and EU Directive

4. Organisation for Economic Cooperation and Development (OECD)’s objectives * To achieve the highest sustainable economic growth and employment and a rising standard of living in member countries, while maintaining financial stability, and thus to contribute to the development of the world economy; • To contribute to sound economic expansion in member as well as non-member countries in the process of economic development; • To contribute to the expansion of world trade on a multilateral, non-discriminatory basis in accordance with international obligations • Given effect iro information privacy in OECD Guidelines

5. Member countries • COE: European countries • OECD: European countries (including some Eastern European countries), but also United States, Canada, Japan, Australia, New Zealand, Mexico, Korea.

6. Interpretation of international instruments in national legislation * Clause 1: Definitions • Consensus on internationally accepted privacy principles; implementation differs • Laws in European countries influenced by human rights perspective • Laws in countries outside Europe influenced more by economic imperatives • Developing countries (Africa): Senegal, Morocco, Benin, Burkino Faso

7. Information Protection Principles Information must be - • Obtained fairly and lawfully • Used only for the original specified purpose • Further processed in compatible fashion • Accurate and up to date • Adequate, relevant and not excessive to purpose • Processed openly • Accessible to subject • Kept secure • Destroyed after its purpose is completed • [Transferred to countries with adequate information protection only] Responsible party must ensure compliance

9. Drafting of Protection of Personal Information Bill • Principle based vs rules based legislation • Principle based means: * overarching framework, outcomes, not process * compliance with spirit of law * flexibility • Best practice approach complemented with detailed rules, codes of conduct, official guidelines

10. The Information Management Lifecycle Storage Collection Archive Use Distribution Destruction

11. Conclusion * The PPI Bill is a hybrid piece of legislation incorporating the human rights perspective while providing for economic expediencies. • It is principled based rather than rules based and the Bill together with other sector specific legislation, regulations, codes of conduct and guidelines form a unique privacy framework for SA. • It emphasises the “do the right thing” approach and promotes compliance with the spirit of the law. • Although it is possible to learn from the experiences in other jurisdictions, the Bill should primarily be interpreted with reference to the international instruments from which it originated.