Privacy & PAIA

Unless clearly inconsistent with or otherwise indicated by the context:

• 1.1 Client means a client of the Firm;
• 1.2 Constitution means the Constitution of the Republic of South Africa, No. 108 of 1996;
• 1.3 Data Subject means the person to whom Personal Information relates as defined in section 1 of POPIA;
• 1.4 Deputy Information Officer means the person designated as the deputy information officer of the Firm from time to time;
• 1.5 EEA means Employment Equity Act, No. 55 of 1998 (as amended);
• 1.6 Employee means an employee of the Firm who has access to and/or is responsible for Processing the Personal Information of Data Subjects;
• 1.7 FICA means the Financial Intelligence Centre Act, No. 38 of 2001 (as amended);
• 1.8 Firm means Stein Scop Attorneys Incorporated (registration number: 2015/306625/21), a personal liability company incorporated in accordance with the laws of the Republic;
• 1.9 GDPR means the European Union's General Data Protection Regulation 2016/679;
• 1.10 Information Officer means the person designated as the information officer of the Firm from time to time;
• 1.11 LPA means the Legal Practice Act, No. 28 of 2014 (as amended);
• 1.12 LPC means the South African Legal Practice Council established in terms of section 4 of the LPA;
• 1.13 LRA means Labour Relations Act, No. 66 of 1995 (as amended);
• 1.14 Operator means a person who Processes Personal Information for a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that party;
• 1.15 Personal Information means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to: (1.15.1) race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth; (1.15.2) education or medical, financial, criminal or employment history; (1.15.3) any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment; (1.15.4) biometric information; (1.15.5) personal opinions, views or preferences; (1.15.6) private or confidential correspondence; (1.15.7) views or opinions of another individual about the person; and (1.15.8) the name of the person if it appears with other Personal Information or if its disclosure would reveal information about the person;
• 1.16 Policy means this Policy, as amended from time to time;
• 1.17 POPIA means the Protection of Personal Information Act, No. 4 of 2013;
• 1.18 POPIA Regulations means the Regulations relating to the Protection of Personal Information promulgated in terms of section 112(2) of POPIA;
• 1.19 Processing means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including: (1.19.1) collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; (1.19.2) dissemination by means of transmission, distribution or making available in any other form; or (1.19.3) merging, linking, as well as restriction, degradation, erasure or destruction of information;
• 1.20 Regulator means the Information Regulator established in terms of section 39 of POPIA;
• 1.21 Republic means the Republic of South Africa;
• 1.22 Responsible Party means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for Processing Personal Information; and
• 1.23 Special Personal Information means Personal Information as referred to in section 26 of POPIA, concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour.

• 2.1 The Firm is a law firm of legal practitioners operating within the Republic and regulated in terms of the LPA.
• 2.2 Section 14 of the Constitution enshrines the right of privacy for every individual.
• 2.3 POPIA was enacted to give further effect to this constitutional right to privacy and, as such, the purpose of POPIA is to, amongst other things, ensure that Data Subjects' Personal Information is safeguarded when it is Processed by a Responsible Party, subject to justifiable limitations that are aimed at: (2.3.1) balancing the right to privacy against other rights, particularly the right of access to information; and (2.3.2) protecting important interests, including the free flow of information within the Republic and across international borders.

• 3.1 This Policy has been prepared in accordance with POPIA (and the POPIA Regulations) for the Firm and its purpose is to regulate the manner in which the Firm, as a Responsible Party and, in certain limited instances, as an Operator, Processes the Personal Information and Special Personal Information of Data Subjects.
• 3.2 This Policy will be updated on a regular basis and will be made available: (3.2.1) on the Firm's website; (3.2.2) at the Firm's principal place of business for public inspection during normal business hours; and (3.2.3) to the Regulator upon request.

• 4.1 This Policy will be effective from 7 June 2021 and will be reviewed on a regular basis.
• 4.2 This Policy applies to: (4.2.1) all Data Subjects whose Personal Information is Processed by the Firm; (4.2.2) to the Firm and all Employees of the Firm who are responsible for Processing the Personal Information of Data Subjects; and (4.2.3) to all Operators engaged by the Firm.

The Personal Information which the Firm Processes can be broadly divided into the following categories:

• 6.1 The Firm may be required to Process Special Personal Information and is permitted to do so in the following circumstances: (6.1.1) the Processing is carried out with the consent of a Data Subject; (6.1.2) the Processing is necessary for the establishment, exercise or defence of a right or obligation in law; (6.1.3) the Processing is necessary to comply with an obligation of international public law; (6.1.4) the Processing is for historical, statistical or research purposes where the purpose serves a public interest or asking for consent is impossible or involves a disproportionate effort and sufficient guarantees are provided; or (6.1.5) information has deliberately been made public by the Data Subject.
• 6.2 To the extent that the Firm is required to Process any Special Personal Information in any other circumstances other than those listed above, the Firm will obtain consent of Data Subjects to process the Special Personal Information. If any Employee is uncertain whether consent of the Data Subject is required, such Employee must seek guidance from the Information Officer or Deputy Information Officer.

• 7.1 The Firm does not intend to Process any Personal Information relating to children. The Firm will only Process the Personal Information of children where the Processing is: (7.1.1) carried out with the prior consent of a competent person; (7.1.2) necessary for the establishment, exercise or defence of a right or obligation in law; (7.1.3) necessary to comply with an obligation of international public law; (7.1.4) for historical, statistical or research purposes with sufficient guarantees; or (7.1.5) of Personal Information which has deliberately been made public by the child with the consent of a competent person.

• 8.1 Personal Information of a Data Subject may only be Processed if the Data Subject consents to the Processing or if one of the following justifiable circumstances apply: (8.1.1) the Processing is necessary to carry out actions for the conclusion or performance of a contract to which the Data Subject is party; (8.1.2) the Processing complies with an obligation imposed by law on the Firm; (8.1.3) the Processing protects a legitimate interest of the Data Subject; (8.1.4) the Processing is necessary for the proper performance of a public law duty by a public body; or (8.1.5) the Processing is necessary for pursuing the legitimate interests of the Firm or of a third party to whom the information is supplied.
• 8.2 Save where the Processing falls within one or more of the aforementioned justifiable circumstances, Data Subjects may withdraw the consent given to the Firm to Process Personal Information at any time in writing addressed to the Information Officer and/or Deputy Information Officer.
• 8.3 Data Subjects may object, at any time, to the Processing of Personal Information: (8.3.1) in the circumstances referred to in paragraphs 8.1.3 to 8.1.5 above, in the prescribed manner on Form 1 attached to the POPIA Regulations (Schedule 1 to this Policy); or (8.3.2) for purposes of direct marketing other than direct marketing by means of unsolicited electronic communications as referred to in section 69 of POPIA.
• 8.4 If a Data Subject has objected to the Processing of Personal Information as per paragraph 8.3 above, the Firm will no longer Process the Personal Information.

9.1 The Processing of Personal Information will be limited to lawful Processing across the eight conditions of lawful Processing in POPIA (Accountability, Processing limitation, Purpose specification, Further Processing limitation, Information quality, Openness, Security safeguards, and Data subject participation). 9.3 The purpose and justification for which Personal Information is collected by the Firm is set out below:

• 10.1 Where the Firm Processes Personal Information or Special Personal Information as an Operator (for example where the Firm acts as correspondent attorneys on behalf of another law firm), the Firm will: (10.1.1) Process such information only with the knowledge or authorisation of the Responsible Party; and (10.1.2) treat such information as confidential and not disclose it, unless required by law or in the course of the proper performance of its duties as an Operator.
• 10.2 Where the Firm acts as an Operator it is entitled to assume that the Responsible Party has complied with POPIA in obtaining and Processing the Personal Information or Special Personal Information.

• 11.1 Employees of the Firm who have access to Personal Information are required to process it only with consent or under justifiable circumstances, use it only for the purpose obtained, maintain security and confidentiality, notify the Information Officer immediately of any suspected unauthorised access, and not retain it longer than necessary.
• 11.2 Third party vendors or Operators processing data on behalf of the Firm are required to treat Personal Information as confidential, maintain adequate security measures, and notify the Firm immediately of any suspected unauthorised access.
• 11.3 Where Personal Information is transferred outside of South Africa, the recipient must be subject to a law, binding corporate rules, or binding agreement providing an adequate level of protection substantially similar to POPIA.
• 11.4 Only the following parties will have access to the Personal Information: (11.4.1) the Firm's authorised directors, shareholders and Employees; (11.4.2) third party vendors or Operators (accountants and auditors, correspondents, suppliers, financial institutions, counsel); (11.4.3) regulatory authorities (including SARS, LPC, CIPC, FIC, Director-General of Labour Department and Department of Health); and (11.4.4) Clients' nominated recipients.

• 12.1 A Data Subject has the right to have their Personal Information processed in accordance with the conditions for lawful Processing, including the right: (12.1.1) to be notified when Personal Information is collected (s18) or accessed by an unauthorised person (s22); (12.1.2) to establish whether the Firm holds Personal Information and to request access (s23); (12.1.3) to request correction, destruction or deletion of Personal Information on Form 2 (Schedule 2 to this Policy) in terms of section 24; (12.1.4) to object on reasonable grounds in terms of section 11(3)(a); (12.1.5–12.1.6) to object to processing for direct marketing (s11(3)(b) and s69); (12.1.7) not to be subject to automated profiling decisions (s71); (12.1.8) to submit a complaint to the Regulator (s74); and (12.1.9) to institute civil proceedings (s99).

• 13. Right to Rectify: Data Subjects have the right to access and rectify Personal Information provided to the Firm and undertake to report changes to keep data accurate.
• 14. Retention: Records of Personal Information will not be retained any longer than necessary for achieving the purpose for which it was collected unless required or authorised by law, reasonably required for lawful functions or activities, required by contract, or consented to by the Data Subject.
• 15. Duties of Information Officer & Deputy Information Officer: Responsible for ensuring compliance with POPIA, working with the Regulator, and dealing with requests from Data Subjects.
• 16. Security Safeguards: The Firm limits the number of persons who have access to Personal Information, maintains security on internal servers and physical files, notifies the Regulator and Data Subject in writing if unauthorised access occurs, and ensures third-party Operators maintain adequate security measures.

• 17. Consequences of Failure to Provide Personal Information: Where Personal Information is mandatory to comply with statutory obligations, failure to provide it or furnish consent will render the Firm unable to carry out the client mandate.
• 18. Complaints Procedure: Data Subjects may address complaints in writing to the Information Officer or Deputy Information Officer within five (5) working days of the occurrence. The Information Officer will endeavour to resolve the complaint within five (5) working days. Data Subjects may also lodge a complaint directly with the Information Regulator using Part I of Form 5 (Schedule 3 to this Policy) at: General enquiries: inforeg@justice.gov.za | Complaints: complaints.IR@justice.gov.za | Tel: 010 023 5207 | Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 (P.O. Box 31533, Braamfontein, 2017).
• 19. GDPR: To the extent applicable where the Firm processes data of European Union citizens or residents, the Firm will ensure compliance with the provisions of the GDPR (EU 2016/679).

• Information Officer: Amelia Berman — amelia@steinscop.com
• Deputy Information Officer: Vanessa da Costa Palmer — vanessa@steinscop.com
• Postal Address: Postnet Suite 274, Private Bag X1, Melrose Arch, 2076
• Physical Address: Capital Hill, 6 Benmore Road, Morningside, Sandton, 2057
• Telephone Number: +27(0)11 380 8080 | Email Address: info@steinscop.com | Website: www.steinscop.com

Schedules included in the downloadable POPIA Policy PDF: Schedule 1 (Form 1 — Objection to the Processing of Personal Information in terms of Section 11(3)), Schedule 2 (Form 2 — Request for Correction or Deletion of Personal Information in terms of Section 24(1)), and Schedule 3 (Part I of Form 5 — Complaint Regarding Interference with the Protection of Personal Information in terms of Section 74).