Who must compile a Manual?

• Natural Persons and Partnerships
• Juristic Persons

Does the PAIA exempt any person?

• Natural Persons and Partnerships
• Juristic Persons

What information must the Manual contain?

• Details of the private body
• Disclosures required by PAIA
  • What is a "record"?
  • Records of the body which are available in accordance with any other legislation
• Disclosures required by the Protection of Personal Information Act, 2013 (POPIA)
  • What does "processing" mean?
  • Completing the online form for records
  • No obligation to create or retain records
• Other

Who is the head of a private body?

Who may request access to this information?

• Requester
• The exercise or protection of any rights

Grounds For Refusal Of Access To Records

• Mandatory protection of privacy of third party who is natural person
• Mandatory protection of commercial information of third party
• Mandatory protection of certain confidential information of third party
• Mandatory protection of safety of individuals, and protection of property
• Mandatory protection of records privileged from production in legal proceedings
• Commercial information of private body
• Mandatory protection of research information of third party, and protection of research information of private body
• Mandatory disclosure in public interest

Protection of Personal Information Act, 2013 (POPIA)

Are there any other legal obligations that must be met?

What are the penalties for non-compliance?

What is the real purpose of this piece of legislation?

The facilities at www.accesstoinfo.co.za have been designed to provide support and assistance to private bodies.

The website does not cater for public bodies.

A public body includes any department of state or administration in the national or provincial sphere of government or any municipality in the local sphere of government or any other functionary or institution when exercising a power or performing a duty in terms of the Constitution or a provincial constitution or exercising a public power or performing a public function in terms of any legislation.

 

WHO MUST COMPILE A MANUAL?

Section 51 of the Promotion of Access to Information Act, 2 of 2000 makes it compulsory for the head of every private body to compile a manual and to make the manual available on the web site, if any, of the private body and at the principal place of business of the private body for public inspection during normal business hours; [S 51 (3)]

A “private body” is defined and means:

 (a)       a natural person who carries or has carried on any trade, business or profession, but only in such capacity;

(b)        a partnership which carries or has carried on any trade, business or profession;

or

(c)        any former or existing juristic person

Natural Persons and Partnerships

The question for natural persons and partnerships is thus: Are you carrying on any trade business or profession?

In most cases the question is easily answered but in more unusual circumstances it needs to be analysed more carefully. When in doubt, consider the following definitions of the words as contained in the English Oxford Dictionary:

Trade (noun)

• The action of buying and selling goods and services
• Job requiring manual skills and special training: (he’s a carpenter by trade)
• The trade [treated as singular or plural] the people engaged in a particular area of business

Business (noun)

• A person’s regular occupation, profession, or trade

Profession (noun)

• Paid occupation, especially one that involves prolonged training and a formal qualification

Juristic Persons

The following entities are recognised as juristic persons:

• Associations incorporated in terms of a general enabling enactment such as companies, close corporations, banks, co-operatives and trusts[1];
• Associations or institutions especially created and recognised as juristic persons in separate legislation, for instance universities, and public corporations such as the South African Broadcasting Corporation; and
• Associations that comply with the common law requirements for the recognition of juristic personality, such as political parties and trade unions and in certain circumstances, churches.

A church will be considered to be a juristic person if that particular church, or the congregation of the church, has been entrusted with legal personality and, as a distinct entity:

• has rights and obligations and can, for instance, own property; and
• has the capacity to enter into legal transactions and to sue and be sued in its own name.

DOES THE PAIA EXEMPT ANY PERSON?

Natural Persons and Partnerships

There are no exemptions granted to any natural person or partnership from the requirements to compile and file a manual.

This means that no matter how small a business, trade or profession concerned and irrespective of turnover or number of employees, both are obliged to compile and file a manual.

Juristic Persons

There are no exemptions granted to any juristic person from the requirements to compile and file a manual.

This means that no matter how small a business, trade or profession being conducted by the close corporation or company concerned and irrespective of turnover or number of employees, every juristic person is obliged to compile and file a manual.

Having regard to the wording of the definition of a private body, even former companies and close corporations must comply – and that goes for dormant organisations too.

WHAT INFORMATION MUST THE MANUAL CONTAIN?

In terms of S 51(1) as amended by POPIA, the manual must contain:

Details of the private body

The manual must contain at least the postal and street address, phone and fax number and, if available, electronic mail address of the head of the body. In the manual compiled by the AccessToInfo system, the only additional information required is the registration number of any juristic person. This is not a requirement of the Act.

Disclosures required by PAIA

The manual must contain a description of the records of the body which are available in accordance with any other legislation with sufficient detail to facilitate a request for access to a record of the body, a description of the subjects on which the body holds records and the categories of records held on each subject.

Despite the title of the Act, it does not control the access to information – it controls the access to “records”.

WHAT IS A “RECORD”?

S 3 provides that the Act applies to a record of a private body regardless of when the record came into existence.

S 1 defines a record as any recorded information regardless of form or medium that is in the possession or under the control of that private body, and whether or not it was created by that private body.

Basically, any information recorded in any form by employees of a private body in the course of their duties would be included: documents of any form, notes on notepads, handwritten rough notes, computer files, tape or videotape recordings, e-mail messages and the like.

RECORDS OF THE BODY WHICH ARE AVAILABLE IN ACCORDANCE WITH ANY OTHER LEGISLATION

A private body is required to list the records in its possession or under its control that have been established in terms of any relevant legislation. These are normal records of the business created and maintained as part of its everyday operations.

Disclosures required by the Protection of Personal Information Act, 2013 (POPIA)

The manual must contain details of the purpose in respect of which personal information in its possession is processed.

WHAT DOES “PROCESSING” MEAN?

POPIA defines the term 'processing' which means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including-

(a)        the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;

(b)        dissemination by means of transmission, distribution or making available in any other form; or

(c)        merging, linking, as well as restriction, degradation, erasure or destruction of information;

The manual must contain a description of the categories of data subjects and of the information or categories of information relating thereto and details of the recipients or categories of recipients to whom the personal information may be supplied.

The manual must contain details, if any, of planned transborder flows of personal information and, importantly, a general description allowing a preliminary assessment of the suitability of the information security measures to be implemented by the responsible party to ensure the confidentiality, integrity and availability of the information which is to be processed.

COMPLETING THE ONLINE FORM

The list of business records and the list of all standard responses to the required  POPIA details is provided in the online form on the AccessToInfo website reflects an attempt to include a comprehensive list of the kinds of records normally held by most private bodies in South Africa. It does not mean that every private body must (or should) have records in every category listed. For example, an individual who carries on the business of a wedding photographer may only keep Correspondence and Banking Records  

NO OBLIGATION TO CREATE OR RETAIN RECORDS

The Act does not impose obligations on a private body to compile records of any kind. The Act simply requires private bodies to compile a manual that contains an index of all records under its control or in its possession.

The Act does not impose any obligations on private bodies to create or retain records. If a record has been destroyed or lost at the time of a request for access or if it was never created, there is no record in the possession or under the control of the body to disclose.

Other

• The manual must contain a description of the guide referred to in section 10, if available, and how to obtain access to it. This information is included in every manual compiled by the AccessToInfo system for each client.
• The manual must contain the latest notice in terms of S 52(2), if any, regarding the categories of record of the body which are available without a person having to request access in terms of this Act. To date no notice has been issued in terms of S 52(2) and so this does not apply.

WHO IS THE HEAD OF A PRIVATE BODY?

S 1 of the Act (Definitions) provides as follows:

“head” of, or in relation to, a private body means—

(a)        in the case of a natural person, that natural person or any person duly authorised by that natural person;

(b)        in the case of a partnership, any partner of the partnership or any person duly authorised by the partnership;

(c)        in the case of a juristic person—

(i)         the chief executive officer or equivalent officer of the juristic person or any person duly authorised by that officer; or

(ii)        the person who is acting as such or any person duly authorised by such acting person

WHO MAY REQUEST ACCESS TO THIS INFORMATION?

The PAIA gives effect to s 32(1)(b) of the Constitution of South Africa by creating a right to request records held by private bodies. This right exists only to the extent that the record is required for the exercise and protection of rights. The Act places a duty on private bodies to disclose the record unless refusal of the request is permitted or mandated by one or more of a list of grounds.

Requester

S 50 (Right of access to records of private bodies) provides that a requester must be given access to any record of a private body if: 

• that record is required for the exercise or protection of any rights; and
• that person complies with the procedural requirements in this Act relating to a request for access to that record; and
• access to that record is not refused in terms of any ground for refusal as contemplated in the Act.

Essentially, a request for a record held by a private body can be made by any 'person', which obviously includes juristic persons. There is no residence, citizenship or jurisdictional qualification. A person can make a request in their own name or acting on behalf of someone else.

A public body is also entitled to request access to a record of a private body on condition that such request is to protect a right such public body has against the private body or is in the public interest.

The exercise or protection of any rights

The purpose of S 50 is to require private body transparency in order to prevent harm to fundamental rights associated with a human rights culture.

Such rights are those included in the South African Bill of Rights and rights in general law that can be regarded as deriving from the rights in the Bill of Rights. This would include such rights as are included in the law of delict.

The law of delict forms a part of private law and more particularly the law of obligations. Delict is one of the primary sources of obligations. In terms of an obligation caused by a delictual action, the wrongdoer has a personal duty to compensate the victim for the harm done and, vice versa, the victim has a personal right to claim reparation of harm done from the wrongdoer.

Rights enshrined in the SA Constitution – Bill of Rights

• Equality
• Human Dignity
• Life
• Freedom and Security of the Person
• Slavery, Servitude and Forced Labour
• Privacy
• Freedom of Religion, Belief and Opinion
• Freedom of Expression
• Assembly, Demonstration, Picket and Petition
• Freedom of Association
• Political Rights
• Citizenship
• Freedom of Movement and Residence
• Freedom of Trade, Occupation and Profession
• Labour Relations
• Environment
• Property
• Housing
• Health Care, Food Water and Social Security
• Children
• Education
• Language and Culture
• Cultural, Religious and Linguistic Communities
• Access to Information
• Just Administrative Action
• Access to Courts
• Arrested, Detained and Accused Persons

GROUNDS FOR REFUSAL OF ACCESS TO RECORDS

Mandatory protection of privacy of third party who is natural person

The head of a private body must refuse a request for access to a record of the body if its disclosure would involve the unreasonable disclosure of personal information about a third party (being any natural person other than the requester), including a deceased individual.

However, a record may not be refused if:

• it consists of information about an individual who has consented in writing to its disclosure to the requester concerned;
• it is already publicly available;
• the record was given to the private body by the individual to whom it relates and the individual was informed by or on behalf of the private body, before it is given, that the information belongs to a class of information that would or might be made available to the public;
• the request is for a record about an individual's physical or mental health, or well-being, who is under the care of the requester and who is under the age of 18 years or is incapable of understanding the nature of the request, and if giving access would be in the individual's best interests;
• it is about an individual who is deceased and the requester is the individual's next of kin or is making the request with the written consent of the individual's next of kin;
• is  about an individual who is or was an official of a private body and which relates to the position or functions of the individual, including, but not limited to the fact that the individual is or was an official of that private body, the title, work address, work phone number and other similar particulars of the individual, the classification, salary scale or remuneration and responsibilities of the position held or services performed by the individual and the name of the individual on a record prepared by the individual in the course of employment.

Mandatory protection of commercial information of third party

The head of a private body must refuse a request for access to a record of the body if the record contains:

• trade secrets of a third party;
• financial, commercial, scientific or technical information, other than trade secrets, of a third party, the disclosure of which would be likely to cause harm to the commercial or financial interests of that third party; or
• information supplied in confidence by a third party, the disclosure of which could reasonably be expected to put that third party at a disadvantage in contractual or other negotiations or to prejudice that third party in commercial competition.

A record may not be refused insofar as it consists of information about-

• a third party who has consented in writing to its disclosure to the requester concerned;
• the results of any product or environmental testing or other investigation supplied by a third party or the results of any such testing or investigation carried out by or on behalf of a third party and its disclosure would reveal a serious public safety or environmental risk.

Note:   “third party”, in relation to a request for access to a record of a private body, means any person (including, but not limited to, a public body) other than the requester.

Mandatory protection of certain confidential information of third party

The head of a private body must refuse a request for access to a record of the body if its disclosure would constitute an action for breach of a duty of confidence owed to a third party in terms of an agreement.

Mandatory protection of safety of individuals, and protection of property

The head of a private body must refuse a request for access to a record of the body if its disclosure could reasonably be expected to endanger the life or physical safety of an individual; or

The head of a private body may refuse a request for access to a record of the body if its disclosure would be likely to prejudice or impair the security of a building, structure or system, including, but not limited to, a computer or communication system, a means of transport or any other property;

The head of a private body may refuse a request for access to a record of the body if its disclosure would be likely to prejudice or impair methods, systems, plans or procedures for the protection of an individual in accordance with a witness protection scheme, the safety of the public, or any part of the public or the security of property.

Mandatory protection of records privileged from production in legal proceedings

The head of a private body must refuse a request for access to a record of the body if the record is privileged from production in legal proceedings unless the person entitled to the privilege has waived the privilege.

Commercial information of private body

The head of a private body may refuse a request for access to a record of the body if the record:

• Contains trade secrets of the private body,
• Contains financial, commercial, scientific or technical information, other than trade secrets, of the private body, the disclosure of which would be likely to cause harm to the commercial or financial interests of the body;
• Contains information, the disclosure of which could reasonably be expected to put the private body at a disadvantage in contractual or other negotiations or to prejudice the body in commercial competition;
• Is a computer program, as defined in section 1 (1) of the Copyright Act, 1978 (Act No. 98 of 1978), owned by the private body, except insofar as it is required to give access to a record to which access is granted in terms of this Act.

Mandatory protection of research information of third party, and protection of research information of private body

The head of a private body must refuse a request for access to a record of the body if the record contains information about research being or to be carried out by or on behalf of a third party, the disclosure of which would be likely to expose the third party, a person that is or will be carrying out the research on behalf of the third party or     the subject matter of the research to serious disadvantage.

The head of a private body may refuse a request for access to a record of the body if the record contains information about research being or to be carried out by or on behalf of the private body, the disclosure of which would be likely to expose the private body, a person that is or will be carrying out the research on behalf of the private body or the subject matter of the research to serious disadvantage.

Mandatory disclosure in public interest

The head of a private body must grant a request for access to a record of the body if the disclosure of the record would reveal evidence of a substantial contravention of, or failure to comply with, the law or evidence of imminent and serious public safety or environmental risk and the public interest in the disclosure of the record clearly outweighs the harm contemplated in the provision in question.

 

PROTECTION OF PERSONAL INFORMATION ACT, 2013 (POPIA)

S 51(c) has been extensively amended by S 110 of POPIA read with paragraph 12(a) of the Schedule to the Act and commences on 30 June, 2021.

The following definitions found in PAIA and in POPIA are important:

'biometrics' means a technique of personal identification that is based on physical, physiological or behavioural characterisation including blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition;

'data subject' means the person to whom personal information relates;

'personal information' means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to-

(a)        information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;

(b)        information relating to the education or the medical, financial, criminal or employment history of the person;

(c)        any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;

(d)        the biometric information of the person;

(e)        the personal opinions, views or preferences of the person;

(f)        correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;

(g)        the views or opinions of another individual about the person; and

(h)        the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person;

'processing' means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including-

(a)        the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;

(b)        dissemination by means of transmission, distribution or making available in any other form; or

(c)        merging, linking, as well as restriction, degradation, erasure or destruction of information;

S 51(c) now provides that the manual must include details of the following:

(i)         the purpose of the processing of personal information;

(ii)        a description of the categories of data subjects and of the information or categories of information relating thereto;

(iii)       the recipients or categories of recipients to whom the personal information may be supplied;

(iv)       planned transborder flows of personal information; and

(v)        a general description allowing a preliminary assessment of the suitability of the information security measures to be implemented by the responsible party to ensure the confidentiality, integrity and availability of the information which is to be processed.

 The list of possible purposes of the processing of personal information, categories of data subjects and recipient categories that have provided in the online form on the AccessToInfo website reflects an attempt to include a comprehensive list of the information normally held by most private bodies in South Africa. It does not mean that every private body must (or should) have records in every category listed.

Select only those categories that apply to your business. If any category applicable to your business is not listed, please include details in the space marked “other”.

ARE THERE ANY OTHER LEGAL OBLIGATIONS THAT MUST BE MET?

The manual must be updated on a regular basis and must be made available-

(a)        on the web site, if any, of the private body;

(b)        at the principal place of business of the private body for public inspection during normal business hours;

(c)        to any person upon request and upon the payment of a reasonable amount; and

(d)        to the Information Regulator upon request.

NOTE:  It is no longer a requirement that a copy of the manual be delivered to the South African Human Rights Commission. PAIA now falls under the jurisdiction of the Information Regulator established in terms of POPIA.

WHAT ARE THE PENALTIES FOR NON-COMPLIANCE?

In terms of S 90 (3) a head of a private body who wilfully or in a grossly negligent manner fails to compile a manual, update a manual or fails to make the manual available as prescribed, commits an offence and is liable on conviction to a fine, or to imprisonment for a period not exceeding two years.

The important words in this provision are “wilfully” and “grossly negligent”. These terms are subject to legal interpretation and, in a court of law, usually require a great deal to prove their presence.

In addition any person who with intent to deny a right of access in terms of this Act destroys damages or alters a record, conceals a record or falsifies a record or makes a false record, commits an offence and is liable on conviction to a fine or to imprisonment for a period not exceeding two years.

WHAT IS THE REAL PURPOSE OF THIS PIECE OF LEGISLATION?

S 9 of the Act (Objects of Act) provides as follows:

            The objects of this Act are ‑

(a)        to give effect to the constitutional right of access to –

(i)         any information held by the State; and

(ii)        any information that is held by another person and that is required for the exercise or protection of any rights;

(b)        to give effect to that right ‑

(i)         subject to justifiable limitations, including, but not limited to, limitations aimed at the reasonable protection of privacy, commercial confidentiality and effective, efficient and good governance; and

(ii)        in a manner which balances that right with any other rights, includ­ing the rights in the Bill of Rights in Chapter 2 of the Constitution;

(c)        to give effect to the constitutional obligations of the State of promoting a human rights culture and social justice, by including public bodies in the definition of 'requester', allowing them, amongst others, to access information from private bodies upon compliance with the four require­ments in this Act, including an additional obligation for certain public bodies in certain instances to act in the public interest;

(d)        to establish voluntary and mandatory mechanisms or procedures to give effect to that right in a manner which enables persons to obtain access to records of public and private bodies as swiftly, inexpensively and effort­lessly as reasonably possible; and

(e)        generally, to promote transparency, accountability and effective govern­ance of all public and private bodies by, including, but not limited to, empowering and educating everyone ‑

(i)         to understand their rights in terms of this Act in order to exercise their rights in relation to public and private bodies;

(ii)        to understand the functions and operation of public bodies; and

(iii)       to effectively scrutinise, and participate in, decision‑making by public bodies that affects their rights.

Caveat and Disclaimer

This Frequently Asked Questions Guide (FAQ) does not constitute a legal opinion and is offered solely as a comment and general guide. When in doubt, all persons are best served by consulting an appropriately qualified professional advisor.

This Frequently Asked Questions Guide (FAQ) is copyright under the Berne Convention. In terms of the Copyright Act 98 of 1978, no part of this FAQ may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording or by information storage and retrieval system, without permission in writing from Webtech Solutions CC.

Although every care has been taken in the compilation of the material contained in this work (which includes the verbatim transcription of the texts of the Acts and Regulations as originally published, inclusive of typographical and suchlike errors), the authors, publishers and webmaster do not accept responsibility for any loss or damage that may be occasioned as a result of the reliance by any person on the information contained herein.  In particular, persons who may be affected by the terms of statutory provisions should have recourse to the relevant Gazettes as originally published.