PAIA & POPI POLICY (“The Policy”)

This is the OXFORD STRIDERS RUNNING CLUB’S (“the Club”) policy in terms of the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”) and the Promotion of Access to Information Act, No. 2 of 2000 (“PAIA”) (“the  Policy”). 

This Policy applies to the business of the Club wherever it is conducted, it applies to its Members, paid staff, guests, volunteers and associates of the Club upon the premises of the Club, towards the Club’s general business and Member management conduct and towards the participants and entrants of any competition or event. Where this policy refers to a “Member”, it is deemed to also refer to any other Data Subject unless the context indicates to the contrary.

A: PAIA Policy 

  1. PAIA is an act that was passed to give effect to the constitutional right, held by everyone in South Africa, of access to information which is held by the State or by another person (including the Club) and which is required for the exercise or protection of any right. Where a request is made in terms of PAIA, the body to which the request is made is obliged to give access to the requested information, except where the Act expressly provides that the information may or must not be released. It is important to note that PAIA recognises certain limitations to the right of access to information, including, but not exclusively, limitations aimed at the reasonable protection of privacy, commercial confidentiality, and effective, efficient, and good governance and in a manner which balances that right with any other rights, including such rights contained in the Bill of Rights in the Constitution. 

  2. One of the main requirements specified in PAIA is the compilation of an information manual that provides information on both the types and categories of records held by a private body. This Policy serves as the Club’s Information Manual. This Policy is compiled in accordance with Section 51 of PAIA and the Schedule to POPIA. It is intended to give a description of the records held by and on behalf of the Club, to outline the procedure to be followed and the fees payable when requesting access to any of these records in the exercise of the right of access to information, with a view of enabling requesters to obtain records which they are entitled to in a quick, easy, and accessible manner. This Policy is available for public inspection at the physical address of the Club, free of charge. 

  3. The Club only keeps the Personal Information of the Member as defined in the POPIA Policy below. Members shall at all reasonable times have access to such data and the Club shall within 

a reasonable time provide a Member or another interested party with that Personal Information and shall charge no fee to provide it. 

B: POPIA Policy 

Note: POPIA compliance is still in its infancy. The procedures and guidelines in this Policy are drafted using the best available guidance from the Information Regulator as of 1 July 2021. The Club notes that it will amend this document should practices and procedures change in due course. 

Introduction 

  1. POPIA is intended to balance two competing interests. These are: 

(a) our individual constitutional rights to privacy (which requires our Personal Information to be protected); and 

(b) the needs of our society to have access to and to process (work with) our Personal Information for legitimate purposes, including the purpose of doing business. 

  1. This Policy sets out the framework for our Clubs compliance with POPIA. Where reference is made to the “processing” of Personal Information, this will include any activity in which the information is worked with, from the time that the information is collected, up to the time that the information is destroyed, regardless of whether the information is worked with manually, or by automated systems. 

Purpose 

  1. The purpose of this policy is to enable the Club to: 

(a) comply with the law in respect of the data it holds about individuals (known as Data Subjects in the POPIA); 

(b) follow good reasonable commercial practice; & 

(c) protect the Club’s staff and other individuals. 

Club Undertakings 

  1. The Club will always: 

(a) comply with both the law and good practice; 

(b) respect individuals’ rights;

(c) be open and honest with individuals whose data is held; & 

(d) provide training and support for staff who handle personal data, so that they can act confidently and consistently with regards to PAIA and POPIA. 

  1. POPIA aims to ensure that the legitimate concerns of individuals about the ways in which their data may be used are considered. In addition to being open and transparent, the Club will seek to give individuals as much choice as is possible and reasonable over what data is held and how it is used. 

  2. The Club undertakes to follow POPIA at all relevant times and to process Personal Information lawfully and reasonably, so as not to infringe unnecessarily on the privacy of our Members and the Club recognises that its first priority under the POPIA is to avoid causing harm to individuals.  In the main this means: 

(a) the Club undertakes to process information only for the purpose for which it is intended, to enable us to do our work, as agreed with our members; 

(b) keeping information securely in the right hands; 

(c) retention of good quality information; 

(d) whenever necessary, the Club shall obtain consent to process Personal Information; (e) where the Club does not seek consent, the processing of our Members Personal Information will be following a legal obligation placed upon us, or to protect a legitimate interest that requires protection; 

(f) the Club shall stop processing Personal Information if the required consent is withdrawn, or if a legitimate objection is raised; 

(g) the Club shall retain records of the Personal Information the Club has collected for the minimum period as required by law unless the Member has furnished their consent or instructed us to retain the records for a longer period; 

(h) the Club shall destroy or delete records of the Personal Information (so as to de-identify the Member) as soon as reasonably possible after the time period for which the Club uses said data (please note that the Club keeps Member’s information after they have left the Club in case they should re-join or move to another club, for a maximum of 3 years); 

(i) the Club undertakes to ensure that the Personal Information which the Club collects and processes is complete, accurate and not misleading and up to date; 

(j) the Club undertakes to retain the physical file and the electronic data related to the processing of the Personal Information; & 

(k) the Club undertakes to take special care with our member’s bank account details and the Club is not entitled to disclose or procure the disclosure of such banking details to any third party, save for the Club’s bank and the Member’s bank, purely for purposes of executing a debit order.

  1. The Club shall collect Personal Information directly from the Member unless: (a) the information is of public record; 

(b) the Member has consented to the collection of their Personal Information from another source; 

(c) the collection of the information from another source does not prejudice the Member; (d) the information to be collected is necessary for the maintenance of law and order or national security; 

(e) the information is being collected to comply with a legal obligation, including an obligation to SARS; 

(f) the information collected is required for the conduct of proceedings in any court or tribunal, where these proceedings have commenced or are reasonably contemplated; (g) the information is required to maintain our legitimate interests; or 

(h) where requesting consent is not reasonably practical in the circumstances. 

  1. The Club shall restrict the processing of Personal Information: 

(a) where the accuracy of the information is contested, for a period sufficient to enable us to verify the accuracy of the information; 

(b) where the purpose for which the Personal Information was collected has been achieved and where the Personal Information is being retained only for the purposes of proof; or (c) where the Member requests that the Personal Information be transmitted to another automated data processing system. 

  1. According to POPIA ‘‘Personal Information’’ means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person. The POPIA, which has more specific examples if you need them, can be found at the following link:  https://popia.co.za/section-1-definitions/

The Club collects the following information from its Members (Personal Information): 

  • name 

  • photos

  • residential address 

  • email address 

  • telephone/cell number 

  • gender 

  • date of birth 

  • possibly details of other running club memberships 

  • banking details (where debit orders are implemented)

Non-Personal Information 

  1. The Club may automatically collect non-Personal Information about a Member such as the type of internet browsers a Member may use. The Club may also aggregate details which a Member has submitted to our website (for example, the products or services they are interested in). They cannot be identified from this information and it is only used to assist the Club in providing an effective service by the Club. 

Key Risks 

  1. The Club has identified the following potential key risks, which this Policy is designed to address: (a) breach of confidentiality (information being given out inappropriately); 

(b) insufficient clarity about the range of uses to which data will be put — leading to Data Subjects being insufficiently informed; 

(c) failure to offer choice about data use when appropriate; 

(d) breach of security by allowing unauthorised access; 

(e) harm to individuals if personal data is not up to date; & 

(f) third party data operator contracts. 

Member’s Rights 

  1. Data Subjects hold the following specific rights: 

(a) in cases where the Data Subject’s consent is required to process their Personal Information, this consent may be withdrawn. 

(b) in cases where the Club processes Personal Information without consent to protect a legitimate interest, to comply with the law or to pursue or protect our legitimate interests, the Data Subject has the right to object to such processing; and 

(c) all Data Subjects are entitled to lodge a complaint regarding our application of POPIA with the Information Regulator. 

Security Safeguards 

  1. In order to secure the integrity and confidentiality of the Personal Information in our possession, and to protect it against loss or damage or unauthorised access, the Club must continue to implement the following security safeguards: 

(a) our business premises where records are kept must remain protected by access control, burglar alarms and if possible, armed response;

(b) archived files must be stored behind locked doors and access control to these storage facilities must be implemented; 

(c) all the user terminals on our internal computer network and our servers / PC’s / laptops must be protected by passwords which must be changed on a regular basis. This also applies to all cloud data storage modalities; 

(d) our email infrastructure must comply with industry standard security safeguards (the club shall deal directly with its service provider in this regard); 

(e) if necessary, vulnerability assessments shall be carried out on our digital infrastructure to identify weaknesses in our systems and to ensure the Club has adequate security in place; (f) the Club must use an internationally recognised firewall to protect the data on its local servers, and the Club must run antivirus protection at least every week to ensure its systems are kept updated with the latest patches; 

(g) Club volunteers and staff must be trained to carry out their duties in compliance with POPIA, and this training must be ongoing; 

(h) it must be a term of the contract with every staff member that they must maintain full confidentiality in respect of all of our Members’ affairs, including our Members’ Personal Information; 

(i) employment contracts for staff whose duty it is to process a Member’s Personal Information, must include an obligation on the staff member: (1) to maintain the Club’s security measures, and (2) to notify their manager/supervisor immediately if there are reasonable grounds to believe that the Personal Information of a Member has been accessed or acquired by any unauthorised person; 

(j) the processing of the Personal Information of Club volunteers and staff members must take place in accordance with the rules contained in the relevant labour legislation; & (k) the digital work profiles and privileges of staff who have left our employ must be properly terminated. 

These security safeguards must be verified on a regular basis to ensure effective implementation, and these safeguards must be continually updated in response to new risks or deficiencies. 

Security Breaches 

  1. Should it appear that the Personal Information of a Member has been accessed or acquired by an unauthorised person, the Club must notify the Information Regulator and the relevant Member/s, unless the Club is no longer able to identify the Member/s. This notification must take place as soon as reasonably possible. 

  2. Such notification must be given to the Information Regulator first as it is possible that they, or another public body, might require the notification to the Member/s be delayed.

  3. The notification to the Member must be communicated in writing in one of the following ways, with a view to ensuring that the notification reaches the Member: 

(a) by email to the Member’s last known email address; 

(b) by publication on the Club’s website, or in the news media; or 

(c) as directed by the Information Regulator 

  1. This notification to the Member must give sufficient information to enable the Member to protect themselves against the potential consequences of the security breach, and must include: (a) a description of the possible consequences of the breach; 

(b) details of the measures that the Club intends to take or have taken to address the breach; (c) the recommendation of what the Member could do to mitigate the adverse effects of the breach; & 

(d) if known, the identity of the person who may have accessed, or acquired the Personal Information. 

Correction of Personal Information 

  1. A Member is entitled to require the Club to correct or delete Personal Information that the Club has, which is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or which has been obtained unlawfully. 

  2. A Member is also entitled to require the Club to destroy or delete records of Personal Information about the Member that the Club is no longer authorised to retain. 

  3. Upon receipt of such a lawful request, the Club must comply as soon as reasonably practicable: (a) in the event that a dispute arises regarding the Member’s rights to have information  corrected, and in the event that the Member so requires, the Club must attach to the  information, in a way that it will always be read with the information, an indication that  the correction of the information has been requested but has not been made; & (b) the Club must notify the Member who has made a request for their Personal Information  to be corrected or deleted what action the Club have taken as a result of such a request. 

Special Personal Information 

  1. Special rules apply to the collection and use of information relating to a person’s religious or philosophical beliefs, their race or ethnic origin, their trade union membership, their political persuasion, their health or sex life, their biometric information, or their criminal behaviour.

  2. The Club shall not process any of this special Personal Information without the Member’s consent, or where this is necessary for the establishment, exercise or defence of a right or an obligation in law. 

  3. Having regard to the nature of the Club’s work, it is unlikely that the Club will ever have to process special Personal Information (save for that of minors), but should it be necessary the guidance of the Information Officer must be sought. 

  4. The Club may only process the Personal Information of a minor if the Club has the consent of the child’s parent or legal guardian. 

Information Officer 

  1. Our Information Officer is the Club’s nominated Chairman or is a Committee Member nominated and authorised by the Club’s Management Committee. Our Information Officer’s responsibilities include: 

(a) encourage and ensure overall compliance with POPIA; 

(b) encourage compliance with conditions for the lawful processing of Personal Information; (c) deal with requests made by the Information Regulator or data subjects (individuals); (d) work with the Regulator in relation to investigations conducted in accordance with the relevant provisions of POPIA; 

(e) develop, implement and monitor a compliance framework; 

(f) ensure that a personal information impact/risk assessment is performed to guarantee that adequate measures and standards exist within the entity; 

(g) develop, monitor, maintain and make available a PAIA manual; 

(h) develop internal measures and adequate systems to process requests for access to information; & 

(i) ensure that internal awareness sessions are conducted regarding the provisions of POPI, the regulations and any codes of conduct or information obtained from the Regulator. 

  1. In the event that our Information Officer is not the Club’s nominated Chairman, such person must register with the Information Regulator prior to taking up their duties. 

  2. In carrying out his/her duties, our Information Officer must ensure that: 

(a) this Policy is implemented; 

(b) that this Policy is developed, monitored, maintained, and made available; 

(c) that internal measures are developed together with adequate systems to process requests for information or access to information;

(d) that internal awareness sessions are conducted regarding the provisions of POPIA, the Regulations, codes of conduct or information obtained from the Information Regulator;  and 

(e) that copies of this Policy are provided to persons at their request. 

  1. Guidance notes on Information Officers have been published by the Information Regulator and our Information Officer must familiarise himself / herself with the content of these notes. 29. A Member can rest assured that unless the Club is legally obliged to share their Personal Information, the Club will only share so much of a Member’s Personal Information as is needed  by the authority that requires it, and we will only do so when it is necessary for the Club to do its  work for the Member.  

  2. Should a Member have any concerns with the way in which the Club is processing their Personal Information, such Member should inform the Information Officer and if not satisfied with the  remedy be entitled to lodge a complaint with the Information Regulator, whose contact details  are: 

33 Hoofd Street, Forum III, 3rd Floor, Braampark 

P.O Box 31533, Braamfontein, Johannesburg, 2017 

Complaints email: This email address is being protected from spambots. You need JavaScript enabled to view it.;

General enquiries email: This email address is being protected from spambots. You need JavaScript enabled to view it.;

Staff Training & Acceptance of Responsibilities 

  1. The Club’s Information Officer will ensure that all staff and Club volunteers who have access to any kind of Personal Information will have their responsibilities outlined during their induction procedures. Continuing training will provide opportunities for staff to explore POPIA issues through training, team meetings, and supervision. Procedure for staff signifying acceptance of policy will ensure that all staff sign acceptance of this Policy once they have had a chance to  understand the Policy and their responsibilities in terms of the policy and the POPIA. 

Direct Marketing 

  1. The Club may only carry out direct marketing (using any form of electronic communication) to Members if: 

(a) they have been given an opportunity to object to receiving direct marketing material by electronic communication at the time that their Personal Information was collected; &

(b) they did not object then or at any time after receiving any such direct marketing communications from the Club. 

  1. The Club may only approach Members using their Personal Information if the Club has obtained their Personal Information in the context of providing services associated with our business to them and the Club may then only market Club services to them. 

  2. The Club may approach a person to ask for their consent to receive direct marketing material only once, and the Club may not do so if they have previously refused their consent. 35. All direct marketing communications must disclose a Member’s identity and must contain an address or opt-out functionality, to which the Member may send a request that the communications cease. 

Transborder Information Flows 

  1. The Club may not transfer a Member’s Personal Information to a third party in a foreign country, unless: 

(a) the Member consents to this, or requests it; 

(b) such third party is subject to a law, binding corporate rules or a binding agreement which protects the Personal Information in a manner similar to POPIA, and such third party is governed by similar rules which prohibit the onward transfer of the Personal Information to a third party in another country; 

(c) the transfer of the Personal Information is required for the performance of the contract between ourselves and the Member; 

(d) the transfer is necessary for the conclusion or performance of a contract for the benefit of the Member entered into between the Club and the third party; or 

(e) the transfer of the Personal Information is for the benefit of the Member and it is not reasonably possible to obtain their consent and that if it is possible the Member would be likely to give such consent. 

Offences & Penalties 

  1. POPIA provides for serious penalties for the contravention of its terms. For minor offences, a guilty party can receive a fine or be imprisoned for up to 12 months. For serious offences, the period of imprisonment rises to a maximum of 10 years. Administrative fines for the Club can reach a maximum of R10 million.

  1. Breaches of this Policy will also be viewed as a serious disciplinary offence by employees and Club volunteers. 

  2. It is therefore imperative that the Club complies strictly with the terms of this Policy and protects our Member’s Personal Information to international standard. 

  3. This Policy shall be governed by and construed in accordance with the laws of South Africa.