December 2026 marks 10 years since the establishment of SA’s independent institution responsible for the protection of the POPIA legislation. (Image source: iStock)
Nearly 10 years since it was established, data privacy watchdog the Information Regulator (InfoReg) must now traverse an environment where personal information is collected, shared and processed at an unprecedented scale.
InfoReg chairperson advocate Pansy Tlakula told ITWeb on the sidelines of a recent event that today’s technological progress has resulted in complexities that raise questions about compliance and privacy by default.
OpenAI catapulted its ChatGPT platform into the public’s hands in November 2022, bringing worldwide attention to artificial intelligence (AI) and subsequently generative AI.
Since then, AI has infiltrated almost every industry, with AI-capable devices and tools now the order of the day.Policy and lawmakers across the global community have increasingly focused on its regulation.
The InfoReg, which is the enforcer of the Protection of Personal Information Act (POPIA) and Promotion of Access to Information Act (PAIA), says it now operates in a world that’s “vastly different” from the one that existed when legislations were enacted.
According to the watchdog, AI, automated decision-making systems, biometric technologies and digital platforms are increasingly embedded in both public and private sector operations.
Developments, it says, present immense opportunities for economic growth, innovation and improved service delivery. However, they also introduce risks to privacy, transparency, accountability and human rights.
This, said Tlakula, makes the role of the Information Regulator even more important.
Delving into some of these complexities, she said these include managing consent, retention, maintaining transparency and addressing the lack of a national AI policy in South Africa.
She cited an example where a form for the Consumer Protection Act opt-out registry requests non-compliant information, such as marital status and gender.
This is some of what the regulator witnesses when laws, policies and systems are introduced, according to Tlakula. “From where we sit, we are not convinced by the principle of privacy by default and conducting personal information impact assessments…if they happen.”
Advocate Tshepo Boikanyo, InfoReg executive for POPIA, highlighted that AI models often retain personal information beyond its intended purpose, which contradicts the principles of POPIA.
“That’s the challenge,” he noted. “In terms of our Act, you cannot store the personal information beyond its intended purpose. With AI models, we don’t know what then happens with this personal information.”
Advocate Pansy Tlakula, chairperson of the Information Regulator. (Photograph by Strike A Pose Studio)
The InfoReg was established on 1 December 2016, with the aim to, among other matters, monitor and enforce compliance by public and private bodies with the provisions of PAIA and POPIA.
The purpose of the laws is to ensure all South African institutions conduct themselves in a responsible manner when collecting, processing, storing and sharing another entity’s personal information by holding them accountable should they abuse or compromise personal information in any way.
The country’s data privacy legislation POPIA came into force on 1 July 2021, following a year-long grace period for organisations to comply with the Act.
Breaching the rules and regulations outlined by the Act can have serious, long-lasting financial and reputational implications for the affected business.
It makes provision for fines of up to R10 million and a jail sentence of up to 10 years, depending on the seriousness of the breach.
The regulator can give a public body a grace period to remedy a POPIA violation before taking further enforcement action.
Tlakula commented that the past decade has been marked by both significant challenges and important achievements in safeguarding constitutional rights to privacy and access to information.
Among these is transitioning from establishing the regulatory framework to actively exercising statutory enforcement powers, including receiving complaints, conducting assessments and issuing enforcement notices.
The chairperson noted it’s the InfoReg’s view that POPIA does not stand in the way of innovation.
“If people can just internalise that data privacy can never stand in the way of innovation, these two things must go hand-in-hand,” she said, stressing that some things should be viewed from the human rights lens.
“Data protection is not an ICT matter; it’s a matter that concerns human dignity – it concerns the privacy of people. If people can have that paradigm shift of saying, in as much as you wouldn’t want anyone to do as they wish with your property, you wouldn’t want anyone to do as they wish with your personal information. If everyone can depart from that premise, maybe we’ll see a different world.”
Mukelani Dimba, InfoReg executive for education and communication,noted that technology often outpaces legal considerations, with data protection frequently being treated as an afterthought rather than being integrated from the system’s conceptualisation phase.
“It’s only when people are looking at scaling up…and then we get we get invited to engage in sandboxes. But it’s too late by that time.”
Dimba stressed the need for thorough audits of the development of AI systems and how they process personal information within the South African market.
“Where are they being developed, who is developing them and how are these systems processing personal information? You find that those questions don’t happen nearly enough. As the regulator, we need to be vigilant that we are quite aware of where development is happening, and to ensure that happens within the provisions of the legislation.”
Tlakula added: “What doesn’t help is that we don’t even have a national AI policy, so it’s a free for all.” People develop their own policies internally, if they have them at all, she pointed out.
She concluded that the InfoReg remains committed to ensuring technological progress is matched by responsible governance, innovation is accompanied by accountability, and that the fundamental rights of all people in South Africa continue to be protected and advanced.
