POPIA, Employees And Employment Contracts

Employers will inevitably collect or already have personal information about their employees on file or stored electronically. With the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”) now in force, such employee information must be protected in their workplace just as it should be protected by other bodies who possess their personal information.  

Employees have the right to determine what information their employer holds and to request access to such information. They may also request that it be corrected, deleted or destroyed; or may object on reasonable grounds to have their personal information processed. Further, they have the right to submit a complaint to the Information Regulator or commence civil proceedings to protect their rights under POPIA. 

Besides regular personal information, POPIA also provides for the prohibition of processing “special personal information”, subject to certain exceptions. This “special personal information” relates to one’s race or ethnic origin, religious or philosophical beliefs, political persuasion, trade union membership, health, sex life or biometric information. It can also include certain information about the criminal behaviour of an employee. 

This “special personal information” may also form part of the data which an employer comes to possess. For an employer to legally process this information, the employer is obliged to obtain the employee’s consent to do so. 

An employer should thus notify existing employees regarding what personal and special information is processed and obtain their informed consent in this regard. Furthermore, employers should update all current employment contracts or supplement them with an addendum regarding the processing of personal information by the employer. 

Employment contracts entered into from hereon should contain a clause or an addendum dealing with the employee’s consent for their employer to process their personal information and/or special personal information. This clause or addendum should also regulate the instance of the employee processing others’ personal information that they will have access to due to their employment, such as the employer’s clients.