Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998
92
No. 37067
GOVERNMENT GAZETTE, 26 November 2013
Act No. 4 of 2013
Protection of Personal Information Act, 2013
92
Functions of Enforcement Committee
93. The Enforcement Committee—
(a) must consider all matters referred to it by the Regulator in terms of section 92
or the Promotion of Access to Information Act and make a finding in respect
thereof; and
5
(b) may make any recommendation to the Regulator necessary or incidental to
any action that should be taken against—
(i) a responsible party in terms of this Act; or
(ii) an information officer or head of a private body, as the case may be, in
terms of the Promotion of Access to Information Act.
10
Parties to be informed of developments during and result of investigation
94. If an investigation is made following a complaint, and—
(a) the Regulator believes that no interference with the protection of the personal
information of a data subject has taken place and therefore does not serve an
enforcement notice;
15
(b) the Regulator has referred the complaint to the Enforcement Committee for
consideration in terms of section 92;
(c) an enforcement notice is served in terms of section 95;
(d) a served enforcement notice is cancelled in terms of section 96;
(e) an appeal is lodged against the enforcement notice for cancellation or 20
variation of the notice in terms of section 97; or
(f) an appeal against an enforcement notice is allowed, the notice is substituted or
the appeal is dismissed in terms of section 98,
the Regulator must inform the complainant and the responsible party, as soon as
reasonably practicable, in the manner prescribed of any development mentioned in 25
paragraphs (a) to (f) and the result of the investigation.
Enforcement notice
95. (1) If the Regulator, after having considered the recommendation of the
Enforcement Committee in terms of section 93, is satisfied that a responsible party has
interfered or is interfering with the protection of the personal information of a data
subject as referred to in section 73, the Regulator may serve the responsible party with
an enforcement notice requiring the responsible party to do either or both of the
following:
(a) To take specified steps within a period specified in the notice, or to refrain
from taking such steps; or
(b) to stop processing personal information specified in the notice, or to stop
processing personal information for a purpose or in a manner specified in the
notice within a period specified in the notice.
(2) An enforcement notice must contain—
(a) a statement indicating the nature of the interference with the protection of the
personal information of the data subject and the reasons for reaching that
conclusion; and
(b) particulars of the rights of appeal conferred by section 97.
(3) Subject to subsection (4), an enforcement notice may not require any of the
provisions of the notice to be complied with before the end of the period within which
an appeal may be brought against the notice and, if such an appeal is brought, the notice
need not be complied with pending the determination or withdrawal of the appeal.
(4) If the Regulator considers that an enforcement notice should be complied with as
a matter of urgency it may include in the notice a statement to that effect and a statement
of its reasons for reaching that conclusion, and in that event subsection (3) does not
apply.
(5) A notice in terms of subsection (4) may not require any of the provisions of the
notice to be complied with before the end of a period of three days beginning with the
day on which the notice is served.
30
35
40
45
50