The openness duty
Condition 6 (openness, ss 17–18) has two parts: keep the documentation required under PAIA, and tell people what you are doing with their information. The telling is section 18(1): when personal information is collected, the responsible party must take reasonably practicable steps to make the data subject aware of the matters listed below. “Reasonably practicable” matters — the duty scales to the context, which is why a sign suffices for a camera and a paragraph suffices on a paper form.
What must a privacy notice cover?
The section 18(1) items, in checklist form:
- What information is being collected (and where collection is not direct, the source)
- Who you are — the responsible party’s name and address
- The purpose of the collection
- Whether supplying the information is voluntary or mandatory
- The consequences of not providing it
- Any law requiring or authorising the collection
- Whether you intend to transfer the information to another country, and the level of protection there
- Any further relevant information — including the recipients or categories of recipients, and the rights of access, correction, objection and complaint to the Information Regulator
Note item seven: if you use offshore providers, your notice should say so — the cross-border page covers the underlying rules. And naming your categories of recipients (s 18(1)(h)(i)) is what keeps later sharing transparent rather than surprising.
When notification is not required
Section 18(4) lists the exceptions: among others, where the data subject already knows the information, where non-compliance is necessary to avoid prejudice to law enforcement or for the conduct of court proceedings, where compliance would prejudice a lawful purpose of the collection, or where it is not reasonably practicable. The exceptions are practical, not loopholes — “we didn’t feel like telling them” is not on the list.
Notices in practice: websites, forms and cameras
The pattern is the same everywhere: put the notice where the collection happens. A website’s privacy policy linked from every form; a short collection statement on the paper application with the full notice available on request; visible CCTV signage naming the responsible party. Keep it true — a notice promising “we never share your information” while your operators, attorneys and collectors all receive it is an openness failure dressed as one. A practical starting point is the firm’s free South African privacy policy template.