Popi Clause in Employment Contract Example

It is essential that employers understand the meaning and interpretation of consent under the ISGP. While employers may hope for a “quick fix” to ensure compliance and believe that incorporating general and “catch-all” consent into employee employment contracts is sufficient, this may not be appropriate in all cases. General consent may be sufficient to cover some of the personal data processed in the course of an employee`s employment, but employers should be aware of the risks associated with using general consent in all cases. In these circumstances, clauses relating to the processing of personal data in employees` employment contracts aimed at obtaining employees` consent to the processing should at least the nature and extent of the personal data to be processed, the reason for the processing, consent to further processing, consent to collection from a source other than the employee and consent to the transfer of the Information included. Employees must be able to understand in plain language what they are accepting and the extent of consent. Where necessary, specific provision should also be made for the processing of specific personal data. The employer must decide on a case-by-case basis whether the processing he wishes to carry out falls within the scope of the consent he may have received from an employee in his employment contract or whether he must rely on one of the other bases provided for by the POPI. In order not to conflict with the provisions of POPI, it is recommended that employers develop internal policies to help them determine whether the personal data to be processed in any event fall within the general consent clause of an employee`s employment contract, alternatively by one of the other bases of lawful processing. In the absence of this, the employer must prepare and obtain further consent from the employee. The following options are now available for download. If you are an employer and need additional help, do not hesitate to contact us.

Guide: Information Officer Protection of Personal Information Information Act of 2013 Information Regulator Contact Details The requirement that consent must be voluntary, specific and informed means that no pressure or coercion must be exerted on an employee to consent. The employee must also be sufficiently aware of the content of the processing, as consent must be communicated. Article 1 of the POPI defines consent as “any voluntary, specific and informed expression of intent in relation to the consent given for the processing of personal data”. Written consent is not expressly required. However, it is up to the employer, in his capacity as manager, to prove that he has obtained the consent of an employee when he relies on consent. In these circumstances, it is advisable to obtain the written consent of employees. POPI distinguishes between the collection, storage and processing of personal data and special personal information. Special personal data includes. B an employee`s racial or ethnic origin, health or sex life, religious or philosophical beliefs and trade union membership. Obtaining an employee`s consent is one of the bases on which an employer can legally process the general and specific personal data of its employees. The Information Authority has not yet provided guidance on the interpretation of consent with respect to POPs. In all likelihood, it will take into account the General Data Protection Regulation 2016/679 (GDPR), which requires that consent be unambiguous and given by a clearly affirmative act.

It may well be that the information regulator interprets consent restrictively in accordance with the GDPR. Refusal to testify in arbitration may result in fair dismissal Subscribers to the entire Labourwise service have free access to the following: the answers to these three questions are used to determine whether there is a “legitimate interest” in the processing of personal data. Redefining the “reasonable grounds” for transferring sanctions for non-compliance Special and general personal data may be lawfully processed if the processing is necessary for “the establishment, exercise or defence of a legal right or obligation”. This would cover cases where, for example. B an employer processes employees` personal data to comply with its obligations under the Employment Equity Act. An employer may process general personal data without an employee`s consent if such processing protects a legitimate interest of the employee or is “necessary to pursue the legitimate interest of the responsible party or a third party to whom it is provided”. Although the term “legitimate interest” is not defined in the POPI, it is likely that the information authority will seek advice from the GDPR in this regard. The GDPR introduced a tripartite test in the interpretation of “legitimate interest” that takes into account purpose, necessity and balance. It asks, on the one hand, “Is there a legitimate reason or purpose for the processions?”, on the other hand, “Is the processing of information necessary for this purpose” and, thirdly, “Is the legitimate interest overridden by the interests of the data subject?” Forum Shopping in limine: Tax Court transmits the review of legality to the High Court Video material can be considered personal data within the meaning of POPIA. You should be able to use it on the basis of pursuing your legitimate interests (i.e. .

. .