The Information Regulator (the Regulator) announced, on July 4, 2023, that it had issued, on July 3, 2023, an Infringement Notice in which it imposed a fine of ZAR 5 million (approx. $267,813) to the Department of Justice and Constitutional Development, for failure to comply with the Enforcement Notice issued by the Regulator on May 9, 2023.

Background to the decision

The Regulator noted that the Enforcement Notice had been issued following the finding of the contravention of various sections of the Protection of Personal Information Act, 2013 (POPIA). In this context, the Regulator reminded that it had required the Department to submit proof to the Regulator, within 31 days, of the actions taken to comply with the Enforcement Notice. Further to this, the Regulator indicated that in case of failure to abide by the Enforcement Notice within the stipulated timeframe, the Department would have been guilty of an offense, in terms of which the Regulator may impose an administrative fine in the amount not exceeding ZAR 10 million (approx. $536,418), or liable upon conviction to a fine or to imprisonment of the responsible officials. 

Findings of the Regulator

The Regulator noted that the 31-day timeframe expired on June 9, 2023, and that the Department had not provided the Regulator with a report on the implementation of the actions required in the Enforcement Notice, nor any other communication in this regard. As such, the Regulator determined that the Department failed to comply with the Enforcement Notice served to it in terms of POPIA. Therefore, the Regulator imposed a fine of ZAR 5 million (approx $267,813).

Outcomes

The Regulator imposed the aforementioned fine and noted that the Department has 30 days to pay the administrative fine, make arrangements with the Regulator to pay the administrative fine in installments, or elect to be tried in court on a charge of having committed the alleged offense referred in terms of POPIA.

You can read the announcement here.