Well, we have waited since 2013 for POPIA to be implemented and now, from 1 July a number of sections are in force meaning that entities have until 1 July 2021 to be compliant.
For 5 years now I have been saying that POPIA and eDiscovery work hand in hand in a number of ways and it is unfortunate that we have had to wait so long for POPIA and of course are still waiting for eDiscovery to be incorporated into our Uniform Rules. However, they can work together now because eDiscovery technology is already here to right some wrongs and also protect the rights and privacy of individuals and entities. Let us take a peek at how this can happen.
Firstly, I have been concerned for years about what I call the drain of data leaving our jurisdiction in litigation cases, arbitrations and investigations. These are matters which are global in that they may be subject to proceedings in other countries e.g. USA and UK and the organisations involved have a presence in SA be it offices, factories, research centres, mines etc. The data held here needs to form part of the investigation or case and the US or UK lawyers and service providers, simply organise a data collection in SA then ship or transfer that data to their own country for analysis and review. This happens for two main reasons. One is that we had no Data Protection laws in place and therefore data, in its entirety could be removed without sanction. Secondly, because eDiscovery is not integral to our rules there is insufficient experience and resource for external lawyers to entrust work to SA. POPIA will help markedly because data must not be removed if it contains personal or private information and there are severe financial penalties for doing so. Remember also that in SA, POPIA refers to private information of entities, unlike some DP laws, and all of this means that the data needs to be filtered here in SA to ensure that it is free from personal or private information before leaving the jurisdiction (unless there is specific consent from the subject of the data) . How can that be done reliably, quickly and cost effectively? The answer is by using the features of eDiscovery technology.
Taking that one stage further I see opportunities for SA attorneys and service providers, in that, if they have to be involved to find and set aside personal and private information they may as well be engaged to host, analyse and review the remaining data on behalf of the main lawyers from other countries. This way, everyone wins! The data is protected as it never leaves SA unless it goes to a jurisdiction that has DP laws as good as or better than POPIA. The rights of individuals are protected for the same reason. Local attorneys and service have more international work which will expand their knowledge and experience and the outside organisations and their clients are happy as they save money and time.
How else can eDiscovery technology work with POPIA? A very important aspect and ever growing consequence of Data Protection laws is Data Subject Access Requests or DSAR’s as they are more commonly known. These are a feature of every DP law and in simple terms it is the right of individual to see what private data of theirs exists within the data of an organisation. The individual can request this data, see how and where it is stored, how it was sourced and details of how and where it may have been disclosed anywhere else. Once a request has been made there are strict time limits for the organisation to comply with the DSAR, usually within one month. How can this be done quickly and cost effectively, and again the answer is by using eDiscovery technology to search, filter and produce what is required. Furthermore this represents more work and opportunities for local providers.
All in all I am excited about POPIA’s implementation not only as I believe in protecting the rights of individuals but I am passionate about using eDiscovery technology in SA. It will take us one step nearer to my dream of having eDiscovery incorporated into our rule of civil procedure.