The Protection of Personal Information (POPI) Act, coming into effect later this year, is set to revolutionise South African businesses at every level, from the telephonist to board members, says Hogan Lovells partner, Leishen Pillay.

The implementation of this act will also impact the relationship between local DMCs and international tour operators.

According to Pillay, POPI introduces a concept known as ‘specific consent’. He stresses that “consent is key” and warns that for South African companies, compliance will not be a matter of “simply ticking a box”.

“How does a South African travel company, hotel or airline that has received information from a third party know that the party providing it has the authority to do so? How can one confirm the integrity of that information? This is where POPI introduces ‘specific consent’,” he says.

Comments Advocate Louis Nel: “Specific consent (defined as ‘any voluntary, specific and informed expression of will’) requires that a person’s information is collected for a specific purpose – the person must be fully informed on how the information will be used and with whom it will be shared e.g. a car-hire company.”

Nel says to comply, local travel trade dealing with international tour operators will have to set up processes and procedures that ensure foreign travellers making use of their services have specifically consented for their information to be provided and “processed” (meaning collected, disseminated or merged) by the DMC, and then to any of the companies they partner with who will be providing further services.

For example, if these details are to be shared with the accommodation, car rental, or tourist services the traveller will be using during their stay, specific consent has to be obtained in writing, which stipulates that each company may receive and utilise the information for the purposes of that trip, and no other purposes.

Pillay says: “That’s the level to which SA companies are going to need to get to, to obtain consent. It is not enough that you ask: ‘Can we obtain quotations from lodges in the Kruger?’ for example. You’ve got to obtain the exact consent and that consent has to be as specific as possible.”

Travellers would also have to provide specific consent for their data to be used in marketing research or studies, or for them to receive promotional material.

Nel explains that the onus to prove that specific consent was properly acquired will be placed on the South African company, “to the extent that if they don’t have it and are not able to get it, they will be in breach of POPI”.

South African companies have been advised to hire or appoint a privacy or information officer to ensure that data protection standards are complied with, says Pillay.

This person should have a well-versed understanding and good working knowledge of the legal framework of the POPI Act. This person would then implement and monitor procedure and, in the case of the travel trade, ensure that international tour operators are provided with the correct information regarding how travellers’ information will be collected and processed.

Additional research by  Daniella Potter.