The Problem with POPIA

The intentions of the Protection of Personal Information Act (POPIA), promulgated in 2014 and enacted on 1 July this year, are honourable and compelling. The public must be protected against identity theft and intrusive marketing which is line with the objectives of the equivalent EU General Data Protection Regulation (GDPR). It must be emphasised that the objective is to protect personal information, but in stark contrast to the GDPR, POPIA was inexplicably extended to include juristic entities i.e. companies.

This directly clashes with existing legislation which obligates the public disclosure of company information such as director and shareholder information. STRATE is the settlement agent for listed issued securities and holds the central depository which identifies ownership of these securities, but because of POPIA being extended to juristic entities, it has taken the understandable decision to no longer make this information publicly available pending clarity from the regulator. STRATE is under no legal obligation to supply ownership information but merely facilitates this on behalf of issuers, which is where the legal onus lies in terms of section 26 of the Companies Act. Incongruously, POPIA’s inclusion of juristic entities, potentially defaults all JSE listed companies to be in breach of the law.

Section 26 of the Companies Act grants unqualified access to a company’s share register by the public. It is a moral imperative that as directors of public or private companies trade with the privilege of limited liability, the reciprocation is transparency. In 1995 the Constitutional Court ruled in the case of Bernstein and others vs Bester and others that: “The establishment of a company as a vehicle for conducting business on the basis of limited liability is not a private matter”. In 2016, the Supreme Court of Appeal ruled in Moneyweb vs Nova Properties that the shareholding of private companies is not private information, and dismissed the Nova application with punitive costs.

The problem goes substantially beyond that.

The events of 9/11 placed global regulators on an inexorable path to fight corruption, money laundering and terrorist funding by insisting on effective regulated disclosure of ultimate beneficial owners by trading partners. This global charge is led by Financial Action Task Force which has given South Africa 18 months to implement effective legislation to disclose the ultimate beneficial owners or risk being placed on a ‘grey list’ which will have material negative implications for our financial sector.

Considerable progress has been made in the Companies Amendment Bill, the draft of which was released for public comment by the Department of Trade, Industry and Competition on 1 October this year, to strengthen the obligations under section 26 to meet international disclosure standards. POPIA in its current form is a direct obstacle to that progress.

The regulator undertook in June this year to provide a guidance note on juristic persons, and while the pressure on its resources at the moment can be appreciated, this should be given the highest priority.