white_paper_on_data_protection_in_india_171127_final_v2

South Africa
Under the POPI Act, the Information Regulator may undertake investigation into a complaint
submitted by a person for, inter alia, breach of the conditions of lawful processing of personal
information. 842 The Information Regulator may also, on its own initiative, commence
investigation. 843 On receipt of a complaint, the Information Regulator may conduct a preinvestigation
844 , act as a conciliator, conduct a full investigation or refer the complaint to its
enforcement committee 845 . Where the Information Regulator is satisfied with the organization
has interfered with the protection of personal information of the complainant, the Information
Regulator may issue a notice directing the organization to take corrective steps
accordingly. 846 A penalty may also be imposed on the organization. 847 A right of appeal
against the direction/notice of the Information Commissioner lies with the High Court having
the requisite jurisdiction. 848
3.4 Provisional Views
1. Given that under a data protection legal regime, government bodies and public
authorities may be considered as data controllers, an adjudicating officer appointed
under the IT Act, who is an officer of the government, may not be the appropriate body
to adjudicate disputes which involve violation of data protection obligations by such
government bodies and public authorities. Therefore, it may be appropriate for a
separate, independent body, such as, a data protection authority to adjudicate on
disputes arising between an individual and a data controller due to breach of any data
protection obligation.
2. It follows that an individual whose data protection rights have been violated may, at the
outset, first approach the data controller or a specific grievance redressal officer of the
data controller identified in this regard.
3. Where the data controller fails to resolve the complaint of the individual in a
satisfactory and expeditious manner, the individual may be given the right to file a
complaint with the data protection authority. Moreover, where the data protection
authority observes any violation by a data controller of any of the provisions of a data
protection law, it may initiate action against such data controller on a suo motu basis.
4. The data protection authority may be conferred with the power to appoint an
adjudicating officer who may have the requisite qualifications and expertise to inquire
into the facts of the complaint and adjudicate accordingly.
842 Sections 73 and 74, POPI Act.
843 Section 76(3), POPI Act.
844 Section 79, POPI Act.
845 Section 92, POPI Act.
846 Section 95, POPI Act.
847 Section 109, POPI Act.
848 Section 97, POPI Act.
188