white_paper_on_data_protection_in_india_171127_final_v2

‗filing system‘. 254 A ‗filing system‘ has been defined as ‗any structured set of personal data
which are accessible according to specific criteria, whether centralised, decentralised or
dispersed on a functional or geographical basis.‘ 255 This refers to personal data that is
contained in manual records but may be organised in a structured manner.
South Africa
South Africa follows a similar approach. 256 This approach is based on the premise that easily
accessible datasets increase privacy risks and in respect of manual processing such risks arise
only if the data is an easily accessible dataset in an organized manner. 257 An example of
personal data processed manually is as follows: A hospital collects patient details manually
and stores it as physical records. Here, personal data is collected or stored manually and
therefore, is processed through non-automated means.
5.3 Provisional Views
1. The data protection law may not attempt to exhaustively list all operations that
constitute processing.
2. The definition of processing may be broadly worded to include existing operations
while leaving room to incorporate new operations by way of interpretation.
3. The definition may list the three main operations of processing i.e. collection, use and
disclosure of data. It may be worded such that it covers the operations/activities
incidental to these operations.
4. The law should cover both automated and manual processing.
5.4 Questions
1. What are your views on the nature and scope of data processing activities?
2. Should the definition of processing list only main operations of processing i.e.
collection, use and disclosure of data, and inclusively cover all possible operations on
data?
3. Should the scope of the law include both automated and manual processing? Should the
law apply to manual processing only when such data is intended to be stored in a filing
system or in some similar structured format?
Alternatives:
254 Article 2(1), EU GDPR.
255 Article 4(6), EU GDPR.
256 Section 3, POPI Act.
257 See also Recital 15, EU GDPR.
46