THE PROTECTION OF PERSONAL INFORMATION ACT

PRIVACY NOTICE

The right to privacy is an integral human right recognised and protected in the South Africa Constitution and in the Protection of Personal Information Act 4 of 2013 (“POPIA”). POPIA aims to promote the protection of privacy through providing guiding principles that are intended to be applied to the processing of personal information in a context sensitive manner.  A person’s right to privacy entails having control over their personal information “PI” and being able to conduct their affairs relatively free from unwanted intrusions.

 

This Notice explains how we obtain, use and disclose your personal information, in accordance with the requirements of the Protection of Personal Information Act (“POPIA”).

At Total Labour Force we are committed to protecting your privacy and to ensure that your personal information is collected and used properly, lawfully and transparently.

 

DEFINITIONS

Personal Information Personal information (PI) is any information that can be used to reveal a person’s identity.  PI relates to an identifiable, living, natural person, and where applicable and identifiable, existing juristic person (such as a company), including, but not limited to information concerning: ·       Race, gender, sex, pregnancy, marital status, national or ethnic origin, colour, sexual orientation, age, physical or mental health, disability, religion, conscience, belief, culture, language and birth of a person; ·       Information relating to the education or the medical, financial, criminal or employment history of the person; ·       Any identifying number, symbol, email address, physical address, telephone number, location information, online identifier or other particular assignment to the person; ·       The biometric information of the person; ·       The personal opinions, views or preferences of the person; ·       Correspondence sent by the person that is implicitly or explicitly of a prove or confidential nature or further correspondence that would reveal the contents of the original correspondence; ·       The view or opinions of another individual about the person; ·       The mane of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

Data Subject this refers to the natural or juristic person to whom PI relates, such as an individual client, customer or company that supplies the organisation with products or other goods and or services.

Responsible Party The responsible party is the entity that needs the PI for a particular reason and determines the purpose of an means for processing the PI.  In this case, the organisation is the responsible party.

Operator An operator means a person who processes PI for a responsible party in terms of a contract or mandate, without coming under the direct authority of the party.  For example, a third party service provider that has contracted with the organisation to shred documents containing PI.  When dealing with an operator, it is considered good practice for a responsible party to include and indemnity clause.

Information Officer The information officer is responsible for ensuring the organisations compliance with POPIA.  Where no information officer is appointed, the head of the organisation will be responsible for performing the information officer’s duties. Once appointed, the information officer must be registered with the South African Information Regulator established under POPIA prior to performing their duties.  Deputy information offices can also be appointed to assist the information officer.

Processing The act of processing information includes any activity or any set of operations, whether or not by automatic means, concerning PI and includes: ·       The collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; ·       Dissemination by means of transmission, distribution or making available in any other form; or ·       Merging, linking, as well as any restriction, degradation, erasure or destruction of information.

Record Means any recorded information, regardless of form or medium, including: ·       Writing on any material; ·       Information produced, recorded or stored by means of any tape-recording device, computer equipment, whether hardware or software or both, or other device; and any material subsequently derived from information so produced, recorded or stored; ·       Label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached by any means; ·       Book, map, plan, graph or drawing; ·       Photograph, film, negative, tape or other device in which one or more visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced.

Filing System Means any structured set of PI, whether centralised, decentralised or dispersed on a functional or geographical basis, which is accessible according to specific criteria.

Unique identifier Means any identifier that is assigned to data subject and is used by a reasonable party for the purposes of the operations of that responsible party and that uniquely identifies that data subject in relation to that responsible party.

De-Identify This means to delete any information that identifies a data subject or which can be used by a reasonably foreseeable method to identify, or when linked to other information, that identifies the data subject.

Re-identify In relation to personal information of a data subject, means to resurrect any information that has been de-identified that identifies the data subject, or can be used or manipulated by a reasonably foreseeable method to identify the data subject.

Consent Means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of PI

Direct Marketing Means to approach a data subject, either in person or by mail or electronic communication, for the direct or indirect purposes of: ·       Promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject; or ·       Requesting the data subject to make a donation of any kind for any reason.

Biometrics Means a technique of personal identification that is based on physical, physiological or behavioural characterisation including blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition.

 

 

PURPOSE

The purpose of this policy is to protect Total Labour Force from the compliance risks associated with the protection of personal information which includes:

• Breaches of confidentiality. For instance, the company could suffer loss in revenue where it is found that the PI of data subjects has been shared or disclosed inappropriately.
• Failing to offer choice. For instance, all data subjects should be free to choose how and for what purpose Total Labour Force uses information relating to them.
• Reputational damage. For instance, the organisation could suffer a decline in value following an adverse event such as a computer hacker deleting the PI held by the company.

 

The policy demonstrates Total Labour Force’s commitment to protecting the privacy rights of data subjects in the following manner:

• Through stating desired behaviour and directing compliance with the provisions of POPIA and best practice.
• By cultivating an organisational culture that recognises privacy as a valuable human right.
• By developing and implementing internal controls for the purpose of managing the compliance risk associated with the protection of PI.
• By creating business practices that will provide assurance that the rights of data subjects are protected and balanced with the legitimate business needs of Total Labour Force.
• By assigning specific duties and responsibilities to control owners, including the appointment of an Information Officer and where necessary, Deputy Information Officers in order to protect the interests of Total Labour Force and data subjects.
• By raising awareness through training and providing guidance to individuals who process personal information so that they can act confidently and consistently.

 

ABOUT THE COMPANY AND ORGANISATIONAL SCOPE

Total Labour Force is a wages processing company specialising in Access workers.

 

This policy and its guiding principles apply to:

• Total Labour Force’s governing and managing members
• All branches, business units and divisions
• All employees and casual labourers
• All contractors, suppliers, customers and other persons acting on behalf of Total Labour Force.

 

The policy’s guiding principles find application in all situations and must be read in conjunction with POPI as well as the organisations PAIA as required by the Promotion of Access to Information Act (Act No2 of 2000).

 

The legal duty to comply with POPIA’s provisions is activated in any situation where there is:

• A processing of…..
• …..personal information……
• ……entered into a record………
• …….by or for a responsible person……
• ……who is domiciled to South Africa.

 

POPI does not apply in situations where the processing of PI:

• Is concluded in the course of purely personal or household activities; or
• Where the PI has been de-identified.

 

Where appropriate, Total Labour Force will ensure that its clients and customers are made aware of the rights conferred upon them as data subjects.  Total Labour Force will ensure that it gives effect to the following rights:

 

1. The right to access Personal Information

Total Labour Force recognises that a data subject has the right to establish whether Total Labour Force holds PI related to them, including the right to request access to that PI.

 

To do this, simply contact us info@tlfkzn.co.za or alternatively on our landline number 031 303 1106 and specify what information you require.  We will need a copy of your ID document to confirm your identity before providing details of your personal information. A request form will be sent to you for clarification and signature, once this has all been verified then we can proceed with release of information.

 

2. The right to have Personal Information corrected or deleted

The data subject has the right to request, where necessary, that their personal information must be corrected or deleted where Total Labour Force is no longer authorised to retain the PI.

 

3. The right to object to the processing of Personal Information

The data subject has the right, on reasonable grounds, to object to the processing of their personal information.

 

In such circumstances, Total Labour Force will give due consideration to the request and the requirements of the POPIA, we may cease to use or disclose the data subject’s PI and may, subject to any statutory and contractual record keeping requirements and legislation, also approve the destruction of the PI.

 

4. The right to object to Direct Marketing

The data subject has the right to object to the processing of their PI for the purposes of direct marketing by means of unsolicited electronic communications.

 

5. The right to complain to the Information Regulator

The data subject has the right to object to submit a complaint to the Information Regulator regarding an alleged infringement of any of the rights protected under POPIA and to institute civil proceedings regarding the alleged non-compliance with the protection of their PI.

 

6. The right to be informed

The data subject has the right to be notified that their PI is being collected by Total Labour Force.  The data subject also has the right to be notified in any situation where Total Labour Force has reasonable grounds to believe that the PI of the data subject has been accessed or acquired by an unauthorised person.

 

GENERAL GUIDING PRINCIPLES

All employees and persons acting on behalf of Total Labour Force will at all times be subject to, and act in accordance with, the following principles:

 

Accountability

Failing to comply with POPIA could potentially damage Total Labour Force’s reputation or expose the organisation to civil claim for damages.  The protection of PI is therefore everybody’s responsibility.

 

Total Labour Force will ensure that the provisions of POPIA and the guiding principles outlined in this policy are complied with through the encouragement of desired behaviours.  However, Total Labour Force will take appropriate sanctions, which may include disciplinary action, against those individuals who through their intentional or negligent actions or omissions frail to comply with the principles and responsibilities outlined in this policy.

 

Processing limitation

Total Labour Force will ensure that PI under its control is processed:

• In a fair, lawful and non-excessive manner, and
• Only with the informed consent of the data subject, and
• Only for a specifically defined purpose.

 

Total Labour Force will inform the data subject of the reasons for collecting their PI and obtain written consent prior to processing PI.

 

Alternatively, where business is concluded electronically, Total Labour Force will retain a record for the collecting of the information and where business is concluded telephonically, Total Labour Force will require the requestor to submit proof of the consent electronically and then forward such information electronically, keeping a record of such.

 

Total Labour Force will under no circumstances distribute or share PI between associated organisations or with any individuals that are not directly involved with facilitating the purpose of which the information was originally collected.

 

Where applicable, the data subject must be informed of the possibility that their PI will be shared with other aspects of the organisations business and provided with the reasons for doing so.

 

Purpose specifications

All of Total Labour Force’s business operations must be informed by the principle of transparency.  Total Labour Force will process PI only for specific, explicitly defined and legitimate reasons.  Total Labour Force will inform data subjects of these reasons prior to collecting or recording the data subjects PI.

 

Further processing limitations

PI will not be processed for a secondary purpose unless that processing is compliant with the original purpose.  Therefore, where Total Labour Force seeks to process PI it holds for a purpose other than the original purpose for which it was obtained, and where the secondary purpose is not compatible with the original purpose we will obtain additional consent from the data subject.

 

Information quality

Total Labour Force will take reasonable steps to ensure that all PI collected is complete, accurate and not misleading.  The more important the information is the greater the effort we will place on ensuring its accuracy.

 

Where PI is collected or received from third parties, Total Labour Force will take reasonable steps to confirm that the information is correct by verifying the accuracy of the information directly with the data subject or by way of independent sources.

 

Open communication

Total Labour Force will take reasonable steps to ensure that data subjects are notified (are at all times aware) that their PI is being collected including the purpose for which it is being collected and processed.

 

Total Labour Force will ensure that it establishes and maintains a “contact us” facility through electronic means for the data subject who wants to:

• Enquire whether the organisation holds related PI, or
• Request access to related PI, or
• Request the organisation to update or correct related PI, or
• Make a complaint concerning the processing of PI.

 

Security safeguards

Total Labour Force will manage the security of its filing and data holding systems to ensure that PI is adequately protected.  To this end, security controls will be implemented in order to minimise the risk of loss, unauthorised access, disclosure, interference, modification or destruction.  Bearing in mind that we are a small business and the information we hold is relatively minimal due to the nature of our business and therefore security measure required are relatively minor.

 

Security measures also need to be applied in a context-sensitive manner. For example, the more sensitive the PI, such as medical information or credit card details, the greater the security required.

 

Total Labour Force will continuously review its security controls which will include regular testing of protocols and measures put in place to combat cyber-attacks on the organisations server and IT networks.

 

Total Labour Force will ensure that all paper and electronic records comprising PI are securely stored and made accessible only to the authorised staff handling such PI.

 

All new employees will be required to sign employment contracts containing contractual terms for the use and storage of employee information.  Confidentiality clauses will also be included to reduce the risk of unauthorised disclosures of PI for which the organisation is responsible.

 

All existing employees will, after the required consultation process has been followed, be required to sign an addendum to their employment in the form of a consent and confidentiality document to be added to their employee file.

 

Total Labour Force’s clients and third party service providers will be required to enter into service level agreements with the organisation where both parties pledge their mutual commitment to POPI and the lawful processing of any PI pursuant to the agreement.

 

When we contract with third parties, we impose appropriate security, privacy and confidentiality obligations on them to ensure that personal information that we remain responsible for, is kept secure.  We will ensure that anyone to whom we pass your personal information agrees to treat your information with the same level of protection as we are obliged to.

 

Our security policies and procedures cover:

• Physical security;
• Computer and network security;
• Access to personal information;
• Secure communications;
• Security in contracting out activities or functions;
• Retention and disposal of information;
• Acceptable usage of personal information;
• Governance and regulatory issues;
• Monitoring access and usage of private information;
• Investigating and reacting to security incidents.

 

Data subject participation

A data subject may request the correction or deletion of their PI held by the organisation.  Total Labour Force will ensure that it provides a facility for data subjects who want to request the correction or deletion of their PI, via electronic means on our “contactus” platform.

 

INFORMATION OFFICES

Total Labour Force will appoint an Information Officer and where necessary, a Deputy Information Officer to assist the Information Officer.  Total Labour Force’s Information Officer is responsible for ensuring compliance with POPIA.

 

There are no legal requirements under POPIA for Total Labour Force to appoint an Information Officer.  Appointing an Information Officer is however, considered to be a good business practice, particularly with larger organisations.

 

Where no Information Officer is appointed, the head of Total Labour Force will assume the role of the Information Officer.  Consideration will be given on an annual basis to the re-appointment or replacement of the Information Officer and the Deputy Information Officer.

 

Once appointed, Total Labour Force will register the Information Officer with the South African Information Regulator established under POPI prior to performing their duties.

 

SPECIFIC DUTIES AND RESPONSIBILITIES

Management

Total Labour Force’s management cannot delegate its accountability and is ultimately answerable for ensuring that the organisation meets its legal obligations in terms of POPIA.  The management may however delegate some of its responsibilities in terms of POPIA to lower management or other capable individuals.

 

Management is responsible for:

• Total Labour Force appointment of an Information Officer, and where necessary, a Deputy Information Officer.
• All persons responsible for the processing of PI on behalf of the organisation:
• Are appropriately trained and supervised to do so,
• Understand that they are contractually obligated to protect the PI they come into contact with, and
• Are aware that a wilful or negligent breach of this policy’s processes and procedures may lead to disciplinary action being taken against them.
• Data subjects who want to make enquiries about their PI are made aware of the procedures that needs to be followed should they wish to do so.
• The scheduling of a periodic POPIA audit in order to accurately assess and review the ways in which Total Labour Force collects, holds, uses, shares, discloses, destroys and processes PI.
• Ensure that Total Labour Force’s IT infrastructure, filing systems and other devices used for processing PI meet acceptable security standards.

 

Information Officer

Total Labour Force’s Information Officer is responsible for:

• Taking steps to ensure Total Labour Force’s reasonable compliance with the provisions of POPIA.
• Keeping management updated about the organisations information protection responsibilities under POPIA. For instance, in the case of security breach, the Information Officer must inform and advise management of their obligations pursuant to POPIA.
• Continually analysing privacy regulations and aligning them with the organisations PI processing procedures. This will include reviewing Total Labour Force’s information protection procedures related to policies.
• Ensuring that POPIA Audits are scheduled and conducted on a regular basis.
• Ensuring the Total Labour Force makes it convenient for data subjects who want to update their PI or submit POPIA related complaints to the organisation. For instance, maintaining a “contactus” facility.
• Approving any contracts entered into with clients, employees and other third parties which may have an impact on the PI held by the organisation. This will include overseeing the amendment of Total Labour Force’s employment contracts and other service level agreements.
• Encouraging compliance with the conditions required for the lawful processing of PI.
• Ensuring that employees and other persons action on behalf of Total Labour Force are fully aware of the risks associated with the processing of PI and that they remain informed about Total Labour Force’s security controls.
• Organising and overseeing the awareness training of employees and other individuals involved in the processing of PI on behalf of Total Labour Force.
• Addressing employees POPIA related questions.
• Addressing all POPIA related requests and complaints made by Total Labour Force’s data subjects.
• Working with the Information Regulator in relation to any ongoing investigations. The Information Officer will therefore act as the contact point for the Information Regulator authority in issues relating to the processing of PI and will consult with the Information Regulator where appropriate, with regards to any other matter.

 

The Deputy Information Officer will assist the Information Officer in performing their duties and perform the following duties:

• Ensuring that all electronically held PI is kept on the server and where available to approved cloud computing services.
• Ensuring that servers containing PI are situated in secure locations, away from the general work force.
• Ensuring that all electronically stored PI is backed-up and tested on a regular basis.
• Ensuring that all back-ups containing PI are protected from unauthorised access, accidental deletion and malicious hacking attempts.
• Ensuring that PI information being transferred electronically is done so securely.
• Ensuring that all servers and computers containing PI are protected by a firewall and the latest security software.
• Facilitating the performing of regular IT audits to ensure that the security of the organisations hardware and software systems is functioning properly.
• Performing proper due diligence review prior to contracting with clients and other third-party service providers to process PI on the organisations behalf such as cloud computing services.

 

Administrative staff

Total Labour Force’s administrative staff are responsible for:

• Approving and maintaining the protection of PI statements and disclaimers that are displayed on electronic communications such as emails and notices etc.
• Addressing any PI protection queries from employees and clients.
• Where necessary, working with persons acting on behalf of the organisation to ensure that any outsourced initiatives comply with POPIA.

 

Employees and other persons acting on behalf of Total Labour Force

Employees and other persons acting on behalf of Total Labour Force will, during the course of their duties, gain access to and become acquainted with the PI of certain clients, suppliers and other employees.

 

Employees and other person’s action on behalf of Total Labour Force are required to treat PI as a confidential business asset and to respect the privacy of data subjects.

 

Employees and other persons action on behalf of Total Labour Force may not directly or indirectly, utilise, disclose or make public in any manner to any person or third party, either within Total Labour Force or externally, any PI, unless such information is already public knowledge or the disclosure is necessary in order for the employee or person to perform their duties.

 

Employees and other persons acting on behalf of Total Labour Force will only process PI where:

• The data subject, or competent person will consent to processing; or
• The processing is necessary to carry out actions for the conclusion or performance of a task, duty, contract to which the data subject is a party; or
• The processing complies with an obligation imposed by law on the responsible party; or
• The processing protects a legitimate interest of the data subject; or
• The processing is necessary for pursing the legitimate interest of the organisation or of a third party to which the information is supplied.

 

Furthermore, PI will only be processed where the data subject;

• Clearly understands why and for what purpose their PI is being collected, and
• Has granted the organisation with explicit written or verbally recorded consent to process their PI.

 

Employees and other persons action on behalf of Total Labour Force will consequently, prior to processing any PI, obtain a specific and informed expression of will from the data subject, in terms of which permission is given for the processing of PI.

 

Informed consent is therefore when the data subject clearly understands for what purpose their PI is needed and who it will be shared with.  Consent can be obtained in written form which includes any appropriate electronic medium that is accurately and readily reducible to print form.

 

Consent to process data subjects PI will be obtained directly from the data subject, except where:

• The PI has been made public; or
• Where valid consent has been given to a third party; or
• The information is necessary for effective law enforcement.

 

Employees and other person’s action on behalf of Total Labour Force will under no circumstances whatsoever:

• Process or have access to PI where such processing or access is not a requirement to perform their respective work-related tasks and duties.
• Save copies of PI directly to their own private computers, laptops or other mobile devices like tablets or smart phones. All PI must be accessed and updated from the organisations central database or a dedicated server.
• Share PI informally. Where access to PI is required, this may be requested from the relevant manager or the head office.
• Transfer of PI outside of South Africa without the express permission from the Information Officer.

 

Employees and other person’s action on behalf of Total Labour Force are responsible for:

• Keeping all PI that they come into contact with secure, by taking sensible precautions and following the guidelines outlined within this policy.
• Ensuring that PI is held in as few places as is necessary. No unnecessary additional records, filing systems and data sets should therefore be created.
• Ensuring that PI is safeguarded and sent in a format that is safe prior to sending or sharing the information electronically and only share the information with authorised external persons.
• Ensuring that all computers, laptops and devices such as tablets, flash drives and smart phones that store PI are password protected and never left unattended. Passwords must be changed regularly and may not be shared with unauthorised persons.
• Ensuring that computer screens and other devices are switched off or locked when not in use or when away from your workstation.
• Ensuring that where PI is stored on removable storage devices such as CD’s or DVD’s that these are kept locked away securely when not in use.
• Ensuring that PI that has been printed out, that the paper printouts are not left unattended where individuals unauthorised could see or copy them.
• Taking reasonable steps to ensure that PI is kept accurate and up to date. For instance, confirming data subjects contact details when in telephonic or electronic communication.  Where a data subject’s information is found to be outdated it must be communicated to the Information Officer for updating accordingly.
• Taking reasonable steps to ensure that PI is stored only for as long as it is needed or required in terms of the intended purpose for which it was originally obtained. Where PI is no longer required, authorisation must first be obtained from the relevant manager or the Information Officer to delete or dispose of the PI in the appropriate manner.
• Undergoing POPIA Awareness training from time to time.

 

Where an employee, or person acting on behalf of action on behalf of Total Labour Force becomes aware or suspicious of any security breach such as the unauthorised access, interference, modification, destruction or the unsanctioned disclosure of PI, they must immediately report this event or suspicion to the Information Officer or Deputy Information Officer.

 

The information Total Labour Force collects

We collect and process your personal information for the purposes of processing your wages, and delivering services accordingly.  For this purpose we will collect contact details including your name and organisation. We collect information directly from you where you provide us with your personal details.  We will inform you what information you are required to provide to us and what information is optional.

 

How we use your information

We will use your personal information only for the purposes for which it was collected and agreed with you.  In addition, where necessary your information may be retained for legal or research purposes.

 

For example:

• To gather contact information;
• To confirm and verify your identity or to verify that your certificates and other information is valid and correct;
• For the detection and prevention of fraud, crime, money laundering or other malpractice;
• To conduct market or customer satisfaction research or for statistical analysis;
• For audit and record keeping purposes;
• In connection with legal proceedings.

 

Disclosure of information

We may disclose your personal information to our clients who are involved in the supply of work for our employees. We have agreements in place to ensure that they comply with the privacy requirements as required by the Protection of Personal Information Act.

 

We may also disclose your information:

• Where we have a duty or a right to disclose in terms of law or industry codes;
• Where we believe it is necessary to protect our rights.

 

POPIA AUDIT

Total Labour Force’s Information Officer will schedule periodic POPIA audits.  The purpose of a POPIA audit is to:

• Identify the processes used to collect, record, store, disseminate and destroy personal information.
• Determine the flow of PI throughout Total Labour Force. For instance Total Labour Force’s various sites and branches and associated organisations.
• Redefine the purposes for gathering and processing PI.
• Ensure that the processing parameters are still adequately limited.
• Ensure that new data subjects are made aware of the processing of their PI.
• Re-establish the rationale for any further processing where information is received via a third party.
• Verify the quality and security of PI.
• Monitor the extent of compliance with POPIA and this policy.
• Monitor the effectiveness of internal controls established to manage the organisations POPI related compliance risk.

 

In per forming the POPIA audit, Information Officers will liaise with managers in order to identify areas within Total Labour Force’s operations that are most vulnerable or susceptible to the unlawful processing of PI.  Information Officers will be permitted direct access to and have demonstrable support from management and the organisations members in performing their duties.

 

REQUEST TO ACCESS PERSONAL INFORMATION

Data subjects have the right to:

• Request what PI the organisation holds about them and why.
• Request access to their PI.
• Be informed how we keep their PI up to date.

 

Access to information requests can be made by email, addressed to the Information Officer.  The Information Officer will provide the data subject with a “Personal Information Request Form”.  Once the completed form has been received, the Information Officer will verify the identity of the data subject prior to handing over any PI.  All requests will be processed and considered against the organisations POPIA Policy.  The Information Officer will process all requests within a reasonable time.

 

POPIA COMPLAINTS PROCEDURE

Data subjects have the right to complain in instances where any of their rights under POPIA have been infringed upon, Total Labour Force takes all complaints very seriously and will address all POPIA related complaints in accordance with the following procedure:

• POPIA complaints must be submitted to the organisation in writing. Where so required, the Information Officer will provide the data subject with a POPIA complaint form.
• Where the complaint has been received by any person other than the Information Officer, that person will ensure that the full details of the complaint reach the Information Officer within 1 working day.
• The Information Officer will provide the complainant with a written acknowledgement of the receipt of the complaint within 2 working days.
• The Information Officer will carefully consider and address the complainant’s concerns in an amicable manner. In considering the complaint, the Information Officer will endeavour to resolve the complaint in a fair manner in accordance with the principles outlined in POPIA.
• The Information Officer must also determine whether the complaint relates to an error or breach of confidentiality that has occurred and which may have a wider impact on the organisations data subjects.
• Where the Information Officer has reason to believe that the PI of the data subject has been accessed or acquired by an unauthorised person, the Information Officer will consult with the organisations top management and thereafter the data subject and the Information Regulator will be informed of this breach.
• The Information Officer will revert to the complainant with a proposed solution with the option of escalating the complaint to the organisations management within 7 working days of receipt of the complaint. In all instances, the organisation will provide reasons for any decisions taken and communicate any anticipated deviation from the specified timelines.

 

The Information Officer’s response to the data subject may comprise any of the following:

• a suggested remedy for the complaint,
• a dismissal of the complaint and the reasons as to why it was dismissed,
• an apology (if applicable) and any disciplinary action that has been taken against any employees involved.

 

Where the data subject is not satisfied with the Information Officers suggested remedies, the data subject has the right to complain to the Information Regulator.

 

The Information Officer will review the complaints process to assess the effectiveness of the procedure on a periodic basis and to improve the procedure where it is found wanting.  The reason for any complaints will also be reviewed to ensure the avoidance of occurrences giving rise to POPIA related complaints.

 

How to contact us

If you have any queries about this policy; you need further information about our privacy practices; exercise preferences or access or correct your personal information, please contact us at the “contactus” format or telephonically and or electronically via any of our email addresses and we will direct your correspondence to the Information Officer.

 

DISCIPLINARY ACTION

Where a POPIA complaint or a POPIA infringement has been finalised, Total Labour Force may recommend any appropriate administrative, legal or disciplinary action to be taken against any employee reasonably suspected of being implicated in any non-compliant activity outlined within this policy.

 

In the case of ignorance or minor negligence, Total Labour Force will undertake to provide further awareness training to the employee.

 

Any gross negligence or the wilful mismanagement of PI, will be considered a serious form of misconduct for which Total Labour Force may dismiss the employee.  Disciplinary procedures will commence where there is sufficient evidence to support an employee’s gross negligence.

 

Examples of immediate actions that may be taken subsequent to an investigation include:

• a recommendation to commence with disciplinary action
• a referral to appropriate law enforcement agencies for criminal investigation
• any form of recoveries in order to limit any prejudice or damages cause

 

LEGISLATIVE FRAMEWORK

Total Labour Force legislative framework consist of company policies and procedures and we follow all provincial; national and industrial laws and procedures and where applicable any international legislation.

 

POPIA FORMS AND DOCUMENTS

SDPO01 Rev0 – Employee Protection of Personal Information POPI Consent Form

SDPO02 Rev0 – POPIA Request Form

SDPO03 Rev0 – POPIA Compliant Form

SDPO04 Rev0 – POPIA SLA Confidentiality Clause

SDPO05 Rev0 – POPIA Employee Consent to Release PI