POPIA – YOU & MIBCO

By now the acronym POPIA, short for the Protection of Personal Information Act 4 of 2013, should be no stranger to you. MISA in conjunction with Johnny Goldberg hosted a webinar on POPIA that was tailor-made for you as MISA member where a number of issues, relating to the processing of your personal information and that of clients, were unpacked.

Another acronym that you should equally be familiar with is MIBCO, which is the Motor Industry Bargaining Council. Most of you are also members of the Motor Industry Provident Fund (MIPF) and your contributions are deducted from your salary and paid over to MIBCO who, in turn, ensure that it is paid over to the Motor Industry Fund Administrators.

Who Are You

In terms of POPIA you are a data subject which means that you are a source of information, which is information limited to you only, by which you can be classified or identified. Personal Information according to POPIA includes information relating to an identifiable, living natural person, which is you!

Look at yourself, what do you see? You see gender, race, ethnic origin, colour, age, sexual orientation, culture and language. This is information specific to you.

What do others see? They see education, employment history, identifying number, e-mail or home address and telephone number to name but a few. Employers might have your biometric, financial or criminal history, information that is personal to the core of who you are.

Processing your Information

Having regard to the above it goes without saying that you should be cognisant of the processing or possible processing of your data, your personal information. That is what POPIA is all about, the protection of your personal information within the parameters of POPIA and other legislation. You must also familiarise yourself with the ‘processor’ or ‘processors’ who might process your information and the purpose of that processing.

‘Processing’ is defined as ‘the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; dissemination by means of transmission, distribution or making available in any other form; or merging, linking, as well as restriction, degradation, erasure or destruction of information.’

This is a mouthful, but the reality is that this is exactly what is done daily, either manually or through an automated system, with the personal information of clients, employees, customers and members to name a few.

POPIA refers to the person(s) or systems that process (potential) personal information as an operator.

‘Operator’ is defined as ‘a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party’.

POPIA further define ‘responsible party’ as ‘a public or private body or any other person which, alone or in conjunction with others, determines the purpose and means for processing personal information.’

Different Relationships:

Your employment in the retail motor industry created a number of relationships between you, the data subject, and other responsible parties and processors. The first relationship is between you and your employer. Your employer processes your personal information in-house for the purposes of registering you on their internal systems such as the payroll and external systems such as SARS, MIBCO and UIF. In this scenario you have to give consent to the processing for specific purposes and means and, important to note, legislation also requires the processing for specific purposes such as SARS.

You have a relationship with MISA, as member, and gave consent when you applied for MISA Membership or when you updated your information with MISA. This consent, again, is for the specific purpose of communication with you as member. When you require legal assistance or claim for a specific MISA Benefit, you give consent for specific purposes when you complete the enquiry form or application form. In fact, POPIA section 30 actually gives MISA the right to process your personal information for the purposes relating to your membership, as long as you actively belong to MISA.

Another relationship exists between your employer and MIBCO where your employer is the responsible party, who determined the purpose for MIBCO, as processor, to process your information on their system. In fact, if you were employed in the retail motor industry prior 1 July 2021, your information is already captured or processed by MIBCO and that includes your registration with the Motor Industry Provident Fund, unless you belong to the employer’s In-House Provident Fund. This relationship between your employer, as responsible party, and MIBCO as processor is created through legislation.

Processing in terms of Legislation

The MIBCO Administrative Agreement (Agreement) in clause 13 provides that employers must deduct certain contributions, such as MIBCO Council Levies, on a monthly basis and pay these deductions over to MIBCO, together with a detailed statement with inter alia your family name, initials, sex, date of birth, occupation, identity number and date of engagement with your employer. The Agreement continues to provide that your employer must deduct union subscriptions, clause 14, and pay this over to MIBCO, again with a detailed statement containing your personal information mentioned above.

The Motor Industry Provident Fund Agreement also provides in clause 5 that every employee joining the Motor Industry Provident Fund, must complete a specific form referred to as Annexure A. All of you who does belong to the Motor Industry Provident Fund should have completed this form already. Taking it a step further, legalities in regard to a pension fund, the administrator is entitled to use the information in terms of the law. Specifically in terms of the Pension Fund Act no 24 of 1956 Section 13A, Regulation 33, processing of your personal information is legally provided for. Bear in mind that POPIA provides in section 3(3)(b) that POPIA ‘…does not prevent any public or private body from exercising or performing its powers, duties and functions in terms of the law…relating to the processing of personal information…’

It is therefore clear that your personal information may be processed with your consent, implied consent (Prior 1 July 2021) and in terms of legislation.

MIBCO’s Annexure B

Now that you know where your information has been captured and what the purposes are and whether it was done via consent of legislation, I need to clarify one last aspect. MIBCO sent out a circular with an Annexure B and advised that ‘Annexure B is to record employee consent for MIBCO to process their information. Further communication on Annexure B will follow where such information should be recorded.’

The circular implies that all employees employed in the retail motor industry is obligated to complete this Annexure B. In my opinion, Annexure B is overkill and there should be no obligation on you to complete Annexure B. In fact, Annexure B is very vague in terms of what exactly the purpose is for requesting this information (again) as it stipulates ‘By signing these registration forms you give consent to us to use your personal information in a certain way.’

In terms of MIBCO’s Annexure B, point 3 and 4, a further rationale in requesting you to complete Annexure B is ‘…Where necessary for the performance of a contract to which we are a party, or to take steps at your request via enforcement processes; or, to take steps where there were non-compliance. Where it is your or someone else’s vital interest (in case of emergency and your Family member as authorised in writing needs to act on your behalf)…’  This is not purpose specific, in fact, it is very wide and too generic and again refers to aspects covered by legislation, namely enforcement processes.

Conclusion

Certain public bodies (such as MIBCO) and private bodies (such as MISA), does have your personal information through your consent and through legislation. There is no need for you to sign Annexure B as required by MIBCO as the rationale explained throughout this document is vague, generic and a repeat of what is already obligatory through legislation.

Know your rights and stay alert!

MISA is only a phone call or an e-mail away!

Kindly utilise the following e-mail addresses and links for assistance during this time: 

Legal/Labour-related enquiries                      Legal@ms.org.za  

Legal Reception                                                011 476 3920

MISA Benefit claim-related enquiries            Claims@misa.org.za   

Any other enquiries                                          Info@ms.org.za  

Website                                                              www.misa.org.za    

Mobile App                                                        https://onelink.to/w9a7ku