Real Estate Agencies and POPIA
The day-to-day activities of a typical real estate agency are centred around the facilitation of the selling and/or leasing of properties in terms of the agency’s mandate with the relevant seller or landlord/buyer. Ordinarily, such activities involve the collection and exchange of documents, emails and others forms of communication which identify the parties to the relevant transactions. For example, bond originators must obtain information from buyers in order to negotiate a bond with the relevant bank on the buyer’s behalf. Real estate agencies come into contact with personal information by the mere fact that these documents and communication methods identify the parties to which they relate.
The simple act of coming into contact, collecting or transferring these documents ultimately means the real estate agency processes the personal information contained therein. A real estate agency will likely act as a ‘responsible party’ in terms of POPIA and is required to protect the rights of its clients (i.e. sellers and landlords), buyers, tenants, bond originators, conveyancers, banks, building societies, suppliers, and employees when processing their personal information. A responsible party determines the purpose of and means for processing personal information. The toolkit is particularly designed to ensure that any processing activity is ultimately lawful and compliant with the eight conditions for processing espoused in Chapter 3 of POPIA.
Aspects of POPIA the Toolkit will Assist with
The toolkit provides real estate agencies with practical and grounded guidance, assisting them in understanding the more complex nuances of POPIA. A few examples of these complexities are the provisions in POPIA related to ‘special personal information’, ‘prior authorisation’, ‘record retention and destruction’ and ‘information officer registration and designation’.
Special personal information relates to religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information. Also included in this category is information relating to the alleged commission of any offence or any proceedings in respect of any offence allegedly committed and the outcome of such proceedings. The toolkit will assist real estate agencies to identify where special personal information is found within their business, while also outlining the practical implications of processing such information.
POPIA specifically mentions certain processing activities that would oblige a real estate agency to submit an application to the Information Regulator for prior authorisation. The activities are extensively covered in Section 57 of POPIA, but would be relevant to a real estate agency when it, for example, conducts a transfer of special personal information from South Africa to a third party in a foreign country, where that country does not provide an adequate level of protection for the processing of personal information as compared to POPIA.
Furthermore, as part of the conditions for lawful processing, it is important that records of a data subject’s personal information are not retained for any longer than is necessary in achieving the purpose for which the information was collected or processed in the first place. The reality is that many organisations either do not categorise records that are retained or fail to identify who is responsible for ensuring that the retained records are appropriately safeguarded. The result is that different versions of the same record may exist, be held by different persons or be subject to differing security safeguards. Therefore, records retention demands careful consideration and the toolkit will assist real estate agencies to better implement policies in this regard.
With regard to information officers, every public and private body will have a de-facto Information Officer as per the provisions of the Promotion of Access to Information Act of 2000 (“PAIA“). However, the advent of POPIA has now expanded the role of information officers, meaning the role of an Information Officer within an organisation is now not only governed by the provisions of PAIA, but also by POPIA. The aspects surrounding the registration, designation, delegation and appointment of information officers and deputy information officers are outlined in the toolkit. The respective duties of the information officer and deputy information officer are also clearly articulated in the toolkit so that the designated information officer in a real estate agency can identify his/her/their respective duties and undertakings.
Conclusion
CDH has meticulously prepared the real estate agency toolkit with a focus on the practical issues associated with POPIA compliance. We would recommend that any real estate agency utilise the toolkit as a starting point for any POPIA compliance endeavours. Given that the end of the grace period for POPIA compliance is less than 40 days away, we would encourage all organisations to commence their compliance initiatives as soon as possible.
Real Estate Agencies and POPIA
The day-to-day activities of a typical real estate agency are centred around the facilitation of the selling and/or leasing of properties in terms of the agency’s mandate with the relevant seller or landlord/buyer. Ordinarily, such activities involve the collection and exchange of documents, emails and others forms of communication which identify the parties to the relevant transactions. For example, bond originators must obtain information from buyers in order to negotiate a bond with the relevant bank on the buyer’s behalf. Real estate agencies come into contact with personal information by the mere fact that these documents and communication methods identify the parties to which they relate.
The simple act of coming into contact, collecting or transferring these documents ultimately means the real estate agency processes the personal information contained therein. A real estate agency will likely act as a ‘responsible party’ in terms of POPIA and is required to protect the rights of its clients (i.e. sellers and landlords), buyers, tenants, bond originators, conveyancers, banks, building societies, suppliers, and employees when processing their personal information. A responsible party determines the purpose of and means for processing personal information. The toolkit is particularly designed to ensure that any processing activity is ultimately lawful and compliant with the eight conditions for processing espoused in Chapter 3 of POPIA.
Aspects of POPIA the Toolkit will Assist with
The toolkit provides real estate agencies with practical and grounded guidance, assisting them in understanding the more complex nuances of POPIA. A few examples of these complexities are the provisions in POPIA related to ‘special personal information’, ‘prior authorisation’, ‘record retention and destruction’ and ‘information officer registration and designation’.
Special personal information relates to religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information. Also included in this category is information relating to the alleged commission of any offence or any proceedings in respect of any offence allegedly committed and the outcome of such proceedings. The toolkit will assist real estate agencies to identify where special personal information is found within their business, while also outlining the practical implications of processing such information.
POPIA specifically mentions certain processing activities that would oblige a real estate agency to submit an application to the Information Regulator for prior authorisation. The activities are extensively covered in Section 57 of POPIA, but would be relevant to a real estate agency when it, for example, conducts a transfer of special personal information from South Africa to a third party in a foreign country, where that country does not provide an adequate level of protection for the processing of personal information as compared to POPIA.
Furthermore, as part of the conditions for lawful processing, it is important that records of a data subject’s personal information are not retained for any longer than is necessary in achieving the purpose for which the information was collected or processed in the first place. The reality is that many organisations either do not categorise records that are retained or fail to identify who is responsible for ensuring that the retained records are appropriately safeguarded. The result is that different versions of the same record may exist, be held by different persons or be subject to differing security safeguards. Therefore, records retention demands careful consideration and the toolkit will assist real estate agencies to better implement policies in this regard.
With regard to information officers, every public and private body will have a de-facto Information Officer as per the provisions of the Promotion of Access to Information Act of 2000 (“PAIA“). However, the advent of POPIA has now expanded the role of information officers, meaning the role of an Information Officer within an organisation is now not only governed by the provisions of PAIA, but also by POPIA. The aspects surrounding the registration, designation, delegation and appointment of information officers and deputy information officers are outlined in the toolkit. The respective duties of the information officer and deputy information officer are also clearly articulated in the toolkit so that the designated information officer in a real estate agency can identify his/her/their respective duties and undertakings.
Conclusion
CDH has meticulously prepared the real estate agency toolkit with a focus on the practical issues associated with POPIA compliance. We would recommend that any real estate agency utilise the toolkit as a starting point for any POPIA compliance endeavours. Given that the end of the grace period for POPIA compliance is less than 40 days away, we would encourage all organisations to commence their compliance initiatives as soon as possible.
