Chapter 11

Obstruction of Regulator

Any person who hinders, obstructs or unlawfully influences the Regulator or any person acting on behalf of or under the direction of the Regulator in the performance of the Regulator’s duties and functions under this Act, is guilty of an offence.

Breach of confidentiality

Any person who contravenes the provisions of section 54, is guilty of an offence.

Obstruction of execution of warrant

Any person who—intentionally obstructs a person in the execution of a warrant issued under section 82; or
fails without reasonable excuse to give any person executing such a warrant such assistance as he or she may reasonably require for the execution of the warrant,
is guilty of an offence.

section 103

Failure to comply with enforcement or information notices

A responsible party which fails to comply with an enforcement notice served in terms of section 95, is guilty of an offence.
A responsible party which, in purported compliance with an information notice served in terms of section 90—makes a statement knowing it to be false; or
recklessly makes a statement which is false, in a material respect,

is guilty of an offence.

section 104

Offences by witnesses

Any person summoned in terms of section 81 to attend and give evidence or to produce any book, document or object before the Regulator who, without sufficient cause fails—to attend at the time and place specified in the summons;
to remain in attendance until conclusion of the proceedings or until he or she is excused by the Chairperson of the Regulator from further attendance;
having attended, refuses to be sworn or to make an affirmation as witness after he or she has been required by the Chairperson of the Regulator to do so;
having been sworn or having made an affirmation, to answer fully and satisfactorily any question lawfully put to him or her; or
to produce any book, document or object in his or her possession or custody or under his or her control, which he or she has been summoned to produce,
is guilty of an offence.

Any person who after having been sworn or having made an affirmation, gives false evidence before the Regulator on any matter, knowing such evidence to be false or not knowing or believing it to be true, is guilty of an offence.

section 105

Unlawful acts by responsible party in connection with account number

A responsible party who contravenes the provisions of section 8 insofar as those provisions relate to the processing of an account number of a data subject is, subject to subsections (2) and (3), guilty of an offence.
The contravention referred to in subsection (1) must—be of a serious or persistent nature; and
likely cause substantial damage or distress to the data subject.

The responsible party must—have known or ought to have known that—there was a risk that the contravention would occur; or
such contravention would likely cause substantial damage or distress to the data subject; and

have failed to take reasonable steps to prevent the contravention.

Whenever a responsible party is charged with an offence under subsection (1), it is a valid defence to such a charge to contend that he or she has taken all reasonable steps to comply with the provisions of section 8.
‘Account number’’, for purposes of this section and section 106, means any unique identifier that has been assigned— to one data subject only; or
jointly to more than one data subject,
by a financial or other institution which enables the data subject, referred to in paragraph (a), to access his, her or its own funds or to access credit facilities or which enables a data subject, referred to in paragraph (b), to access joint funds or to access joint credit facilities.

Section 106

Unlawful acts by third parties in connection with account number

A person who knowingly or recklessly, without the consent of the responsible party—obtains or discloses an account number of a data subject; or
procures the disclosure of an account number of a data subject to another person,
is, subject to subsection (2), guilty of an offence.

Whenever a person is charged with an offence under subsection (1), it is a valid defence to such a charge to contend that—the obtaining, disclosure or procuring of the account number was—necessary for the purpose of the prevention, detection, investigation or proof of an offence; or
required or authorised in terms of the law or in terms of a court order;

he or she acted in the reasonable belief that he or she was legally entitled to obtain or disclose the account number or, as the case may be, to procure the disclosure of the account number to the other person;
he or she acted in the reasonable belief that he or she would have had the consent of the responsible party if the responsible party had known of the obtaining, disclosing or procuring and the circumstances of it; or
in the particular circumstances the obtaining, disclosing or procuring was in the public interest.

A person who sells an account number which he or she has obtained in contravention of subsection (1), is guilty of an offence.
A person who offers to sell the account number of a data subject which that person—has obtained; or
subsequently obtained,
in contravention of subsection (1), is guilty of an offence.

For the purposes of subsection (4), an advertisement indicating that an account number of a data subject is or may be for sale is an offer to sell the information.

Section 107

Penalties

Any person convicted of an offence in terms of this Act, is liable, in the case of a contravention of—section 100, 103(1), 104(2), 105(1), 106(1), (3) or (4) to a fine or to imprisonment for a period not exceeding 10 years, or to both a fine and such imprisonment; or
section 59, 101, 102, 103(2) or 104(1), to a fine or to imprisonment for a period not exceeding 12 months, or to both a fine and such imprisonment.

Section 108

Magistrate’s Court jurisdiction to impose penalties

Despite anything to the contrary contained in any other law, a Magistrate’s Court has jurisdiction to impose any penalty provided for in section 107.

Section 109

Administrative fines

If a responsible party is alleged to have committed an offence in terms of this Act, the Regulator may cause to be delivered by hand to that person (hereinafter referred to as the infringer) an infringement notice which must contain the particulars contemplated in subsection (2).
A notice referred to in subsection (1) must—specify the name and address of the infringer;
specify the particulars of the alleged offence;
specify the amount of the administrative fine payable, which amount may, subject to subsection (10), not exceed R10 million;
inform the infringer that, not later than 30 days after the date of service of the infringement notice, the infringer may—pay the administrative fine;
make arrangements with the Regulator to pay the administrative fine in instalments; or
elect to be tried in court on a charge of having committed the alleged offence referred to in terms of this Act; and
state that a failure to comply with the requirements of the notice within the time permitted, will result in the administrative fine becoming recoverable as contemplated in subsection (5).
When determining an appropriate fine, the Regulator must consider the following factors:the nature of the personal information involved;
the duration and extent of the contravention;
the number of data subjects affected or potentially affected by the contravention;
whether or not the contravention raises an issue of public importance;
the likelihood of substantial damage or distress, including injury to feelings or anxiety suffered by data subjects;
whether the responsible party or a third party could have prevented the contravention from occurring;
any failure to carry out a risk assessment or a failure to operate
good policies, procedures and practices to protect personal information; and
whether the responsible party has previously committed an offence in terms of this Act.
If an infringer elects to be tried in court on a charge of having committed the alleged offence in terms of this Act, the Regulator must hand the matter over to the South African Police Service and inform the infringer accordingly.
If an infringer fails to comply with the requirements of a notice, the Regulator may file with the clerk or registrar of any competent court a statement certified by it as correct, setting forth the amount of the administrative fine payable by the infringer, and such statement thereupon has all the effects of a civil judgment lawfully given in that court in favour of the Regulator for a liquid debt in the amount specified in the statement.
The Regulator may not impose an administrative fine contemplated in this section if the responsible party concerned has been charged with an offence in terms of this Act in respect of the same set of facts.
No prosecution may be instituted against a responsible party if the responsible party concerned has paid an administrative fine in terms of this section in respect of the same set of facts.
An administrative fine imposed in terms of this section does not constitute a previous conviction as contemplated in Chapter 27 of the Criminal Procedure Act, 1977 (Act No. 51 of 1977).
A fine payable in terms of this section must be paid into the National Revenue Fund referred to in section 213 of the Constitution.
The Minister may, from time to time and after consultation with the Regulator, by notice in the Gazette, adjust the amount referred to in subsection (2)(c) in accordance with the average of the consumer price index, as published from time to time in the Gazette, for the immediately preceding period of 12 months multiplied by the number of years that the amount referred to in subsection (2)(c) has remained the same.

Chapter 11 Offences, Penalties and Administrative Fines