There is no better way to introduce our book, Over-Thinking the Protection of Personal Information Act: The Last POPIA Book You Will Ever Need, than by reciting the Dunning-Kruger* prayer: ‘Let me be smart enough to know how dumb I am and give me the courage to carry on anyway.’ No, we are not calling the readers stupid; we are referring to our own stupidity when it comes to POPIA. Writing this book was hard for a few reasons.
POPIA IS NEW
So, this book is full of some (educated) guesses. It is important to acknowledge that. When we were guessing, we marked it as a ‘tricky area’. In the words of co-author Jessica Boast, ‘If I had a nickel for every tricky area…’
POPIA IS OLD
The research that underpinned the first draft was published in 2005 and POPIA was enacted in 2013. Researching this book was a bit like an archaeological dig to determine what the drafters were thinking back then. That is why you will see us referring to repealed data protection legislation from time to time.
POPIA IS COMPLEX
POPIA is comprised of a list of different principles that are linked in the most complicated way. Studying these principles as separate topics leads to confusion and some very bad advice. Hence, the book is not structured around the eight principles of the lawful processing of personal information. Instead, we have the following chapters:
- POPIA’s place in the grand scheme of governance
- The purpose and interpretation of POPIA
- The application and scope of POPIA
- Who is held accountable for POPIA compliance
- Information security management
- Processing must be for a lawful purpose
- Special personal information and children’s personal information
- When the Information Regulator must be approached for prior authorisation
- The principles of minimal processing and information quality
- Collecting and creating personal information
- Notifying data subjects
- Further processing of personal information (secondary use)
- Sharing personal information between organisations
- Transborder information flows
- Profiling and automated decision-making
- Direct marketing
- Records management
- Data subject rights
- Enforcement of POPIA
- How to implement a POPIA programme
POPIA IS OVERWHELMING
We are campaigning to have ‘POPIA paralysis’ and ‘POPIA fatigue’ recognised as syndromes in the DSM-6. In order to combat the almost inevitable paralysis, we also included ‘key points’. These nuggets are the things that are (a) most important to understand and (b) most commonly misunderstood.
POPIA CAN SUCK THE JOY OUT OF LIFE
To combat the tedium, we drew inspiration from our favourite people, books, movies and musicians. We did not do this (only) to be funny. Receiving information when you are in a good mood, or even when you have a pencil stuck crosswise in your mouth to make you “smile”, also induces cognitive ease. We tried to apply this principle from cover to cover.
You might have figured out that none of the fictional characters on the front cover (or inside it) actually said any of the quotes we ascribe to them in the context of a POPIA book. This is their fault of course, because if they knew how gripping data protection could be, we are sure they would have.
We hope that you have fun reading this book, but if you don’t, we think that Justice Sachs said it best: ‘The Constitution cannot oblige the dour to laugh. It can, however, prevent the cheerless from snuffing out the laughter of the blithe spirits among us’.
DOWNLOAD THE FREE CHAPTER ON DIRECT MARKETING
*The Dunning-Kruger effect is a cognitive bias explained as follows by John Cleese: ‘You see, if you’re very, very stupid, how can you possibly realise that you’re very, very stupid? You’d have to be relatively intelligent to realise how stupid you are. … [Knowing] how good you are at something requires exactly the same skills as it does to be good at that thing in the first place. Which means – and this is terribly funny – that if you’re absolutely no good at something at all, then you lack exactly the skills that you need to know that you’re absolutely no good at it.’