Objection and withdrawal of consent in the age of information

In terms of POPI where a person (a data subject) consents to his or her personal information being processed, the information may be processed lawfully in the manner prescribed by POPI. This seems relatively straightforward.

However, a person may withdraw his or her consent at any time. Furthermore, in terms of POPI, where a person reasonably objects to their information being processed, the information may not be processed, unless legislation provides otherwise. POPI distinguishes between the consequences of a person’s “withdrawal of consent” and his or her “objection to” the processing of personal information.

Withdrawal of consent

Although Section 11 of POPI allows for the withdrawal of consent it does not set out how the withdrawal must take place. There is little in the way of local precedent in respect of POPI. It is likely that the Information Regulator will look to other jurisdictions, such as the European Union for guidance. The European Union’s General Data Protection Regulation 2016/679 (GDPR), provides that in respect of the withdrawal of consent “it shall be as easy to withdraw as to give consent”. Accordingly, verbal consent can be withdrawn verbally, and where written consent involved no more than the ticking of a box, a person should simply be able to untick the relevant box to withdraw consent.

In the employment context the withdrawal of consent by an employee may however impede an employer’s ability to carry out legitimate functions which require the processing of an employee’s personal information. In terms of section 11(2)(b) of POPI the withdrawal of consent does not affect the lawfulness of the processing of personal information before the withdrawal. It also does not affect the processing of personal information:

• necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party;
• that complies with an obligation imposed by law on the responsible party;
• that protects a legitimate interest of the data subject;
• necessary for the proper performance of a public law duty by a public body; or
• necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.

Objection to processing

An employee may also object to the processing of his or her information. The requirements for objections to processing are however more stringent than when an employee withdraws consent. The objection has to be on reasonable grounds and communicated in a prescribed manner, through Form 1 of the Regulations to POPI. The objection does not apply to processing that is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party or where it complies with an obligation imposed by law on the responsible party. An employee may however object to processing where it may protect a legitimate interest of the data subject, be necessary for the proper performance of a public law duty by a public body, or for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.

It will be up to the Information Regulator to determine what constitutes “reasonable grounds”. However, the employee would have to show that the processing undermines his or her right to privacy and that the right to privacy outweighs any right that the employer might have in respect of the information.

Once an employee objects to the processing of this information, an employer may no longer process the information.

Conclusion

Employees should be aware that a withdrawal of consent, or an objection to the processing of private information does not constitute a blanket withdrawal. An employer may still process certain personal information where it is necessary to pursue a lawful and legitimate purpose as described above.

In certain instances the Information Regulator may be called upon to determine what constitutes a reasonable ground for an objection to the processing of private information, and will need to balance the employee’s constitutional right to privacy with the right of the processor (the employer).