IoT and farming

Examples of IoT farming devices and equipment include autonomous tractors, drones, robots, and remote sensors. These IoT devices can gather large amounts of information ranging from soil moisture, chemical application, dam levels and livestock health to data relating to the monitoring of fences, vehicles and weather. The advent of IoT in farming means that a farmer’s ‘gut instinct’ can be backed up with validated data points to support decision making, which can eliminate significant risks relating to farming operations and the viability of a yield.

All upsides have downsides (potentially)

A particular risk to be aware of is where IoT service providers are based in a foreign country that does not have adequate data protection laws in place. Such an instance may see a service provider use the data gathered by these IoT devices for purposes unknown to the farmer, including even potentially selling the data for economic gain.

This is precisely why the Protection of Personal Information Act 4 of 2013 (POPIA) was created. Any person (both natural and juristic) whose personal information is processed within the borders of South Africa enjoys the protections afforded by POPIA. Where a service provider sells an IoT device to a farmer who uses the device within South Africa, the service provider must comply with the provisions of POPIA.

The IoT service provider will be considered a “responsible party” in terms of POPIA and must ensure that any processing of personal information is done in accordance with the prescripts of POPIA including by adhering to the concept of “minimality” (section 10 of POPIA), which requires personal information to only be processed if the purpose for which it is processed is adequate, relevant and not excessive. Furthermore, cross-border data transfers are also required to be carried out in compliance with POPIA. The best way in which to manage data-related risks is to assess the service provider’s IoT service terms of use and privacy policy. These documents should illustrate the service provider’s processing activities in a transparent and informative way.

What if I have consented already?

Fear not, POPIA once again has a remedy for a person who would like to withdraw their consent. Section 11(2)(b) of POPIA affords a data subject (end-user) the ability to withdraw their consent at any time. Furthermore, POPIA also extends a right to a data subject that allows them to request the deletion of their personal information (section 24(1)). The IoT service provider that does not allow a data subject the ability to exercise their rights under POPIA can be reported to the Information Regulator by following the prescribed complaints procedure (i.e. by completing the prescribed POPIA Form 5 available on its website and sending it to the designated email address (POPIAComplaints@inforegulator.org.za)). Responsible parties who don’t comply with POPIA may be liable for administrative penalties and may be subject to criminal sanction if they commit an offence in terms of the Act.

Conclusion

Both farmers and IoT service providers should be aware of their rights and duties under POPIA. It is now more important than ever to be mindful of how data is processed and what it is being used for – particularly in the new economy strongly driven by data.