Course overview

This course explores high-risk data processing activities under South Africa’s Protection of Personal Information Act (POPIA), emphasizing the profound implications for data subjects’ rights. Drawing from detailed guidance on POPIA’s framework, particularly Section 19 on security safeguards, the course systematically examines 15 distinct categories of high-risk processing. Participants will gain insights into the ethical, legal, and practical challenges of handling personal information, focusing on balancing technological innovation with individual privacy. Through real-world scenarios and case studies, this course equips learners to identify risks, implement safeguards, and foster a culture of responsible data governance in an increasingly digital environment.

Course objectives

Participants will obtain an understanding of :

1. Understand POPIA’s High-Risk Framework: Articulate how POPIA (Section 19) addresses high-risk data processing, including assessments of technology, costs, nature, scope, purpose, probability, and severity of risks.
2. Identify High-Risk Activities: Recognize and analyze 15 categories of high-risk processing, such as automated decision-making, systematic monitoring, and biometric data collection.
3. Assess Impacts on Data Subjects: Evaluate the potential harms to individual rights, including discrimination, loss of autonomy, psychological distress, and physical danger.
4. Apply Compliance Strategies: Implement security safeguards, privacy-by-design principles, and risk mitigation measures to protect vulnerable groups and ensure ethical data handling.
5. Exercise Data Subject Rights: Navigate POPIA’s provisions for transparency, consent, access, rectification, and objection in high-risk scenarios.
6. Promote Ethical Data Practices: Foster organizational cultures that prioritize data subject rights, balancing innovation with privacy in South Africa’s regulatory landscape.

Course outline

Participants will learn about:

Module 1: Introduction to POPIA and High-Risk Processing

POPIA Overview: Explore POPIA’s role in upholding constitutional privacy rights (Section 14) and focusing on security safeguards (Section 19).

High-Risk Assessment Framework: Understand evaluations based on technology state-of-the-art, implementation costs, processing nature/scope/purpose, risk probability, and severity.

Ethical Implications: Discuss the human impact of data processing beyond compliance, emphasizing individual autonomy and fairness.

Module 2: Core High-Risk Categories

Automated Decision-Making: Analyze risks of bias, lack of transparency, and unfair outcomes (e.g., loan denials).

Systematic Monitoring of Public Areas: Examine chilling effects on freedoms of expression and assembly via CCTV and facial recognition.

Processing Sensitive/Highly Personal Data: Discuss discrimination, identity theft, and harm from health, religious, or criminal data.

Innovative Technological/Organizational Solutions: Address unknowns in AI, blockchain, or novel data-sharing methods, advocating privacy-by-design.

Denial of Service: Explore disruptions to rights, services, or contracts due to outages or breaches.

Systematic Evaluation/Scoring: Evaluate biases in credit scoring or employee assessments leading to discrimination.

Matching/Combining Datasets: Identify re-identification risks and erroneous inferences from aggregated data.

Invisible Processing: Highlight lack of transparency in third-party data collection or inferred profiling.

Targeting Vulnerable Groups: Focus on protections for children and others in marketing, profiling, or online services.

Risk of Physical Harm: Assess dangers from location data breaches enabling stalking or incorrect medical decisions.

Module 3: Advanced High-Risk Categories

Profiling for Predictive Purposes: Examine autonomy erosion from behavioral predictions in marketing or law enforcement.

Data Matching Techniques: Differentiate deterministic and probabilistic matching, addressing false positives/negatives.

Biometric Data Collection: Discuss immutability and lifetime risks of fingerprints or facial scans.

Genetic Data Processing: Analyze familial implications, discrimination, and unknown future uses.

Invisible Processing Revisited: Deepen understanding of hidden data flows and consent challenges.

Module 4: Practical Compliance and Ethical Considerations

Risk Mitigation Strategies: Implement encryption, access controls, audits, and disaster recovery.

Data Subject Rights in High-Risk Contexts: Exercise access, rectification, objection, and consent under Section 5.

Organizational Responsibilities: Embed ethical data governance, privacy impact assessments, and continuous monitoring.

Case Studies: Analyze South African scenarios, such as breaches involving health data or automated rejections.

Module 5: Building a Privacy-Centric Culture

Proactive Risk Assessment: Integrate ongoing evaluations into operations.

Balancing Innovation and Rights: Ensure technological progress respects human dignity.

Reflection and Application: Consider personal digital interactions and organizational practices.