In a world flooded with data, how safe is your personal information?

THE corporate world is flooded with data on consumers.

- MARTIN HESSE

Much of this data is tied to you personally — how much you spend, what you spend your money on, your lines of credit, and how you are managing your debt — and the law requires your consent for such information to be gathered and used.

But there’s also a mountain of de-personalised data out there, which is used to assess market trends and financial risks among different demographic groups.

Banks, credit bureaus, insurance companies, large retailers, market research companies — all have access to this wealth of information to some extent. So are they using this data responsibly and is your privacy being sufficiently recognised and protected?

A few weeks ago, I attended the Second Africa Credit and Risk Reporting Conference hosted by the South African Credit and Risk Reporting Association and the Credit Information Sharing Association of Kenya, which provided fascinating insights into the world of consumer-related data as used by the credit industry to assess risk, but also into how it is treated more generally in the corporate space.

The Protection of Personal Information (Popi) Act, enacted in 2013 and in full effect since July 2020, sets conditions for the lawful collection, processing, storage, and sharing of your personal information by public and private organisations.

It distinguishes between:

@ The data subject, to whom the data refers;

@ The responsible party: the organisation that acquires the information for a certain purpose and determines

@ The operator: a company, such as an IT vendor, which processes the information on behalf of the responsible party.

The Act places the obligation to protect personal information on the responsible party, including where it is processed by operators and passed on to other third parties.

‘Great responsibility’