Popia Compliance for Access Control Systems: What You Need to Know
With the rise of gated communities and secure office parks, access control systems using driver’s license scans have become increasingly common. However, the Information Regulator, under the leadership of Advocate Pansy Tlakula, has raised concerns about potential violations of the Protection of Personal Information Act (Popia) in this area.
Tlakula believes that some estates and office parks collect too much personal information through these systems. “When you go into gated communities and office parks, they scan your licence disc, which contains a lot of personal information,” she said in a recent interview with radio station 702. “They scan your driver’s license, and some even take your photo.”
Popia’s Guidelines for Data Collection
Popia allows for the collection of minimal personal information only when there is a specific purpose, such as security. According to Tlakula, for gated communities, the driver’s name, vehicle registration number, and car color should be sufficient.
The Information Regulator is currently focusing on developing a code of conduct for personal data collection in the surveillance sector, following its work on the direct marketing sector.
Balancing Security and Privacy
One leading access management system provider, ATG Digital, emphasizes that its system complies with Popia. They argue that digital systems are more secure than traditional methods of visitor registration, where information was often handwritten in vulnerable books.
“Visitor registration is allowed,” explains Ariel Flax, ATG Digital’s sales head. “However, often the visitors’ information is handwritten in a book that’s vulnerable to prying eyes—and therein lies the problem.”
Flax points out that Popia doesn’t prohibit data collection but sets strict rules on what information can be collected, why, how it is stored, and if shared, with whom and why. He stresses that individuals must be informed about these practices before sharing their information.
ATG Digital’s Popia-Compliant Features
ATG Digital takes several steps to ensure compliance with Popia:
- Minimal Data Collection: The system is designed to collect only the essential information necessary for security purposes.
- De-identification: Unnecessary information from driver and vehicle licenses is redacted.
- Secure Storage: Data is encrypted and stored in a secure cloud-based system.
- Access Control: Access to data is restricted to authorized personnel.
- Data Retention: Data is deleted after a predefined period.
- Employee Training: All staff are trained in information security and confidentiality.
- Transparency: Signage and notices inform individuals about data collection practices.
Protecting Your Privacy
Understanding your rights under Popia and ensuring the systems you interact with comply with these regulations is crucial. When visiting gated communities or office parks, be aware of what information is being collected and how it is being used.
For more information about Popia and your rights, visit the Information Regulator’s website: https://www.justice.gov.za/inforeg
Related reading