South Africans are increasingly at risk of falling victim to identity theft, fraud and other forms of cyber crime – as was the case in October last year, when the largest data breach of private citizens in South Africa\u2019s history saw the personal data of over 30 million people leaked online.<\/p>\n
According to\u00a0Fatima Ameer-Mia, senior associate at Cliffe Dekker Hofmeyr,\u00a0there is currently no legislation in force which compels a business to disclose such data breaches to its information security.<\/p>\n
\u201cAcross the world, data is a very valuable resource and the commercialisation and monetisation of data is therefore big business,” she said.<\/p>\n
“Businesses in South Africa, however, tend to have particularly poor information security practices in place, which puts them at greater risk to opportunistic cyber criminals,” Ameer-Mia said.<\/p>\n
The legal expert said that under current\u00a0South African law, legal recourse against cybercrime is fairly limited.<\/p>\n
\u201cThe only circumstances under which compensation may be payable is if an individual is able to prove monetary loss and causality (ie the breach caused you to lose money)<\/strong>\u00a0and succeeds with a delictual claim, whereby they claim for damages from the individual or organisation who caused the data breach.<\/p>\n “In this case, however, the claimant will have to go to court, which is usually a complicated and costly exercise,” she said.<\/p>\n A delictual claim is awarded when a person receives monetary compensation for losses suffered. For a delictual claim to succeed, the person making the claim (the claimant) or attorney must prove that:<\/p>\n Changes<\/strong><\/p>\n While South Africans are still restricted in their rights following a data breach, this is\u00a0expected to change when the Protection of Personal Information Act (“POPI”) comes into force, said\u00a0Ameer-Mia.<\/p>\n \u201cThe notification of data breaches in South Africa is governed by POPI, and while POPI has been promulgated, its substantive sections are not yet in effect.”<\/p>\n \u201cOnly once these substantive sections become legally binding, do we expect to see businesses change their approach to the protection of customer and employee data, as this will mean that an organisation which is involved in a data breach situation may be subject to an administrative fine, penalty or sanction,\u201d Ameer-Mia explained.<\/p>\n \u201cFurthermore, POPI will provide remedies and a complaint channel for those compromised by the unlawful processing of personal information,\u201d she added.<\/p>\n However she said that she was hopeful that the\u00a0recent data breach will provide the impetus for government to take positive action with regards to implementing the legislative and regulatory framework around data protection and cybersecurity.<\/p>\n \u201cIn the long run, implementing a regulatory framework which protects citizens and allows for healthy economic development will benefit all parties \u2013 consumers, businesses and the government alike,” she said.<\/p>\n\n
\n
\n