PAIA Manual
The Promotion of Access to Information Manual (“Manual”) for Converge Solutions Proprietary Limited, registration number 2017/541163/07 (“CONVERGE”). Published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 and in terms of the Protection of Personal Information Act 4 of 2013.
1. Introduction
The Promotion of Access to Information Act of 2000 (“PAIA”) was enacted with the purpose of addressing section 32(1) of the Constitution of the Republic of South Africa (“Constitution”), which provides that any person has a right to gain access to any information held by a public or private body. If the record is requested from a private body, the requestor needs to prove that the record is required for the exercise or protection of a right. clause headings are for convenience and are not to be used in its interpretation.
The Protection of Personal Information Act 4 of 2013 (“POPIA”) was enacted to give effect to -
the constitutional right to privacy, by safeguarding personal information when processed by a responsible party, subject to justifiable limitations that are aimed at: (i) balancing the right to privacy against other rights, particularly the right of access to information; and (ii) protecting important interests, including the free flow of information within the Republic of South Africa and across international borders;
regulate the manner in which personal information may be processed, by establishing conditions, in harmony with international standards, that prescribe the minimum threshold requirements for the lawful processing of personal information;
provide persons with rights and remedies to protect their personal information from processing that is not in accordance with POPIA; and
and establish voluntary and compulsory measures, including the establishment of an Information Regulator, to ensure respect for and to promote, enforce and fulfil the rights protected by POPIA.
One of the main requirements specified in PAIA is the compilation of a manual that provides information on both the types and categories of records held by a public or private body. In terms of PAIA, a private body includes any former or existing juristic person.
Insofar as POPIA is concerned, PAIA requires the manual to detail: (i) the purpose of processing of personal information; (ii) a description of the categories of data subjects and of the information or categories of information relating thereto; (iii) the recipients or categories of recipients to whom the personal information may be supplied; (iv) any planned transborder flows of information; and (v) a general description allowing a preliminary assessment of the suitability of the information security measures to be implemented by the responsible party to ensure the confidentiality, integrity and availability of the information which is to be processed.
This Information Manual (“Manual”) provides an outline of the type of records held by and the processing of personal information performed by CONVERGE and details the process for requesting access to these records under PAIA.
This document serves as the Manual for CONVERGE in terms of PAIA, to provide a reference as to the processing activities, the records held and the process that needs to be followed to request access to such records
2. Administration of PAIA
Section 51 (1)(a) of PAIA
The details of the contact person who will deal with all requests made in terms of PAIA and who will act, as the information officer for the purposes of POPIA relating to CONVERGE is as follows:
Information Officer
- Name
- Kobus van der Merwe
- Physical Address
- 5 Rodger street, Durbanville, Cape Town 7550, South Africa.
- Phone number
- +27 (0) 82 413 5617
- Email address
- kobus.vandermerwe@converge-solutions.com
3. Guide on how to use PAIA
The Information Regulator has in terms of section 10(1) of PAIA amended, updated and made available a revised guide containing information reasonably required by a person wishing to exercise any right in terms of PAIA and POPIA (“the Guide”).
The Guide is available in each of the official languages and in braille.
The Guide that has been published by the Information Regulator contains the following information: (a) the objects of PAIA and POPIA; (b) the postal and street address, phone number, and if available, the electronic mail address of the information officer of every public and private body designated in terms of section 17(1) of PAIA and section 56 of POPIA; (c) the manner and form of a request for access to a record of a public body and a record held by a private body; (d) the assistance available from the information officer of a public body in terms of PAIA and POPIA; (e) the assistance available from the Information Regulator in terms of PAIA and POPIA; all remedies in law regarding an act or an omission in respect of a right or duty conferred or imposed by PAIA and POPIA, including how to lodge an internal appeal, a complaint to the Information Regulator and a court application; (f) the requirements for a public body and private body, respectively, to compile a Manual, and how to obtain access to a Manual; (g) the voluntary disclosure of categories of records by a public body and private body, respectively; (h) the notices issued in terms of sections 22 and 54 of PAIA regarding fees to be paid in relation to requests for access; and (i) the regulations made in terms of section 92 of PAIA.
A copy of the Guide is available on the Information Regulator's website.
The Information Regulator is responsible for updating and making available the existing guide that will facilitate ease of use of PAIA for requesters. Please direct any queries to the Information Regulator using the details below:
The Information Regulator of South Africa
- Physical Address
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.
- Postal Address
- P.O. Box 31533, Braamfontein, Johannesburg, 2017.
- Email Address
- complaints@inforegulator.org.za
- Website
- www.inforegulator.org.za
4. Objectives of this Manual
The objectives of this Manual are to:
provide a list of all records held by CONVERGE;
set out the requirements regarding who may request information in terms of PAIA as well as the grounds on which a request may be denied;
provide a list of all records held by CONVERGE;
define the manner and form in which a request for information must be submitted; and
comply with the additional requirements imposed by POPIA.
5. Requests
PAIA provides that a person may only make a request for information if the information is required for the exercise or protection of a legitimate right.
Information will therefore not be furnished unless a person provides sufficient particulars to enable CONVERGE to identify the right that the requester is seeking to protect as well as an explanation as to why the requested information is required for the exercise or protection of that right. The exercise of an individual’s rights is subject to justifiable limitations, including the reasonable protection of privacy, commercial confidentiality and effective, efficient and good governance. PAIA and the request procedure contained in this Manual may not be used for access to a record for criminal or civil proceedings, nor should information be requested after the commencement of such proceedings.
The Information Officer has been delegated with the task of receiving and co-ordinating all requests for access to records in terms of PAIA, to ensure proper compliance with PAIA and POPIA.
The Information Officer will facilitate the liaison with the internal legal team on all requests received.
All requests in terms of PAIA and this Manual must be addressed to the Information Officer using the details in paragraph 2 above.
6. Records automatically available
In accordance with section 52(1) of PAIA, CONVERGE has elected not to voluntarily make available to the public any categories of records that do not require the making of a request for access in terms of PAIA.
7. Information required in terms of POPIA
Section 51(c)(i) – (v) of PAIA
In terms of POPIA, personal information must be processed for a specified purpose. The purpose for which data is processed by CONVERGE will depend on the nature of the data and the particular data subject.
Categories of personal information that may be collected by CONVERGE includes (without limitation): -
name and surname;
contact number and email address;
physical address;
identity or passport number and registration number;
date of birth;
bank details;
VAT numbers;
financial and credit information;
special personal information to deliver our Healthtech services in accordance with contractual relationships with registered healthcare providers such as hospitals and clinics;
biometric information to access our services;
transaction information relating to your use of our services and log files;
cookies and web beacons;
information we infer about you based on your interaction with our services;
device information (for example the type of device you're using, how you access platforms,
your browser or operating system and your Internet Protocol ("IP address"); and
location information;
in respect of our employees: names, surname, identity numbers, address, qualifications, gender, health/medical, race, religion, children, spouse and family, beneficiaries, medical, criminal, financial, employment history, opinions and views, credit, curriculum vitae, biometric.
The purpose of processing personal information is:
to provide you with information or services you request from CONVERGE;
to communicate with you;
to provide you with support; and
to provide effective advertising (for example to provide you with news, special offers and general information about other services and events which we offer, that are similar to those that you have already procured or enquired about).
A description of the categories of data subjects and of the information or categories of information relating thereto:
visitors of our website;
our clients who make use of CONVERGE’s services;
our client’s customers/patients; and
all data subjects whose personal information is processed by CONVERGE.
The recipients or categories of recipients to whom CONVERGE may share personal information which is as follows:
we may disclose your personal information to a limited number of our contractors or third-party service providers (other than those who we refer you to), who interact with you on our behalf;
other parties in response to a legal or regulatory obligation we may have;
other parties when we perform an obligation we have towards you;
other parties in response to legal process or when necessary to conduct or protect our legal rights;
companies that provide services to us. Companies that provide services to us or act on our behalf may have access to information about you. These companies are limited in their ability to use information they receive while providing services to us or you; and
third parties in the event of and during a business transfer. Where all or a part of our business is merged, sold or reorganised, personal information about you may be shared with the successor entity. CONVERGE will use reasonable measures to help ensure that any successor entity processes personal information in accordance with this Manual and our Privacy Policy.
7.6. A general description of information security measures to be implemented
CONVERGE takes appropriate technical and organisational measures designed to ensure that personal data remains confidential and secure against unauthorised or unlawful processing and against accidental loss, destruction or damage.
7.7. Planned transborder flows of personal information
CONVERGE might transfer your personal information to places outside of South Africa and store it there, where our suppliers might process it. If this is required, CONVERGE will comply with applicable data privacy laws and its Privacy Policy before effecting the transfer of your personal information.
8. POPIA data subject request process
POPIA provides that a data subject may, upon proof of identity, request CONVERGE to confirm, free of charge, all the information it holds about the data subject and may request access to such information, including information about the identity of third parties who have or have had access to such information. POPIA provides that a data subject may object, at any time, to the processing of personal information by CONVERGE on reasonable grounds relating to his/her situation, unless legislation provides for such processing.
A data subject may also request CONVERGE to correct or delete personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully; or to otherwise destroy or delete a record of personal information about the data subject that CONVERGE is no longer authorised to retain in terms of POPIA’s retention and restriction of records provisions.
If a data subject wishes to (i) submit an access request; (ii) object to the processing of personal information; or (iii) request the correction or deletion of personal information, or the destruction or deletion of a record of personal information; then the data subject must complete the applicable form which is accessible on the Information Regulator’s website and submit the completed form to the Information Officer of CONVERGE.
Proof of the data subject’s identity (and that of any related third parties acting on behalf of the data subject) must be provided on submitting any of the data subject forms referenced above to the Information Officer of CONVERGE.
9. Records and record categories available in accordance with South African legislation
Section 51(1)(b)(iv) of PAIA
CONVERGE has the following records available in terms of the following South African laws that are applicable to CONVERGE business operation, including:
| Applicable legislation | Records / record categories |
|---|---|
| Companies Act, 71 of 2008 |
|
| Basic Conditions of Employment Act, 75 of 1997Labour Relations Act, 66 of 1995Occupational Health and Safety Act, 85 of 1993Income Tax Act, 58 of 1962 | Employee records, including recruitment records, disciplinary records and incident records. |
| Insurance Act, 63 of 2001 |
|
| Promotion of Access to Information Act, 2 of 2000 |
|
| Protection of Personal Information Act, 4 of 2013 |
|
| Value Added Tax Act, 89 of 1991 | VAT Returns. |
Please note that the records listed above are not automatically available, and the process outlined in this PAIA Manual in respect of access to information requests and data subject personal information access requests must be followed.
10. PAIA access request procedure
Section 51(1)(b)(iv) of PAIA
10.1. Completion of the prescribed form
Any request for access to a record in terms of PAIA must substantially correspond with Form 2 (“Request for Access to Record”), which is available on the Information Regulator’s website, which must be completed taking due cognisance of the following instructions on the completion of Forms:
the access request form must be completed in English language;
type or print your answers for every question in BLOCK LETTERS;
if a question does not apply, state “N/A” in response to that question;
if there is nothing to disclose in reply to a particular question, state “nil” in response to that question;
if there is insufficient space on a printed form in which to answer a question, additional information may be provided on an additional folio (in which case, please precede each answer with the title applicable to the question being answered and ensure that all additional folios are signed by the requestor). A request for access to information which does not comply with the formalities as prescribed by PAIA will be returned to you. Grounds for refusal of the data subject’s request are set out in PAIA and are discussed below.
A request for access to information which does not comply with the formalities as prescribed by PAIA will be returned to you.
Grounds for refusal of the data subject’s request are set out in PAIA and are discussed below.
10.2. Proof of identity
Proof of identity is required to authenticate your identity and the request. You will, in addition to this prescribed form, be required to submit acceptable proof of identity such as a certified copy of your identity document or other legal forms of identity.
10.3. Payment of the prescribed fees
There are two categories of fees which are payable:
The request fee, which will be a standard fee; and
The access fee, which must be calculated by taking into account reproduction costs, search and preparation time and costs, as well as postal costs.
Section 54 of PAIA entitles CONVERGE to levy a charge or to request a fee to enable it to recover the cost of processing a request and providing access to records. The fees that may be charged are set out in Annexure B of Government Notice No. R.757 dated 27 August 2021 promulgated under the PAIA Regulations.
Where a decision to grant a request has been taken, the record will not be disclosed until the necessary fees have been paid in full.
10.4. Timelines for consideration of a request for access
Requests will be processed within 30 (thirty) days, unless the request contains considerations that are of such a nature that an extension of the time limit is needed.
The Information Officer will inform the requester of the decision, and the fees payable (if applicable) on a form that corresponds substantially with Form 3 of Annexure A to Government Notice No. R.757 dated 27 August 2021 promulgated under the PAIA Regulations.
Should an extension be required, you will be notified, together with reasons explaining why the extension is necessary.
10.5. Grounds for refusal of access and protection of information
There are various grounds upon which a request for access to a record may be refused. These grounds include:
the protection of personal information of a third person (who is a natural person) from unreasonable disclosure;
the protection of commercial information of a third-party (for example: trade secrets; financial, commercial, scientific or technical information that may harm the commercial or financial interests of a third-party);
if disclosure would result in the breach of a duty of confidence owed to a third-party;
if disclosure would jeopardise the safety of an individual or prejudice or impair certain property rights of a third person;
if the record was produced during legal proceedings, unless that legal privilege has been waived;
if the record contains trade secrets, financial or sensitive information or any information that would put CONVERGE (at a disadvantage in negotiations or prejudice it in commercial competition); and/or
if the record contains information about research being carried out or about to be carried out on behalf of a third-party or by CONVERGE.
Section 70 of PAIA contains an overriding provision. Disclosure of a record is compulsory if it would reveal (i) a substantial contravention of, or failure to comply with the law; or (ii) there is an imminent and serious public safety or environmental risk; and (iii) the public interest in the disclosure of the record in question clearly outweighs the harm contemplated by its disclosure.
If the request for access to information affects a third-party, then such third-party must first be informed within 21 (twenty-one) days of receipt of the request. The third-party would then have a further 21 (twenty-one) days to make representations and/or submissions regarding the granting of access to the record.
11. Availability of this Manual
Copies of this Manual are available for inspection, free of charge, on the CONVERGE website.
For questions regarding this document, contact kobus.vandermerwe@converge-solutions.com.