The Regulator may from time to time issue codes of conduct.
A code of conduct must—incorporate all the conditions for the lawful processing of personal information or set out obligations that provide a functional equivalent of all the obligations set out in those conditions; and
prescribe how the conditions for the lawful processing of personal information are to be applied, or are to be complied with, given the particular features of the sector or sectors of society in which the relevant responsible parties are operating.
A code of conduct may apply in relation to any one or more of the following:Any specified information or class of information;
any specified body or class of bodies;
any specified activity or class of activities; or
any specified industry, profession, or vocation or class of industries, professions, or vocations.
A code of conduct must also—specify appropriate measures— for information matching programmes if such programmes are used within a specific sector; or
for protecting the legitimate interests of data subjects insofar as automated decision making, as referred to in section 71, is concerned;
provide for the review of the code by the Regulator; and
provide for the expiry of the code.
The Regulator may issue a code of conduct under section 60—on the Regulator’s own initiative, but after consultation with affected stakeholders or a body representing such stakeholders; or
on the application, in the prescribed form, by a body which is, in the opinion of the Regulator, sufficiently representative of any class of bodies, or of any industry, profession, or vocation as defined in the code in respect of such class of bodies or of any such industry, profession or vocation.
The Regulator must give notice in the Gazette that the issuing of a code of conduct is being considered, which notice must contain a statement that—the details of the code of conduct being considered, including a draft of the proposed code, may be obtained from the Regulator; and
submissions on the proposed code may be made in writing to the Regulator within such period as is specified in the notice.
The Regulator may not issue a code of conduct unless it has considered the submissions made to the Regulator in terms of subsection (2)(b), if any, and is satisfied that all persons affected by the proposed code have had a reasonable opportunity to be heard.
The decision as to whether an application for the issuing of a code has been successful must be made within a reasonable period which must not exceed 13 weeks.
If a code of conduct is issued under section 60 the Regulator must ensure that—there is published in the Gazette, as soon as reasonably practicable after the code is issued, a notice indicating—that the code has been issued; and
where copies of the code are available for inspection free of charge and for purchase; and
as long as the code remains in force, copies of it are available—on the Regulator’s website;
for inspection by members of the public free of charge at the Regulator’s offices; and
for purchase or copying by members of the public at a reasonable price at the Regulator’s offices.
A code of conduct issued under section 60 comes into force on the 28th day after the date of its notification in the Gazette or on such later date as may be specified in the code and is binding on every class or classes of body, industry, profession or vocation referred to therein.
A code of conduct may prescribe procedures for making and dealing with complaints alleging a breach of the code, but no such provision may limit or restrict any provision of Chapter 10.
If the code sets out procedures for making and dealing with complaints, the Regulator must be satisfied that—the procedures meet the— prescribed standards; and
guidelines issued by the Regulator in terms of section 65, relating to the making of and dealing with complaints;
the code provides for the appointment of an independent adjudicator to whom complaints may be made;
the code provides that, in exercising his or her powers and performing his or her functions, under the code, an adjudicator for the code must have due regard to the matters listed in section 44;
the code requires the adjudicator to prepare and submit a report, in a form satisfactory to the Regulator, to the Regulator within five months of the end of a financial year of the Regulator on the operation of the code during that financial year; and
the code requires the report prepared for each year to specify the number and nature of complaints made to an adjudicator under the code during the relevant financial year.
A responsible party or data subject who is aggrieved by a determination, including any declaration, order or direction that is included in the determination, made by an adjudicator after having investigated a complaint relating to the protection of personal information under an approved code of conduct, may submit a complaint in terms of section 74(2) with the Regulator against the determination upon payment of a prescribed fee.
The adjudicator’s determination continues to have effect unless and until the Regulator makes a determination under Chapter 10 relating to the complaint or unless the Regulator determines otherwise.
The Regulator may amend or revoke a code of conduct issued under section 60.
The provisions of sections 60 to 63 apply in respect of any amendment or revocation of a code of conduct.
The Regulator may provide written guidelines—to assist bodies to develop codes of conduct or to apply approved codes of conduct;
relating to making and dealing with complaints under approved codes of conduct; and
about matters the Regulator may consider in deciding whether to approve a code of conduct or a variation or revocation of an approved code of conduct.
The Regulator must have regard to the guidelines as set out in section 7(3)(a) to (d) when considering the approval of a code of conduct for the processing of personal information for exclusively journalistic purposes where the responsible party is not subject to a code of ethics as referred to in section 7(1).
Before providing guidelines for the purposes of subsection (1)(b), the Regulator must give everyone the Regulator considers has a real and substantial legitimate interest in the matters covered by the proposed guidelines an opportunity to comment on them.
The Regulator must publish guidelines provided under subsection (1) in the Gazette.
The Regulator must keep a register of approved codes of conduct.
The Regulator may decide the form of the register and how it is to be kept.
The Regulator must make the register available to the public in the way that the Regulator determines.
The Regulator may charge reasonable fees for— making the register available to the public; or
providing copies of, or extracts from, the register.
The Regulator may, on its own initiative, review the operation of an approved code of conduct.
The Regulator may do one or more of the following for the purposes of the review:Consider the process under the code for making and dealing with complaints;
inspect the records of an adjudicator for the code;
consider the outcome of complaints dealt with under the code;
interview an adjudicator for the code; and
appoint experts to review those provisions of the code that the Regulator believes require expert evaluation.
The review may inform a decision by the Regulator under section 64 to revoke the approved code of conduct with immediate effect or at a future date to be determined by the Regulator.
If a code issued under section 60 is in force, failure to comply with the code is deemed to be a breach of the conditions for the lawful processing of personal information referred to in Chapter 3 and is dealt with in terms of Chapter 10.