HR Pulse




Menu Style


How will POPI impact your social media channels?

Craig Rodney

The Protection of Personal Information Act – affectionately known as POPI – was signed into law in November 2013. If your organisation isn't compliant, don't start panicking because you have a year to dot your legal i's and cross your legal t's. Seeing that the POPI Act's primary purpose is to protect individuals' personal information, the question on everyone's lips is: "What impact will it have on my company's social media channels?"

The primary, and most obvious, impact that POPI will have on your social media activities is that any and all information collected via your social media channels will be governed by POPI - just like all other customer information. For example:

  • If you use your social media channels as for customer service purposes and you ask customers for their contact details, ID or customer numbers via private messaging, all of this information is governed by POPI.

How does POPI affect you if you use a social media agency?

If you use an agency to run your social media channels, they're operating as a third party on your behalf. As such, they:

  • Collect and process customer information on your behalf, or
  • View and capture your customers' information.

This means that the agency would be required to conform to the POPI requirements on your behalf.

You, or your agency, should also ensure that your actions aren't endangering your customers' private information. For example:

  • If you ask someone to message you directly on Twitter, you run the risk of them replying publicly and so exposing their information. This happens more often that you think...
  • A solution could be for you to initiate the direct message contact, and they can simply reply privately.

Take POPI into account when you develop your influencer lists

An influencer list is a list of people who are influential on various levels in social media channels. They may be customers, bloggers or simply people who have a large, influential reach. Many of the people on these lists are not journalists so their information is 'less public'.

If you have an influencer list then each person's private information is governed by POPI. (Find out here what 'personal information' includes. Believe it or not, 'personal information' has gotten a lot more meanings with the POPI Act.)

Follow these 5 steps to make sure your social media channels are POPI compliant

1. Evaluate your techniques for capturing social data. Ensure the capture, storage and use of the data complies with your overall company POPI governance.

2. Ensure that your company's risk officer (or whoever is responsible for POPI compliance) understands your social media channel objectives and how social media conforms to POPI.

3. Review your influencer lists and ensure you know:

  • Which information is in the public domain and can be used 'freely',
  • Where and how you got the information,
  • What the purpose of original collection was, and
  • You have permission to use the information.

You may be required to recollect information and get consent for using it in a broader context.

4. Ensure you have processes to deal with the regulator, complaints and security breaches

POPI serves as a general warning to all South Africans:

  • The act only protects your private information and any information you share publicly will automatically fall outside of the protection of the POPI Act.
  • If you list your e-mail address or telephone number on your Facebook page, and that information is publicly available, then it's free for companies to collect and use. You can't then claim protection under POPI if this information gets used.

Moral of the story: Be highly aware of what information you offer publicly as you can't claim protection under POPI for that information!

Craig Rodney is the managing director of Cerebra, an integrated strategic communication agency that builds, engages and activates communities around brands. Craig started his first business, Emerging Media, in 2002 at the age of 26 and quickly made his mark, landing three of the top four most valuable technology companies at the time, Google, Oracle and Symantec. In 2010, Craig completed a merger with Cerebra and, as managing director, is responsible for clients such as Vodacom, ABSA, and Tsogo Sun to name but a few of the most talked about online brands in the country.

Beyond Cerebra, Craig is a shareholder in a niche publishing company, a leading podcasting company, and in 2011 Craig was voted one of the 40 most influential South Africans under 40. Craig has a passion for the type of sports that cause regular injuries. He is often seen sporting broken bones and a bruised ego.

Craig is also a regular on the speaker circuit covering topics ranging from communications and the impact of social technologies, to technology in Africa and the economics of expectations.