Hello everyone and welcome to the third episode of our POPIA for Estate Agents podcast. This is our first podcast for 2021, which is also the year we will have to process personal information in accordance with POPIA, from 1 July 2021. I am Linda Reid, Head of Data at Lightstone, and your host for these podcasts. For this conversation I welcome Hayley Ivins-Downes, Head of Sales at Lightstone. Thank you for joining us Hayley.

That’s right. Just to summarise – Estate Agents will need to make some substantial changes to the way they collect and manage their Client Contact Books to be compliant with the new legal requirements for processing personal information. They will also need to develop a system for collecting and managing consent from Data Subjects (your clients), for marketing and other purposes.

Not to worry, we’ll try to make the content as practical and clear as possible. Also this is a fairly long section so we are going to split it between this podcast and the next one.

POPIA allows for different levels of responsibility for handling PI, depending on whether you’re the person who is primarily responsible for the data or if you’re simply processing it on the instruction of someone else.

The main role with the largest responsibility is the RESPONSIBLE PARTY. If you are the person who is collecting PI and deciding what to do with it, then you are the Responsible Party. So, if an Estate Agent collects contact details from a prospective client and decides to store it and use it to connect with the prospective client, then they are the RESPONSIBLE PARTY under POPIA. This role involves a lot of responsibility around the collection, use and care of that data. If the RESPONSIBLE PARTY contracts an OPERATOR to do something on their behalf, then the Operator will only be allowed to execute on the terms of that arrangement, and will not be bound to some of the other conditions of POPIA, which apply to the Responsible Party.

An example would be the company that does your photography for you. You would give them some Personal Information on the client so that they can arrange the session. They are allowed to use the PI purely for the purposes of that engagement and not for any other reason. They also have to ensure they store that personal information appropriately and securely and protect it from breach. They will need to delete that PI when the engagement is complete and notify the Responsible Party immediately if they believe that the personal information has been accessed or compromised. In short, the Operator may only process the personal information with the knowledge or authorization of you, the estate agent, and must treat that information as confidential and may not disclose it. POPIA requires a Responsible Party to enter into a written contract with the Operator, to ensure that the Operator establishes and maintains the necessary security measures when dealing with the personal information.

In this case you’re the RESPONSIBLE PARTY, as you are deciding what data to collect and for what purpose. If you need another company to contact that seller, for example to arrange staging furniture for the viewings, they are the Operator and they can only use those details for the purpose you’ve contracted them for (that in this case is the staging to support the sale of the property).

Well, if you’re the Responsible Party, then you need to adhere to what POPIA lays out as the eight conditions for lawful processing. There is quite a lot of detail to this section of the Act, and it is actually the nub of the act so we encourage Estate Agents to read it in full, but we will summarise the key elements here. We will also make the full section available on our website for ease of reference.

First I’m going to run through all eight of them, so that our listeners have the framework before we unpack them in greater detail. They are:

1. Accountability
2. Processing Limitation
3. Purpose Specification
4. Further Processing Limitation
5. Information Quality
6. Openness
7. Security Safeguards
8. Data Subject Participation

It will all become a lot clearer when we explain each in more detail. Let’s start with Accountability. This condition simply says that if you’re the Responsible Party it is your job to ensure that the other 7 conditions are complied with throughout your journey with that data. You also have to ensure that your Operators are in a position to handle the data with that same due care.

Next is Processing Limitation, and this is a biggie. The Processing Limitation requires a Responsible Party to process personal information only if it is adequate, relevant and not excessive given the purpose for which it is being processed. This means that you can’t collect more information than what you need to cover the purpose, as a "just in case" or because it would be useful to have that information..

Not unless having that information is required for the purposes of helping them buy or sell their house. Also, under Processing Limitation, you need to ensure you have a lawful reason for collecting their information. This comes down to the six lawful grounds for processing, which we covered in the last podcast, such as gathering consent or processing the data in the execution of a contract, for example.

Yes, those six Lawful Grounds are very important. It’s what gives you the right to collect and process the PI in the first place. But there’s also one more element in the condition of Processing Limitation and that is that you need to collect the information directly from the Data Subject. There are some exceptions to this, which are clearly outlined in the Act, but for the most part you should get the information directly from the Data Subject.

No, she can’t, not unless the neighbour has consented to her passing on the details to the Estate Agent.

Yes you’ve got it. The third condition is called Purpose Specification. Basically, the data you collect must be for a specific and lawful purpose related to your functions or activities, and you must make sure the Data Subject is aware of that purpose.

Absolutely not, because then you are in breach of both ‘minimality’, ‘collection for specific purpose’, and you probably don’t have one of the six ‘lawful grounds’ for collecting it.

Yes, there’s a rather detailed section explaining what your responsibilities are for retaining and restricting access to the records of personal information. You aren’t allowed to keep the Personal Information for longer than is necessary for the purpose you collected them. In other words you have to delete the records after that purpose has been completed. There are a number of exceptions to this, so I do encourage our listeners to read this section of the Act which is available on our site, to see if any of those exceptions apply to them.

Exactly – remember that POPIA aims to give people control over how their personal information is used, and especially that it is used in a way that doesn’t infringe on the privacy of the Data Subject.

Spot on, and actually that’s Condition number four, called Further Processing Limitation. But we are going to end here for today and pick up in our next podcast with this condition and the remaining four after that.

Indeed. We welcome all feedback and would love to hear from our listeners. Thank you for being my co-host today Hayley. It’s so important that we have these conversations around POPIA, so that we can all come away a little bit smarter, wiser and hopefully more prepared. Until next time… goodbye.