Terms and Conditions

CLARITY  ON APPLICABILITY OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013 TO REQUIREMENTS OF THE ENVIRONMENTAL IMPACT ASSESSMENT REGULATIONS, 2014 RELATING TO REGISTERS OF INTERESTED AND AFFECTED PARTIES AND THE INCLUSION OF COMMENTS IN REPORTS

In has come to the attention of the Department of Forestry, Fisheries and the Environment that there is uncertainty regarding the applicability of the requirements of the Protection of Personal Information Act, 2013 (Act No. 14 of 2013) (POPIA) to the requirements of the Environmental Impact Assessment Regulations, 2014, relating to registers of interested and affected parties and the inclusion of comments in reports. Please note the following in this regard:

Register of interested and affected parties:

Regulation 42 of the Environmental Impact Assessment Regulations, 2014, as amended (EIA Regulations) provides for the opening and maintenance of a register of interested and affected parties (I&APs), by the proponent or applicant, which must contain personal information (names, contact details and addresses). It is therefore the duty of the proponent or applicant to collect the information that must be contained in the register.

Regulation 42 further requires that these registers must be submitted to the competent authority (CA). There is no legal requirement in the EIA Regulations that such registers must be included in the reports that are published for public consultation purposes or be made publicly available as part of the EIA process. Since the information in the registers is personal/private information, it should not be included in or attached to reports and be made available in the public domain. CAs, applicants and environmental assessment practitioners (EAPs) should take note that, if this information was previously included in reports and shared in the public domain, this now requires reconsideration in accordance with the POPIA. The Department realises that EAPs may have included some personal information in these reports when they receive and compile them. Likewise, this information may reach CAs who also now need to be sensitive about the management of this information.

It is the duty of the proponent or applicant to collect the information that must be contained in the register. Despite the fact that, in practice, this task is often performed by the EAP, it is the proponent or applicant that remains responsible to comply with the applicable legislative provisions. The applicant or proponent must therefore ensure that the EAP is aware of the POPIA requirements and that registers should not be included in reports and be made available in the public domain.

Comments and responses information:

Regulation 19(1)(a) of the Environmental Impact Assessment Regulations 2014 (EIA Regulations) provides that where basic assessment must be applied to an application, the applicant must, within 90 days of receipt of the application by the CA submit to the CA a basic assessment report, inclusive of any specialist reports, an EMPR, a closure plan or the plans, reports and calculations contemplated in the Financial Provisioning Regulations, which have been subjected to a public participation process of at least 30 days and which reflects the incorporation of comments received, including any comments of the CA. There are similar requirements for the scoping report and the environmental impact assessment reports required in terms of the EIA Regulations.

Paragraph 3(h)(ii) of Appendix 1 of the EIA Regulations requires that a full description of the process followed to reach the proposed preferred alternative within the site, including details of the public participation process undertaken in terms of regulation 41 of the EIA Regulations, including copies of the supporting documents and inputs received must be included in the basic assessment report. Furthermore, subparagraph (iii) requires that a summary of the issues raised by interested and affected parties, and an indication of the manner in which the issues were incorporated, or the reasons for not including them, must also be included in the basic assessment report.

The content requirements for a scoping report (Appendix 2) and an environmental impact assessment report (Appendix 3) contain similar requirements.

The applicant or EAP on behalf of the applicant is therefore required by law to submit reports, including comments received on such reports, summaries of the issues raised, and an indication of the manner in which the comments/issues were incorporated or reasons for not incorporating comments/issues in the reports, where such are not incorporated. It is not expressly required that names or personal information of those who provided comments should be included in the reports. It is however appreciated that it is often the practice to include the name/details of the person who provided the comments in the reports. In many instances those who commented enquire about/ seek confirmation of the inclusion of their comments in the reports. It is therefore important to be able to indicate the comment received in relation to the person/entity who submitted this. Furthermore, it is necessary for the CA to be aware of the persons who submitted comments, when considering the reports (including the comments). For these reasons the names of the commenting parties are intrinsically linked to the comments that are submitted by them and are often also included in the reports, but this must now be done with the careful consideration of and compliance with the POPIA requirements.

The definition of “personal information” in the POPIA includes: “(h) the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person”. Since circumstances may arise where a name, included as part of the comments, may reveal information about a person, it is advisable to err on the side of caution and ensure that there is compliance with the POPIA when names are included in the reports. In some instances more than just the name of the person may be revealed and in such cases the information would also fall within the ambit of the definition of “personal information” and therefore there needs to be compliance with the POPIA requirements. The approach to be followed should be guided by sections 3(3), 9, 12(1) and (2), 11 as well as 18 of the POPIA, as explained below.

Section 3(3)(b) of POPIA provides that the POPIA must be interpreted in a manner that does not prevent any public or private body from exercising or performing its powers, duties and functions in terms of the law as far as such powers, duties and functions relate to the processing of personal information and such processing is in accordance with the POPIA or any other legislation, as referred to in section 3(2), that regulates the processing of personal information. Section 3(3)(b) of the POPIA should be read with and inform the interpretation of other relevant sections of POPIA.

For the current scenario the EAP and applicant has a legal duty to perform a function in terms of the EIA Regulations, which function requires the preparation of reports, that include comments made by process participants. POPIA must therefore be interpreted in a manner that does not prevent the applicant or EAP from performing its functions/duties under the EIA Regulations, as far as such functions/duties relate to the processing of personal information, and provided the processing is in accordance with POPIA and meets the requirements of the EIA Regulations. Furthermore, in light of the fact that the reports submitted by the EAPs are meant to provide the CAs with adequate information that will enable them to decide on applications received, adequate information may, at times, include incorporation of personal information in order for the reports to facilitate decision-making.

Section 9 of POPIA requires that personal information must be processed lawfully and in a reasonable manner that does not infringe the privacy of the data subject. The element of “lawfulness” is fairly straight forward and the requirement is that the responsible party must not act unlawfully in its collection or processing of personal information. The second element of “reasonableness” is perhaps not as straight forward as lawfulness. In most instances the foundation for determination of reasonableness will be the “Purpose Specification”, meaning that personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party, which in turn will inform the data subject’s expectation as well as the responsible party’s processing of personal information. The responsible party must therefore take into account the interests and reasonable expectations of data subjects as well as all the provisions which are incorporated in the conditions for lawful processing of personal information provided in Chapter 3 of POPIA. Clearly, this notion incorporates the requirement for balance and proportionality in processing personal information by the responsible party.

Section 12(1) of POPIA provides that personal information must be collected directly from the data subject. In this case, at the invitation of the EAP, the commenting parties submit their comments and names directly to the EAP and therefore there is compliance with this requirement.  Section 12(2)(b) provides that it is not necessary to comply with subsection 12(1), and to collect data directly from the data subject, if, amongst other things, the data subject has consented to the collection of the information from other sources. In the context of the EIA process it is reasonable to conclude that EIA process participants are aware that information collected by EAPs will eventually be used by CAs to make decisions on relevant development applications. Since the commenting parties are aware and intend that their comments should be considered during the decision-making process by the CA it is not necessary that the CA receive the comments and names of commenting parties directly from the commenting parties. Furthermore, as contemplated in section 12(2)(c), the collection (receipt) of the reports and comments (including the names of persons) by the CA from the EAP (and not directly from the commenting party) would not prejudice the legitimate expectations of the commenting party since the purpose of the submission of the comments to the EAP and the CA is to give effect to the legitimate expectation of the commenting parties that their comments would be considered during the decision-making process by the CA.   

In addition, it should be noted that section 11(1)(a) of POPIA provides that personal information may only be processed if the data subject consents to the processing. On the other hand, section 11(1)(c) provides that personal information may only be processed if processing complies with an obligation imposed by law on the responsible party. The comments (and names of commenting parties) are included in the reports as a result of the requirements of the EIA Regulations and are submitted to the CA to enable informed decision-making.

The requirements of section 18 of POPIA should also be noted. Section 18(1) of POPIA requires that if personal information is collected, the responsible party must take reasonably practicable steps to ensure that the data subject is aware of, amongst other things, the information being collected, the name and address of the responsible party (in this case the EAP and applicant), the purpose for which the information is collected, whether or not the supply of the information by the data subject is voluntary or mandatory, the consequence of the failure to provide the required information, further information such as the recipient of the information, as well as the existence of the right to object to the processing of the personal information. It is therefore necessary that the relevant information be communicated by the EAPs to the commenting parties. Section 18(2) of POPIA requires that the steps must be taken, if the information is collected directly from the data subject, before the data is collected, unless the data subject is already aware of such information. If the above steps are followed and the required information is included when the reports are published for public consultation, the commenting parties will be duly informed of the reasons/purpose of the comments being requested, the name and address of the EAP and applicant, as well as that the information will be included in the reports and be submitted to the CA to enable informed decision-making.

In order to ensure that the inclusion of comments - and names of commenting parties - in the reports complies with the POPIA, the above requirements should be taken into consideration and be given effect to. Furthermore, to err on the side of caution, it is advisable that EAPs should obtain express consent from commenting parties to include their names with their comments in the reports. It is therefore recommended that the EAP, when requesting comment, should also request the persons who may comment to provide consent that their names may be included with their comments in the reports. Commenting parties should also be informed that they may opt to not have their names shared, as well as an indication of the consequences of such an option being exercised, in which case only the comments will be included. This will ensure that the requirements of section 11(1)(a) of POPIA, which provides that personal information may only be processed if the data subject consents to the processing, is given effect to.  Even when consent is obtained it is recommended that only the minimum details (the names) should be included in reports and the inclusion of unnecessary and excessive information should be avoided.