Be sure to visit our articles

Stacks Image 12
On this page you will find ARTICLES
GDPR - Issues and Fines

Italy’s privacy regulator imposes a million Euro fine on Facebook. Facebook’s pre-GDPR data protection breaches in the context of the Cambridge Analytica fiasco have now attracted a million Euro fine imposed by the Italian privacy regulator. The Italian regulator found that Facebook had disclosed to the third-party “This Is Your Digital Life” app, personal data of 214,077 Italian users. These users had not been informed of the sharing of their data and had not given their consent to such sharing, in violation of Italy’s pre-GDPR data protection law.

Although the data processed by the app was generally the basis for Cambridge Analytica’s attempts to influence the U.S. presidential elections in 2016, the Italian regulator found that the data from these Italian users had not been transmitted to Cambridge Analytica. In determining the fine, the Italian regulator took into account the size of the database in question as well as Facebook’s economic status and the number of its users both worldwide and in Italy. The Italian regulator also dismissed Facebook’s arguments for a reduced fine of €52,000.

ICO’s Report on AdTech and Real Time Bidding. The UK’s Information Commissioner’s Office (ICO) has published a report criticizing companies that use online advertising technologies and real-time bidding. The report outlines the issues that require attention and outlines a six-month timescale after which the ICO will re-examine the matter.

In Real-Time Bidding, online ad placements (‘impressions’) are enabled through the auctioning of advertising space in real time, during the milliseconds a webpage takes to load on a user’s browser. Through this process, the online behavioral data of ad-targeted users is shard with AdTech companies billions of times a day. The data shared can include user geo-location data, sexual orientation, religion, political opinions, and online habits, and this processing enables user behavioral profiling.

The ICO’s report criticizes the wrongful reliance by AdTech companies on the GDPR’s legitimate interests as a legal basis to legitimize this processing, without obtaining users’ affirmative consent to this data processing. The ICO also found that privacy policies are not sufficiently clear on how personal data is handled in the Real-Time Bidding process and that companies neglect to conduct a Data Protection Impact Assessment (DPIA) before they engage in this form of processing, in violation of the GDPR.

A Danish furniture company faces fine for over-retaining customers’ personal data. The Danish Data Protection Authority has recommended imposing a €230,000 fine on IDdesign, a large Danish furniture company, that had processed personal data about 385,000 customers for a longer period than necessary for the purpose the data was collected, in violation of the GDPR’s data minimization principle. In addition, the company did not set a retention data policy and did not comply with the accountability principle required by the GDPR.

Spanish Soccer League fined for spying on fans through its mobile app. The Spanish Data Protection Authority imposed a €250,000 fine on the Spanish Major Soccer League (‘La Liga’) after it found that the League had used its mobile app to spy on users through their smartphones’ microphones, in order to help it determine whether bars had pirated soccer matches. La Liga’s misconduct was found to be an infringement of the GDPR because it had to re-inform its users each time the app used the device’s microphone, and not just by notifying of this practice upon download and initial installation of the app.

The regulator also held that La Liga must provide an option for users to withdraw their consent to this form of tracking, at any time, and not just seek the user’s initial consent to this processing. La Liga indicated that it plans to appeal the regulator’s decision, which is the largest fine imposed in Spain to date for GDPR violations.

The GDPR’s first anniversary shows compliance is a challenge. The EU Commission has published two reviews marking the GDPR’s first anniversary. According to the first survey, more than two-thirds of Europeans have heard about the GDPR, but just half of them understand the subject of the regulations. The three most-exercised rights are opting-out of direct marketing (24%), accessing the personal data (18%) and correcting it when it is inaccurate (16%). Only one of six data subjects read privacy policies completely, but every other person has attempted to change the default privacy setting on their social network profile.

The second report examined organizations’ compliance with the GDPR. Some organizations indicated that the GDPR uses vague terms such as “high risk” to data subjects. Many organizations feel that the GDPR may adversely impact innovation, particularly due to the strict interpretation of the GDPR’s requirement for automated decision-making without human involvement. Another concern raised is that the high demand for Data Protection Officers (DPOs) compared with their limited availability in the market, pushes organizations to appoint insufficiently qualified DPOs.

CLICK HERE to read this article published in the Internet, Cyber and Copyright Group’s June 2019 Newsletter.
Four questions determine whether the GDPR applies

When will the GDPR apply directly to an SA company? This is an important question to answer because the penalties for non-compliance are severe. There are fines of up to 20,000,000 EUR or 4% of total global turnover.

1. If an organisation is incorporated in Europe, that entity has to comply with all European laws, including the GDPR.

2. If an organisation is active in Europe through a ‘stable arrangement’ in the EU, the GDPR will apply. This includes instances where a South African business is active in Europe through an agent, a sales office or a branch in Europe. The European Commission will look at factors such as whether the SA company has a website in a European language (other than English), whether it has equipment in Europe or a European postal address.

3. If the SA business is not established in Europe under questions 1 and 2, the GDPR may still apply if it offers goods or services to individuals while they are in the EU. When the European Commission determines whether this is the case they take factors into account such as whether these services are offered in an EU language (other than English), whether payment can be made in an EU currency and whether your marketing material specifically mentions customers located in the EU. This does not mean that the GDPR will apply to European citizens while they are in South Africa. So, just because you have European customers doesn’t mean that you have to comply. It will depend on whether you are delivering goods or services to individuals while they are in the EU.

4. Lastly, and perhaps most importantly for digital marketers, the GDPR will apply to a South African business if it is monitoring the behaviour of individuals while they are in the EU. If the business does analytics on individuals while they are in the EU to create a profile of them, or to analyse their preferences, behaviour or attitudes, the GDPR applies. This means that if a digital marketer is profiling and targeting individuals while they are in Europe, the GDPR will apply.

The story of the dead Springbok OR Prescription - the next chapter in the NCA debt saga.

Long, long ago, in fact in 1969, I had a special Springbok, his name was “Prescription” and he could go without water for 3 years - but then he died; reason being that I did not give him water in that 3 year period. If I had given him water, not just any old water: special water (tacit and expressed and enough to keep him going), I could have extended his life by another 3 years.

Before we move into the debate about: “I is - I was - I have been a Springbok” we need to be reminded ourselves about a pacta sunt servanda. For those who don’t have Latin as home language it means “the sanctity (freedom) of contracts” and it is a doctrine we find in law. In short is every person has the right to freely enter into contracts. This principle has four aspects: 1: freedom from interference by the state to negotiate the terms of a contract, and the corrective freedom from having them imposed on one; 2: freedom to select the person with whom one contracts; 3: freedom not to contract; and 4: freedom from having a contract one has made being interfered with.

One should always bear in mind that we all have an obligation to honour the contracts we enter into, most important the moral obligation to settle the debt that we agreed on. Lawmakers have an obligation to protect the consumer but the opposite is also true hence the principle. Once we have an imbalance between the weighting of the protection of the consumer (prescription) versus the protection of the credit grantor (“sanctity of contract” - creditor/economy) then there is no “equity” and than cannot be sound reasoning.

So many times the issue of Prescription has been raised and the question is easy but the answer apparently not: “Once prescription has run the full period, without being interrupted, can the Creditor still pursue the debt?” I acknowledge many authors on the topic and trust that they will forgive me for using some of their writings and combining that with mine - all in an effort to clear some the confusion.

The 1969 Prescription Act

It is true that when you appear in court for non-payment of a debt, you may raise the defence of prescription at any time during the proceedings. What does the defence entail: a set period of time has passed and by law, you are no longer legally obliged to pay the debt or a subsidiary debt that arose from the debt - [chapter iv sec 17(2)]. Nowhere in the Act does it stipulate that the defence can only be raised in a court of law.

What about all the provisions of the other chapters in the Act? Do we ignore them and if not; how are they applied? The general rule (3 years) applies to all debts covered by South African law unless the general rule is inconsistent with the provisions of any Act of Parliament that: prescribes a specified period within which a claim is to be made or an action is to be instituted in respect of a debt; or imposes conditions on initiating an action for the recovery of a debt. The general rule does not apply where another law applies to the prescription of a debt which arose or arises out of an advance or loan of money by an insurer to any person in respect of an insurance policy issued by such insurer before 1 January 1974. The Act is rarely worth considering when dealing with debts that only prescribe after 30 years. The 30-year period applies to any debt: secured by mortgage bond; that is a judgment debt; relating to taxation by any law; levied by or under any law; owed to the government for any share of the profits, royalties or similar consideration payable for the right to mine minerals or other substances. Similarly the Act will seldom be applied to other debts owed to the government due to: an advance or loan of money; or a sale or lease of land by the State. In such instances 15 years must pass before prescription can be considered. With regard to a debt not mentioned above and arising from a negotiable instrument (such as a cheque or a bill of exchange) or from the less-commonly used notarial contract the prescription period is 6 years. Any debt not mentioned in the paragraphs above the prescription period is 3 years, unless a national act provides otherwise.

Prescription starts to run as soon as the debt is due not to be confused with the date of default. Here we are referred to the wording of the contract between the parties unless: the debtor wilfully prevented the creditor from coming to know of the existence of the debt - prescription then starts once the creditor becomes aware of the existence of the debt; or the creditor did not have knowledge of the identity of the debtor and of the facts from which the debt arises - prescription then starts from the time the creditor is deemed to have such knowledge based on the fact that he, she or it could have gained such knowledge by exercising reasonable care.

Payment made by a debtor after prescription - a payment by a debtor that could have relied on prescription, or in fact relied on prescription, will be accepted in law as payment of a debt - [chapter iii sec 10 (3)].

Prescription can be delayed - Anyone wishing to rely on prescription as a defence, or anyone wishing to avoid such a defence, should study section 13 of the Act. This section raises the possibility that prescription is postponed where certain facts impede the creditor’s ability to institute action in a court such as the fact that the creditor was/is: a minor; declared mentally unfit by court order; a person under curatorship; prevented by superior force including any law or any order of court from judicial interruption of prescription; dealing with a debtor that was/is outside South Africa; married to the debtor; in a partnership with the debtor and the debt arose out of the partnership relationship; or a juristic person (close corporation, company, co-operative) and the debtor is a member of the governing body of the juristic person.

Postponement of prescription must also be considered where - the debt is the object of a dispute subjected to arbitration; the debt is the object of a claim filed against the estate of a debtor who is deceased or against the insolvent estate of the debtor or against a company in liquidation or against an applicant under the Agricultural Credit; or the creditor or the debtor is deceased and an executor of the estate in question has not yet been appointed; where the reciprocal debt in a contract has not prescribed yet.

Interruption of prescription - an acknowledgement of liability and a payment interrupts prescription. Prescription is interrupted by any express or tacit acknowledgement or payment of liability by the debtor. In such a situation prescription starts afresh from the day: on which the interruption takes place; or upon which the debt again becomes due, if at the time of the interruption or at any time thereafter the parties postpone the due date of the debt. We also see that we can have a judicial interruption of prescription i.e. the service on the debtor of any process whereby the creditor claims payment of the debt. Unless the debtor acknowledges liability, such interruption of prescription lapses, and the running of prescription will not be deemed to have been interrupted, if the creditor: does not successfully prosecute the claim under the process in question to final judgment; or prosecutes the claim but abandons the judgment or the judgment is set aside. If the debtor acknowledges liability, and the creditor does not prosecute the claim to final judgment, prescription shall commence to run afresh from the day: on which the debtor acknowledges liability; or upon which the debt again becomes due if at the time when the debtor acknowledges liability or at any time thereafter the parties postpone the due date of the debt.
If the running of prescription is interrupted and the creditor successfully prosecutes the claim to final judgment without abandoning it or having it set aside, prescription starts afresh on the day on which the judgment of the court becomes executable. If any person is joined as a defendant on own application, the process whereby the creditor claims payment of the debt shall be deemed to have been served on such person on the date of such joining.

So what is the fuss ???? - easy !!!! The Prescription Act has NO penalty for overstepping the provisions of the Act - so who cared if the Springbok died. We just ignored the fact that he is dead - we still went on to trace and chase him for his biltong - it was/is not a punishable offence or prohibited conduct to trace, chase, collect or sell his biltong. This is still the position for all other debt except debt falling inside the ambit of the National Credit Act once the National Credit Amendment Act is implemented. Then it will be prohibited conduct to chase a dead NCA Springbok (one that prescribed and now forms part of extinguished fauna) for the biltong or value of his carcass and an administrative fine of R 1,000,000 or 10% of yearly turnover could be imposed by the Tribunal.

In conclusion I leave you with the dictionaries definition of “Extinguished”:

Part of Speech: adjective. Meaning: of a conditioned response; caused to die out because of the absence or withdrawal of reinforcement. Similar: destroyed (spoiled or ruined or demolished). Main Entry: extinguish. Part of Speech: verb. Definition: kill; quash. Synonyms: abate, abolish, annihilate, blot out, check, crush, destroy, eliminate, end, eradicate, erase, expunge, exterminate, extirpate, obliterate, obscure, put down, put the lid on, quell, remove, squash, stamp out, suppress, wipe out. Antonyms: bear, create. Origin: Latin exstinguere (from ex- + stinguere to extinguish) + English -ish (as in abolish); akin to Latin instigare to incite.

Well I guess one must have a point of view. As stated in the beginning, this article is a combination of opinions that I could find and added to it my own views. Least of all is it not a legal opinion, but it should give the novice on “Prescription” a pretty good start in studying this topic, which is as old as debt itself.

Trust that you will now know if my Springbok has been extinguished by prescription, or if in fact he has been given tacit, expressed and enough water, to indicate that we want to keep him alive, during the 3 year period.

JH Eugenè Joubert
Chairman Corporate Rebels