Module 2: Data - Revision history

Plixavra: /* South Africa’s Regulatory Framework */

2025-10-01T15:19:34Z

South Africa’s Regulatory Framework

← Older revision		Revision as of 17:19, 1 October 2025
Line 317:		Line 317:
	In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.		In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

	=== South ~~Africa’s Regulatory Framework~~ ===		=== South Africa ===
	==== Data protection- legal framework and nature ====		==== Data protection- legal framework and nature ====
	South Africa’s regulatory framework concerning cross-border data transfers is based on the constitutional right to privacy, enshrined in Section 14 of the country’s constitution. The protection of personal Information Act 4 of 2013 (POPIA) purpose is to give effect to this constitutional right to privacy (Section 2 (1) POPIA).The act aims to achieve this by regulating the way in which a public or private body, named by the act as the “Responsible Party” (Section 1, Section 3 (1) POPIA, see also) may process personal information in harmony with international standards, while providing “persons” with rights and remedies (Section 2 (2-3) POPIA) . Interestingly, the act defines a “person” as a “natural person or a juristic person”, unlike the GDPR or convention 108, thus including legal entities within its scope and eligible for protection (Section 1, POPIA). The act does not apply to personal information processing conducted in purely personal or household activity (Section 6 POPIA)The act also establishes the Information Regulator as the dedicated independent supervisory authority to promote, enforce and fulfil the rights protected by this Act (Section 2 (4), Section 39, Section 55 POPIA). As part of the Information regulator’s responsibility, is the publishing of an annual report regarding meant to increase transparency and privacy protection (Annual report of 2023-2024)		South Africa’s regulatory framework concerning cross-border data transfers is based on the constitutional right to privacy, enshrined in Section 14 of the country’s constitution. The protection of personal Information Act 4 of 2013 (POPIA) purpose is to give effect to this constitutional right to privacy (Section 2 (1) POPIA).The act aims to achieve this by regulating the way in which a public or private body, named by the act as the “Responsible Party” (Section 1, Section 3 (1) POPIA, see also) may process personal information in harmony with international standards, while providing “persons” with rights and remedies (Section 2 (2-3) POPIA) . Interestingly, the act defines a “person” as a “natural person or a juristic person”, unlike the GDPR or convention 108, thus including legal entities within its scope and eligible for protection (Section 1, POPIA). The act does not apply to personal information processing conducted in purely personal or household activity (Section 6 POPIA)The act also establishes the Information Regulator as the dedicated independent supervisory authority to promote, enforce and fulfil the rights protected by this Act (Section 2 (4), Section 39, Section 55 POPIA). As part of the Information regulator’s responsibility, is the publishing of an annual report regarding meant to increase transparency and privacy protection (Annual report of 2023-2024)

Plixavra: /* South Africa */

2025-10-01T15:19:20Z

South Africa

← Older revision		Revision as of 17:19, 1 October 2025
Line 316:		Line 316:

	In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.		In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

	~~=== South Africa ===~~

	=== South Africa’s Regulatory Framework ===		=== South Africa’s Regulatory Framework ===

Plixavra: /* South Africa’s Regulatory Framework */

2025-10-01T15:18:56Z

South Africa’s Regulatory Framework

Plixavra: /* Transfer of Data */

2025-10-01T15:18:19Z

Transfer of Data

← Older revision		Revision as of 17:18, 1 October 2025
Line 1:		Line 1:
	== ~~Transfer~~ of ~~Data~~ ==		== Cross border transfers of data ==
	Cross-border data flows refers to the transferring of personal data between servers across different country borders.		Cross-border data flows refers to the transferring of personal data between servers across different country borders.

	=== Council of ~~Europe~~ ===		=== Council of Europe ===

	=== Convention 108: ~~Nature~~ ===		==== Convention 108: Nature ====

	The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.		The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.

	=== Convention 108: Scope and ~~Provisions~~ ===		==== Convention 108: Scope and Provisions ====
	Chapter 3 of the Convention engages with the topic of transborder data flows. To be precise, article 12 aims to ‘reconcile the requirements of effective data protection with the principle of free flow of information, regardless of frontiers’. Essentially, it aims to balance the existence of strong data protection for personal data protections along with the free flow of information across borders, which is directly linked to article 10 of the European Convention on Human Rights.		Chapter 3 of the Convention engages with the topic of transborder data flows. To be precise, article 12 aims to ‘reconcile the requirements of effective data protection with the principle of free flow of information, regardless of frontiers’. Essentially, it aims to balance the existence of strong data protection for personal data protections along with the free flow of information across borders, which is directly linked to article 10 of the European Convention on Human Rights.

Line 318:		Line 318:

	=== South Africa ===		=== South Africa ===

	== South Africa’s Regulatory Framework ==		== South Africa’s Regulatory Framework ==
	=== Data protection- legal framework and nature ===		=== Data protection- legal framework and nature ===

Qr2qs9 at 13:42, 1 October 2025

2025-10-01T13:42:35Z

Show changes

Qr2qs9: removing html tags

2025-10-01T13:41:49Z

removing html tags

Show changes

Qr2qs9: Undo revision 123451 by Qr2qs9 (talk)

2025-10-01T13:40:09Z

Undo revision 123451 by Qr2qs9 (talk)

Show changes

Qr2qs9 at 13:39, 1 October 2025

2025-10-01T13:39:14Z

Show changes

Qr2qs9 at 13:38, 1 October 2025

2025-10-01T13:38:13Z

← Older revision		Revision as of 15:38, 1 October 2025
Line 1:		Line 1:
	= Transfer of Data =		== Transfer of Data ==
	Cross-border data flows refers to the transferring of personal data between servers across different country borders.		Cross-border data flows refers to the transferring of personal data between servers across different country borders.

Qr2qs9: /* Examples of federal sectorial legislation */

2025-10-01T13:34:36Z

Examples of federal sectorial legislation

← Older revision		Revision as of 15:34, 1 October 2025
Line 329:		Line 329:
	In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).<p style="font-weight: 400;">As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.</p><p style="font-weight: 400;">COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.</p><p style="font-weight: 400;">Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.</p><p style="font-weight: 400;">COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.</p><p style="font-weight: 400;">The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation.</p><p style="font-weight: 400;"><br></p><p style="font-weight: 400;">COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees.</p><p style="font-weight: 400;"><br></p>		In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).<p style="font-weight: 400;">As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.</p><p style="font-weight: 400;">COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.</p><p style="font-weight: 400;">Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.</p><p style="font-weight: 400;">COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.</p><p style="font-weight: 400;">The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation.</p><p style="font-weight: 400;"><br></p><p style="font-weight: 400;">COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees.</p><p style="font-weight: 400;"><br></p>

	==== US State Laws ====~~<p style="font-weight: 400;">~~In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.~~</p>~~		==== US State Laws ====

			In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

	=== South Africa ===		=== South Africa ===