PoPI is a comprehensive South African Act for the protection of personal third party information, setting stringent conditions for the processing of data. PoPI covers the complete use of personal information, from acquisition to destruction. The onus on organisations is to identify where personal information is held within the organisation and to ensure appropriate levels of access control. PoPI requires that personal information be protected unless for a specific purpose, and also governs the movement of personal information across the borders of South Africa. FATCA on the other hand is US legislation that requires foreign banks, insurance companies and other financial institutions to report on the taxable earnings of US citizens. Many countries, including South Africa, have already agreed to cooperate with FATCA, which requires participating financial institutions to prove that they have identified and are correctly reporting on the earning of US taxpayers earning more than a US$50 000 threshold.

 

Failure to comply with PoPI could result in fines of up to R10 million or 10 years in jail. For FATCA, non-compliance means a 30% withholding tax on any payments received from US entities, a penalty that could add up to hundreds of millions of Rands for some organisations. The consequences of non-compliance with these laws could have a detrimental impact on South African financial services institutions. However, with one piece of legislation requiring personal information to be carefully safeguarded, and another requiring that personal information be disclosed undercertain circumstances, compliance with both, as well as a host of other legislation and compliance requirements, has become a costly and complex exercise.

 

Although much of the focus of PoPI is on security, companies are also required to ensure data quality, as the Act states that personal information has to be complete and accurate, not misleading, and maintained up to date. PoPI also requires organisations to be able to provide, on request, a description of all personal information held about an individual or data subject, to that individual or data subject. Identifying where personal information is held and who has access to it, as well as ensuring the quality of this data across multiple systems, is quite the challenge.

 

With FATCA, poor customer data quality can make it difficult to identify US clients, as important identifying information can be missing or inaccurate. In addition, foreign financial institutions must create a linked profile of these clients in order to identify whether earnings meet the required threshold. Ensuring that reports disclosed to US revenue services are compliant with both PoPI and FATCA is a significant hurdle. By the conditions of PoPI, it is not acceptable to disclose earnings or other personal information of parties that have been wrongfully identified as US citizens, or to disclose the earnings of US citizens who do not reach the threshold of $50 000.

 

Poor quality data and the lack of a single view of the customer are critical to ensuring financial institutions do not fall foul of either piece of legislation. Information governance therefore lies at the heart of compliance with both PoPI and FATCA. Data governance principles, including defining data policies, identifying responsible persons, and measuring compliance to policy, need to be applied to ensure compliance with each act, while minimising the impact of compliance. By making use of a Data Governance Centre, financial institutions can not only ensure compliance, they can identify and manage conflicting and complementary policies appropriately. In addition, by taking a holistic view of compliance, rather than examining each piece of legislation in isolation, synergies can be leveraged to minimise conflict and risk while driving down the cost of compliance overall. 

 

Legislative conflict is nothing new in the compliance space, and planning for each regulation can cost tens of millions of Rands. The centralised governance of data allows you to identify information issues such as noncompliance to policy, measure the business impact, and prioritise remediation efforts. Ultimately, this saves money while reducing risk. By examining compliance as a whole, implementing standardised technology and leveraging a broader data governance framework, financial institutions can identify both synergies and conflicts for efficient, cost effective compliance.