Reading Time: 2 minutes

Applying For Prior Authorisation

The Protection of Personal Information Act (PoPI Act or PoPIA) is finally coming into full effect this year (1 July 2021). It introduces many new requirements for those who handle and process (and share) personal information such as Banks, Credit Providers, Debt Counsellors and Payment Distribution Agents.

‘… the PoPI Act requires that responsible parties get ‘prior authority’ to process information regarding credit reporting’

Section 57 of the PoPI Act requires that responsible parties (who are not under some sort of industry code of conduct) get ‘prior authority’ to process information regarding credit reporting (like how the banks update the credit bureaus, for example).

A Guidance Note

The Information Regulator just issued a Guidance Note about applying for such prior authority explaining the process mentioned in Section 58 of the PoPI Act.

Responsible parties must not carry out any information processing until:

    1. the Information Regulator has completed an investigation (normally 4 weeks) or
    2. until they have received a notice saying that the Regulator will not be investigating their application further (that type of investigation could take up to 13 weeks).

There is also a provision that if you don’t hear back from them for long enough you can assume they are happy and can go ahead.

Some Concern

Some people are worried that the Regulator might only be accepting these applications starting in July 2021 (when the requirements kick in). If so, this means that responsible parties would then have to wait at least 4 weeks or in some cases up to 13 weeks to hear back from the Regulator during which time there would be no credit reporting.

Don’t Get Into Trouble

Section 59 of the PoPI Act says it is an offence to not get prior authority and you could end up being fined or locked up for 12 months (or both). So, this is certainly something for those who process credit info and report on it to consider.