Residential estates, gated communities, office parks, and other properties that scan the driving licences of visitors could be in contravention of the Protection of Private Information Act (Popia).
Advocate Pansy Tlakula, chairperson of the Information Regulator of South Africa, said the entity is concerned that estates and similar properties are collecting too much personal information about visitors, more than what is required by law.
Popia dictates that minimal personal information must be collected by businesses and they must have a good reason for collecting the data they are asking for, such as security.
In the case of residential estates and gated communities, Tlakula argues that only the driver’s name, vehicle registration number, and the colour of the car will be sufficient to maintain a certain level of safety.
In practice, however, these entities go much further when recording the particulars of visitors.
“When you go into gated communities and office parks, what happens is they scan your licence disc, which contains a lot of personal information,” Tlakula told 702.
“They scan your driver’s licence, and some even take your photo.”
This, said the expert, can be classified as overprocessing.
Tlakula questioned why these estates deem it necessary to gather so much data, as even in cases such as vehicle theft, they would still need to report the incidents to the police and that there was nothing they could independently do that would require as much information on one person.
Additionally, it is unclear how they are keeping the information out of the public domain in an era when cybercrime is becoming increasingly sophisticated.
“How are they protecting it? Where does it end up? That disc has your name, home address, and ID number linked to it,” said Tlakula.
The Information Regulator is thus setting its sights on residential estates, gated communities, and office parks that employ these practices.
“I think after the direct marketing sector, the sector we are setting our eyes on is the surveillance sector,” Tlakula said.
“We have preliminarily taken the view that after consulting with the sector, we should issue a code of conduct for them.”
Digital is best
Access management system provider At The Gate (ATG) Digital said that the increase in digital data capturing benefits the subject more than the previous method of physically writing information on a ledger.
“For years, visitors have been asked to provide their name, cell phone number, and signature — at a minimum — to gain entry into lifestyle estates. Popia throws these practices into question, but not for reasons one might assume,” said ATG Digital sales head Ariel Flax.
“Visitor registration is allowed, however, often the visitors’ information is handwritten in a book that’s vulnerable to prying eyes — and therein lies the problem.”
Therefore, recording the data on a dedicated digital system decreases the likelihood of it falling into the wrong hands.
Flax furthermore agrees with the views of the Information Regulator, stating that lifestyle estates, complexes, and community schemes should not collect more information than necessary to fulfill a “specific and reasonable” purpose.
Accordingly, the company’s collection systems have features such as “de-identification,” where unnecessary information that has been gathered from driver and motor vehicle licences is redacted to eliminate non-compliance risks.
Once captured, the data is also encrypted and stored in a secure cloud-based repository which staff can only access after receiving written authorisation from a “responsible party” such as the estate, complex, or office parks management authority.
As per Popia regulations, visitor information is deleted after a set period of time so as to further reduce the risk of nefarious actors getting their hands on it.
Join the discussion