Category: Business

PAIA Manuals and the 31 December 2021 Deadline: Crying Wolf Again, or Real This Time?

“A man who procrastinates in his choosing will inevitably have his choice made for him by circumstance.” (Hunter S. Thompson)

Since 2005 businesses have been repeatedly told “get your PAIA (Promotion of Access to Information Act) manual sorted now, the deadline is approaching”. And every 5 years since then, those (mostly smaller) businesses temporarily exempted from lodging manuals have been given yet another extension – usually at the very last minute.

“Crying Wolf” again?

With government “Crying Wolf” so often, small business owners can certainly be forgiven for treating this whole process with a great deal of scepticism. Perhaps though this deadline is one to take seriously, particularly since the related POPIA (Protection of Personal Information Act) is now fully in place and new PAIA Regulations have been promulgated to tie in with POPIA.

What businesses are currently exempt?

PAIA itself requires all public and private bodies to prepare, lodge and publish (including on any website you have) a PAIA information manual.  Every business operation, no matter how small, falls into that net – the definition of “private body” includes any person or partnership who carries on or has carried on “any trade, business or profession”, together with any “former or existing juristic person” and political parties.

In other words, all businesses of all types and sizes must have a PAIA manual once the current exemption comes to an end.

You are probably currently exempt if you are a smaller business, specifically a “private body”, including any private company.

But the exemption does not apply to any non-private company, nor to any private company in any of the business sectors listed below with either –

• 50 or more employees, or
• An annual turnover of or above specific thresholds – see the table below for details.

Do your Manual now anyway!

Even if the deadline is once again extended, you will almost certainly still have to comply somewhere down the line, and at least by getting this done now you have got rid of one annoying little red tape item from your Action List. Procrastinating, as Hunter S Thompson pointed out, just means having the choice made for you down the line.

Prepare your PAIA manual now; if you already have one, update it regularly.

Disclaimer: The information provided herein should not be used or relied on as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your professional adviser for specific and detailed advice.

© LawDotNews

Your Website of the Month: Starting a Business in 2021

Whether 2020’s lockdown gave you a great idea for a new business, put you out of a job, or killed your old business, 2021 may well be a year full of new opportunities. If the excitement and rewards of entrepreneurial life appeal to you, have a look at “Starting a Business” on the Small Business Site here for checklists and articles like –

• “#20Lessons20Years”,
• “Small business compliance guide”,
• “Where can I register my company in South Africa”, and so on.

Your first port of call however should always be your lawyer – not only are there important legal requirements to consider before you start up, but you need to choose the right vehicle and structure for your business (sole trader, partnership, company, trust etc) upfront.

© LawDotNews

What Must You Prove to Remove a Trustee?

“…where there is disharmony, the essential test is whether it imperils the Trust estate or its proper administration” (extract from judgment below)

Trustees are of course supposed to work together to protect and further the interests of their trust and its beneficiaries, but the fact is that on occasion serious disputes can and do arise.

If settlement negotiations fail and if there is no alternative but to forcibly remove a trustee our courts have the power to do so, on the application of either the Master of the High Court or of “any person having an interest in the Trust property”.

What must you prove for removal?

As to the grounds on which a court will agree to remove a trustee, a recent Supreme Court of Appeal (SCA) judgment confirms that “loss of mutual trust and respect does not, without more, translate to a ground for the removal of a trustee, or to a conclusion that the Trust property has been imperiled [Put at risk of being harmed, injured, or destroyed]. It must further be established that, as a result, the Trust property has been imperiled or the administration of the Trust and the management of its property are at risk. That is a factual enquiry …The determinative test is always whether any state of affairs – be it incompetence, misconduct, incapacity, or lack of trust and respect among trustees or beneficiaries –  has resulted in the Trust property or its proper administration being placed at risk.” (Emphasis supplied).

Importantly the Court added that in exercising its power to remove a trustee, “the courts do so with circumspection”.

Your work, in other words, is cut out for you.

Fighting in a family trust – the outcome

• A deceased businessman’s R2.8m share portfolio and a 75% share in a property-owning company were vested in a family trust, in which the deceased’s mother, step-father, brother, wife, adult children and accountant were all involved in one capacity or another.
• In short, relationships between the role-players soured, involving a flurry of accusations and counter-accusations of theft (reciprocal criminal charges being laid), oppressive conduct, conflicts of interest, collusion, vendettas – the list goes on.
• The wife (as trustee and beneficiary) together with her sons (the other beneficiaries), applied for the removal of the trustee in question, and after a long – and no doubt expensive – trek through the courts, ended up in the SCA.
• Finding on the proved facts that “the state of the relationship of the appellant and the respondent has not imperiled the Trust property or its proper administration. I find no other basis on which it would be in the interests of the Trust and its beneficiaries to remove the appellant” the SCA reversed a High Court order removing the trustee. The trustees are it seems just going to have to work this one through themselves.

© LawDotNews

POPIA: A Practical 4-Step Action Plan for your Business

“By failing to prepare you are preparing to fail” (Benjamin Franklin)

 

The media is still awash with warnings about the dangers of not complying with POPIA (the Protection of Personal Information Act). The risks of non-compliance are indeed substantial but whilst much is made of the fact that the Act itself is now in force, references to the one-year grace period for compliance expiring on 30 June 2021 appear only in the fine print (if at all).

But – and this is a big but – there are major benefits to understanding POPIA and starting the compliance process long before it becomes compulsory. The penalties for getting it wrong are sizeable, “preparation makes perfect”, you are giving yourself lots of time to get it right, and for many businesses there is also good marketing potential in being able to tell your customers and clients that you are already addressing the situation.

Four practical steps to start with…

Before we start on your action plan, get to grips with the fact that you will almost certainly have to comply fully with POPIA. As soon as you in any way “process” (collect, use, manage, store, share, destroy and the like) any personal information relating to a “data subject” (customers, members, employees etc etc), you are a “responsible party”. Very few businesses will fall outside that net. Equally you are unlikely to fall under exemptions like that applying to information processed “in the course of a purely personal or household activity”. Get going with these steps –

1. Assess what personal information you hold, how you hold it, and why: Figure out what personal information you currently hold, how you hold it, and why you hold it. To collect and “process” such information lawfully you need to be able to show that you are acting lawfully, reasonably in a manner that doesn’t infringe the data subject’s privacy, and safely.You must show that “given the purpose for which it is processed, it is adequate, relevant and not excessive”, data can only be collected for a specific purpose related to your business activities, and can only be retained so long as you legitimately need to or are allowed to keep it.

   There’s a lot more detail in POPIA, but you get the picture – you cannot collect or hold personal information without good and lawful cause.

2. Check security measures, know what to do about breaches: You must “secure the integrity and confidentiality of personal information in [your] possession or under [your] control by taking appropriate, reasonable technical and organisational measures to prevent … loss of, damage to or unauthorised destruction of personal information … and unlawful access to or processing of personal information.” You are going to have big problems if there is any form of breach from a risk that is “reasonably foreseeable” unless you can prove that you took steps to “establish and maintain appropriate safeguards” against those risks. Bear in mind that whilst cyber-attacks tend to get the most media time, there are also other risks out there – brainstorm with your team all possible vulnerabilities and patch them. 

   Any actual or suspected breaches (called “security compromises” in POPIA) must be reported “as soon as reasonably possible” to both the Information Regulator and the data subject/s involved.If third parties (”operators”) hold or process any personal information for you, they must act with your authority, treat the information as confidential, and have in place all the above security measures.

3. Check if you do any direct marketing: Most businesses don’t think of themselves as doing any “direct marketing”, but the definition is wide and includes “any approach” to a data subject “for the direct or indirect purpose of … promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject…”. So for example just emailing or WhatsApping your customers about a new product or a special offer will put you firmly into that net.If your approach is by means of “any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail”, you must observe strict limits. Whilst you can as a general proposition market existing customers in respect of “similar products or services” (there are limits and recipients must be able to “opt-out” at any stage), potential new customers can only be marketed with their consent, i.e. on an “opt-in” basis.
4. Get a start on procedures and training: Identify an “Information Officer” who will take on all compliance duties, establish procedures, and train your team in implementing them. Cover how you will collect the data, process it, store it, for how long, for what purpose/s and so on. What consent forms do you need and when/how are they to be completed and stored? You are much less likely to have a POPIA problem if everyone in your business (and most importantly you!) understands what your procedures are and implements them as a matter of course. Make sure that no functions “fall between two stools” – assign individual compliance tasks to named staff members and make sure everyone understands who is to do what.

This is a complex topic and there is no substitute for tailored professional advice. What is set out above is of necessity no more than a simplified summary of a few highlights.

© LawDotNews

The Pandemic and Business Interruption Cover – Can You Claim?

It’s no surprise that our media has been awash with reports on the recent High Court judgment around a restaurant’s business interruption cover claims.

The restaurant in question, like many other businesses of all types and sizes, has been suffering severe losses from being forced to close (and latterly trade under very limited conditions) during the lockdown. Its business interruption claim in terms of an “Infectious Diseases Extension” clause in its policy (which it had faithfully been renewing annually since 2007) was rejected by the insurers.

What caused your business losses? The two things you must prove…

Sued by the restaurant, the insurers raised a whole slew of defences to the claim, all of them ultimately rejected by the Court.

Of most interest to businesses holding this type of cover will be the central question of whether or not the wording of your particular policy, in particular any “notifiable disease extension” clause (which in this case was a no-premium, “free cover” extension) will cover you for losses sustained in the particular circumstances of this pandemic and the lockdown. 

The clause in this particular case promised cover for ”interruption or interference with the business due to (e) notifiable disease occurring within a radius of 50 km of the premises…”.

The insurer argued that this covered only losses resulting from business interruption “where the interruption is due to the Notifiable disease and not losses as a result of other causes” and that in this case business was interrupted not by the Covid-19 outbreak but rather by the lockdown “which is not insured under the Policy.”  It also argued that “there was no sufficient causal link between the Covid-19 outbreak and the [restaurant]’s eventual loss.” The restaurant, it said, could have taken out other policies to specifically cover it in these circumstances but it chose not to do so.

In a nutshell, the Court found that the restaurant had to show two things –

1. “The Covid-19 as a Notifiable disease, caused or materially contributed to the “Lockdown Regulations” that gave rise to the Applicant’s claim (this is a factual enquiry). If it did not, then no legal liability can arise…”
2. “If it did, then the second question becomes relevant, namely whether the conduct is linked to the harm sufficiently closely or directly for legal liability to ensue, or whether the harm is too remote from the conduct”.

Finding that the restaurant had indeed proved causation as above, the Court declared that it was covered for such of its losses as it “is able to calculate and quantify from time to time”.

So are you covered?

The insurers have said they are taking this matter on appeal to the Supreme Court of Appeal (the insurance industry as a whole of course faces substantial losses from these claims), but remember that your particular policy may anyway be worded so as to cover you. There are also media reports of similar claims being met by some insurers, and of interim relief being offered by others. As the Court in this case put it “each case must be decided upon its own facts and the law”.

Moreover the Financial Sector Conduct Authority (FSCA) says that “The National Lockdown cannot be used by any insurer as grounds to reject a claim” and that “policyholders are able to claim in instances where they can show that they have satisfied the requirements of their specific policy, whether it was before, during or after the national lockdown”. You can complain to the FSCA if you feel that you have been treated unfairly.

© LawDotNews

POPIA’s Deadline is 30 June 2021

POPIA’s Deadline is 30 June 2021 – Ignore the “Fake Headlines” But Start Planning!

At long last the main provisions of POPIA (the Protection of Personal Information Act) have been gazetted, and they will commence on 1 July 2020. That means that the one year transitional period will expire on 30 June 2021.

Don’t panic just yet, and ignore the many “fake headlines” in the media implying that you are at immediate risk of non-compliance, but at the same time don’t leave this to the last minute! Preparing for compliance is going to be a time-consuming affair, almost all South African businesses will need to comply, and the penalties for not doing so will be very severe indeed –

• You risk administrative fines of up to R10m;
• You could face criminal prosecution (with up to 10 years’ imprisonment);
• You could be sued for millions by anyone whose data has been compromised, and this is an instance of strict liability” in that no “intent or negligence” on your part need be proved;
• The loss of trust and the adverse publicity resulting if your data breach goes public could be devastating.

In future issues we’ll let you have a lot more practical advice on how POPIA will affect your business, and on the steps you will have to take to protect yourself from the dangers of non-compliance, but for now get started with this first planning step: Ask yourself what personal information you hold, where you hold it, who has access to it, and how secure it is. 

© LawDotNews

Lockdown Advice for Entrepreneurs

“The scale of the national COVID-19 lockdown is unprecedented in living memory. The repercussions – personal, professional, national and international – will reverberate for years to come. As entrepreneurs, we need to be making the right decisions for right now to ensure that our businesses and our people’s livelihoods do not become another casualty of the virus.”

At date of writing it is still unclear to what extent the Lockdown will be relaxed in each Province, but regardless of timelines the COVID-19 pandemic and the crisis it has landed us all in are not going anywhere in a hurry.

Businesses and perhaps SMEs in particular face both enormous challenges and many new opportunities. Some good solid advice on how they can navigate these stormy seas comes from Allon Raiz of Raizcorp in the form of a series of articles under the heading “Lockdown advice for entrepreneurs” here. To date eight articles are available –

• “Get to rational quickly”
• “Building an opportunity matrix”
• “Scenario planning as a vital tool”
• “Building an exploded resources list”
• “Creating a small list of big questions”
• “Embrace your X”
• “Cross-functional teams”
• “Moving from contingency planning to live decision making”.

© LawDotNews