Tech Legal Matters

During August 2020, we got to learn of a data breach at one of South Africa’s big credit bureaus, Experian. As mentioned in the previous episode of this podcast, the whole ordeal around how the data was accessed and the subsequent disclosure statements and interviews by Experian, left more questions than answers.

We’ve hard from Experian, South African Banks, and the Information Regulator of South Africa. Now, we will hear from an attorney regarding what rights you have as a consumer.

Joining us on this episode of the Tech Legal Matters podcast is Lucien Pierce, an attorney in South Africa who specializes in Cyber Law including data protection and privacy.

For several years since 2015, we at iAfrikan.com have been reporting on and researching various cybersecurity, data protection, and privacy-related matters around Africa. We have observed several patterns, some of the more worrying patterns are that many people seem to think that data breaches are victimless crimes.

Also, it rare that you will hear or read about authorities in Africa taking serious action against any organization fro failing to protect the data it handles. This is excluding in Nigeria, whereas Olufemi Daniel from the West African country's National Information Technology Development Agency has informed us in a previous episode of the Tech Legal Matters podcast that they have issued various notices regarding data breaches in the country and successfully collected a fine in the process.

In South Africa, during 2020 alone, we have heard of 3 notable data protection incidents that we know of. The first one was in June 2020 when Life Healthcare Group reported disruption to their IT systems due to a cyberattack. On 17 August 2020 another Johannesburg Stock Exchange-listed company, Momentum Metropolitan, would also downplay a cyberattack incident saying only limited data from one of its subsidiaries was accessed. The latest incident is among the more shocking, only because we have been able to learn more details about it.

On 19 August 2020, Experian South Africa was publicly reported to have experienced a data breach. This was first made public by the South African Banking Risk Information Center (SABRIC). Experian would only, reluctantly, issue their statement saying they curtailed a data incident.

In this special edition episode of the Tech Legal Matters podcast, we take you through everything you need to know about the Experian Data Breach. What their CEO, Ferdie Pieterse has shockingly said, what the banks are saying, and a social engineering incident that led to a 77-year-old woman losing over R100,000 in 30 minutes thanks to criminals using her details to convince her they were calling from a South African bank where she has a bank account.

Nigeria's National Information Technology Development Agency (NITDA), was established in 2007 under the West African country's NITDA Act. The NITDA is responsible for planning, developing, and promoting the use of Information Technology across Nigeria.

During January 2019, the NITDA published and was responsible for issuing the Nigeria Data Protection Regulation (NDPR). The NDPR is aimed at regulating and controlling the use of data in Nigeria, it mandates that, amongst other things, private and public organizations in Nigeria that control data of natural persons need to adhere to regulations around the collection, storage, processing, and transfer of such data.

Olufemi Daniel, the Lead of Regulations Monitoring and Compliance at the NITDA, joins us on this episode of Tech Legal Matters to explain what we need to know about the NDPR. Olufemi also shares some details on the upcoming revised NDPR draft bill.

You’ll often hear it being mentioned that South Africa has one of the best constitutions in the world. We could even go further and argue that this excellence in legal matters also extends into the country’s cyber laws. For example, considered a first world country, but the USA has yet to pass a law that specifically addresses personal data protection similar to South Africa’s Protection of Personal Information Act (POPIA).

Not only that, POPIA, as it is commonly known, is often argued that it compares favorably with the European Union’s General Data Protection Regulation - GDPR.

However, where South Africa often fails is in the enforcement of these laws and in some cases, their understanding and how they apply to our lives and businesses.

On this episode of the Tech Legal Matters podcast, we are joined by Sizwe Snail ka Mtuze, an attorney and Director at Snail Attorneys as well a Part-Time Member of the Information Regulator of South Africa. Sizwe explains the various cyber laws we have in South Africa and how they apply to our lives and organizations.

With more and more people going online and various apps and digital platforms becoming part of our daily lives, the legal and security risks associated with them are also increasing. This is because all these apps and platforms collect our data in various forms.

These digital platforms and apps sometimes take precautions to ensure that our data is securely stored and not accessible to anyone who shouldn’t have access to it. In some cases, like we have seen over the years at iAfrikan.com with various data breaches, this data can fall into the wrong hands.

Joining us on this episode of the Tech Legal Matters podcast is Rob Shavell, CEO of Abine, an American company that specializes in various solutions for personal data protection. Rob also explains what companies known as data brokers are and what they do.

When it comes to corruption, whether it be in the public or private sectors, South Africans generally lament that those accused of corrupt activities hardly ever face the consequences of their actions. This is due to several reasons some being that obtaining evidence of corrupt dealings and proving the corruption link often, legally takes time.

In this episode of the Tech Legal Matters podcast, we are joined by Nazreen Pandor, an attorney in Johannesburg who is also a certified fraud examiner. Nazreen explains how prosecuting corruption cases works and how whistleblowers and digital technology play an important role in these cases.

There has been significant growth in the number of financial technology solutions available to consumers in South Africa. More commonly known as FinTech, these solutions mainly aim to replace all the functions that a customer would typically perform in a physical bank branch with a digital app and platform.

However, this welcome convenience and efficiency come with its own legal and regulatory risks. Among those risks are privacy, data protection, security, to name but a few.

Joining us on this episode of Tech Legal Matters is Lucien Pierce, an attorney in South Africa, who will help us unpack some of the legal and regulatory considerations for FinTech solutions in South Africa.

On 25 May 2018, the European Union's General Data Protection Regulation came into force amid much coverage and fanfare. Many companies, especially Internet-based ones, scrambled to comply with GDPR to ensure to they don't suffer any penalties if they were to be found guilty of not complying with any of its laws.

In this episode of the Tech Legal Matters podcast, we are joined by Delphine Daversin, a French qualified lawyer with 17 years of experience with a strong focus on privacy and IT regulations. Delphine explains all the key components of GDPR and looks at some case studies of where it has been applied.

We also explore some similarities and key differences between GDPR and South Africa's POPIA.

Life Healthcare Group, a private healthcare company that operates private hospitals in South Africa and Botswana, recently said that their IT systems suffered "a targeted criminal attack." According to the company, the attack affected its hospital admissions systems, business processing systems, and e-mail servers.

South Africa has experienced a marked increase in cybersecurity attacks and data breaches in recent years. These attacks have spanned both public and private sector organizations in the country.

Joining us on this episode of Tech Legal Matters is Lucien Pierce, an attorney at PPM Attorneys in South Africa. Lucien discusses whether we should be worried as citizens and what recourse we have.

What we communicate on social media platforms may have consequences which can lead to legal prosecution. There have been several legal cases in South Africa around freedom of expression and defamation on social media.

In this episode of the Tech Legal Matters podcast, we are joined by Lucien Pierce, an Attorney at PPM Attorneys. Lucien takes us through some case law examples of how the law was applied in South Africa regarding freedom of expression and defamation as they relate to social media.

Looking at most of these cases, there's also a pattern that emerges: most of them involve high profile South Africans. Lucien elaborates on this too.