1. The purpose of this form

This form does two things, and the Independent Communications Authority of South Africa (“ICASA”) asks you to read both before you sign. The first thing, notification, gives effect to section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”), which requires a responsible party to tell the data subject what personal information it collects, why it collects that information, and who will receive it. The second thing, consent, gives effect to section 11(1)(a) of POPIA, which makes the data subject’s consent one of the grounds on which processing becomes lawful. That is, section 18 governs what ICASA owes you before you sign, and section 11 governs the ground on which ICASA may process what you supply afterwards. That order matters, because section 1 of POPIA defines consent as a voluntary, specific and informed expression of will, and a signature that is given without the notification is none of those three things.

2. The responsible party and the Information Officer

ICASA is the responsible party for all the personal information that this form covers. ICASA’s Information Officer, who is contactable at compliance@icasa.org.za, is accountable for the way in which ICASA processes that information, because sections 55 and 56 of POPIA place the duty to encourage compliance on the Information Officer personally. That accountability does not pass to the recruiting manager who reads your application, and it does not pass to the panel that interviews you. Those officials process your personal information on ICASA’s instruction, while the Information Officer answers to the Information Regulator (South Africa) for what they do with it.

3. Why ICASA requires your personal information

ICASA requires your personal information on two footings, and Table 1 separates them. The first footing, the voluntary one, carries the information that ICASA requests so that it can perform its own functions, which means that you may decline to supply it and must then accept the consequence that clause 10 states. The second footing, the mandatory one, carries the information that legislation obliges ICASA to collect and to report, which means that refusal is not open to you while the employment or the contract subsists. Read each purpose in Table 1 against its footing before you sign, because the footing decides whether refusal is open to you at all.

Table 1: The purposes for which ICASA processes your personal information

Footing	Purpose	The authority for the purpose
Voluntary	Verification of your employment history, your educational and professional qualifications, your registrations and your licences	Your consent under section 11(1)(a) of POPIA
Voluntary	Verification of your criminal record where the post requires it	Your consent under section 27(1)(a) of POPIA, read with section 33, because criminal behaviour is special personal information under section 26
Voluntary	A credit check where the post involves the handling of finances or a position of trust	Your consent under section 11(1)(a) of POPIA, read with the National Credit Act 34 of 2005, which permits a credit bureau to release a report for an employment purpose
Voluntary	Direct communication with you about the vacancies and the contracting opportunities that arise at ICASA	Your consent under section 11(1)(a) of POPIA
Voluntary	Administration of your benefits, which includes the medical scheme and the retirement fund	Your consent under section 27(1)(a) of POPIA, because health information is special personal information under section 26
Voluntary	Screening of the social media accounts that you have made public, limited to the material that bears on the inherent requirements of the post	Your consent under section 11(1)(a) of POPIA, read with the minimality condition in section 10
Voluntary	Capture and maintenance of your record in ICASA’s human resources information system and in its supporting registers	Your consent under section 11(1)(a) of POPIA, read with the documentation duty in section 17
Mandatory	Keeping of the employment records that legislation prescribes, and reporting to the State	The Basic Conditions of Employment Act 75 of 1997 (sections 29 and 31), the Employment Equity Act 55 of 1998 (sections 21 and 26), the Skills Development Act 97 of 1998 and the Employment Services Act 4 of 2014
Mandatory	Payment of the statutory levies, contributions and deductions that arise from your appointment	The Skills Development Levies Act 9 of 1999, the Unemployment Insurance Contributions Act 4 of 2002, and the Income Tax Act 58 of 1962 read with the Tax Administration Act 28 of 2011

4. Special personal information

Some of the information that Table 1 covers is special personal information, and POPIA sets a higher bar for it. Section 26 of POPIA prohibits the processing of special personal information as a general rule, and it lists criminal behaviour, health, biometric information, race and ethnic origin among the categories that the prohibition covers. Section 27(1)(a) lifts that prohibition where the data subject consents, and consent is the ground on which ICASA relies when it asks for your medical scheme particulars and when it requests your police clearance certificate. Your race and your ethnic origin sit under a different provision, however. Section 29 of POPIA permits ICASA to process that information so that ICASA can comply with the Employment Equity Act 55 of 1998, which is a law that was designed to advance the persons who were disadvantaged by unfair discrimination. Therefore ICASA does not ask for your consent to that purpose, and this form does not record one.

Here is what this means in practice. If you strike out the medical scheme line on your appointment pack, ICASA’s benefits administrator cannot enrol you on the scheme, because the general consent that you give at clause 12 does not reach special personal information that you have expressly withheld.

5. The accuracy of the information

Section 16 of POPIA requires ICASA to take reasonably practicable steps so that the personal information which ICASA holds is complete, accurate, not misleading and updated where necessary. That duty rests on ICASA as the responsible party. However, ICASA cannot discharge the duty from one side alone, because the record can only be as accurate as the particulars that you supply and the changes that you report. Therefore you are required to notify the Human Resources Division in writing whenever your surname, your banking details, your qualifications or your contact particulars change.

Consider the ordinary case. The payroll administrator runs the November payroll against a bank account that you closed in October. The bank reverses the payment on the second working day of December. The administrator then raises a manual payment, which ICASA can release only once you have supplied a stamped bank confirmation letter. By the time the offices reopen in January, you have gone six weeks without a salary that ICASA had in fact paid.

6. The storage, retention and destruction of the information

ICASA stores your personal information electronically, and ICASA keeps a limited set of documents in hard copy where an original signature is required. (The signed original of this form is one of them.) Section 19 of POPIA secures both stores, because that section obliges ICASA to maintain the appropriate technical and organisational measures against loss, damage and unlawful access. Retention is governed by section 14, which permits ICASA to keep a record only for as long as the purpose requires or the law prescribes. The prescribing laws differ by record. The Basic Conditions of Employment Act sets three years for the employment records that section 31 lists, and the Tax Administration Act sets five years for the records that support your PAYE deductions. Above both of those sits the National Archives and Record Service of South Africa Act 43 of 1996, which governs the disposal of ICASA’s records because ICASA is a public body. Therefore no record of yours may be destroyed except under an approved disposal authority. Where no statute prescribes a period, ICASA keeps the record for seven years from the date of the last entry and then destroys it in a manner that prevents its reconstruction.

The unsuccessful candidate runs on a shorter clock. Where you apply for a post and the selection panel does not recommend you, ICASA keeps your application only for the period that its records retention schedule sets for recruitment files, which is the period that ICASA needs so that it can answer a challenge to the selection. After that period ICASA destroys the application, unless you have asked in writing to remain on the candidate register.

7. Who receives your personal information

ICASA discloses your personal information to the recipients that Table 2 lists, and to nobody else without a further consent from you or a lawful ground that ICASA can name. Every recipient outside ICASA that processes the information on ICASA’s behalf is an operator, which means that sections 20 and 21 of POPIA require a written contract between that operator and ICASA, and the contract obliges the operator to hold your information under the same security conditions that bind ICASA. Ask the Information Officer for the register of current operators if you want to see who holds your record today.

Table 2: The recipients of your personal information

Recipient	What the recipient receives	The ground for the disclosure
ICASA’s Human Resources Division and the line manager of the post	Your application, the verification results and your employment record	Internal processing for the purposes that Table 1 sets out
ICASA’s Payroll Section and its payroll bureau	Your banking details, your tax reference number and your remuneration record	An operator contract under sections 20 and 21 of POPIA
The retirement fund administrator and the medical scheme administrator	Your identity particulars, your dependant particulars and your contribution record	Your consent under section 27(1)(a) of POPIA
Verification agencies, credit bureaux and the South African Police Service	Your identity number, your qualifications and, where the post requires them, your criminal and credit particulars	Your consent, limited to the verification purposes in Table 1
The South African Revenue Service, the Unemployment Insurance Fund and the relevant Sector Education and Training Authority	The statutory returns that name you	The Acts that Table 1 lists on the mandatory footing
The Auditor-General of South Africa and ICASA’s internal auditors	Access to the records that fall within the scope of the audit	The Public Audit Act 25 of 2004
ICASA’s attorneys, the CCMA, a bargaining council, an arbitrator or a court	The records that are relevant to the dispute	Section 11(1)(f) of POPIA, which covers the legitimate interests of the responsible party
A prospective employer or client to whom ICASA refers you as a candidate or a contractor	Only the information that the party needs so that it can decide whether to employ or to contract with you	Your consent, given specifically for that referral

8. Transfers outside the Republic

Section 72 of POPIA restricts the transfer of personal information to a recipient outside the Republic. ICASA makes such a transfer only where one of the section 72 grounds is met, and for ICASA that means one of two grounds. The first ground is that the recipient is bound by a law, by binding corporate rules or by a binding agreement that upholds conditions for the lawful processing of personal information that are substantially similar to those in POPIA. The second ground is that you have consented to the transfer. Here is what this means in practice. Where ICASA’s payroll bureau hosts your remuneration record on a server in another country, the contract that binds the bureau carries the POPIA conditions through to that server, and the Information Officer must be able to produce that contract to the Information Regulator on request.

9. Your rights over the information that ICASA holds

POPIA gives you five rights over the information that ICASA holds, and Table 3 records each right, what the right allows you to do, and how you exercise it. The Information Officer receives every request that Table 3 describes. ICASA answers you in writing, and it gives reasons where it refuses a request.

Table 3: Your rights and how you exercise them

The right	What the right allows you to do	How you exercise it
Access (section 23)	Confirm whether ICASA holds your personal information, and obtain the record or a description of it	A written request to the Information Officer at compliance@icasa.org.za, made in the manner that the Promotion of Access to Information Act 2 of 2000 prescribes
Correction or deletion (section 24)	Ask ICASA to correct or to delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained	Form 2, which Regulation 3 of the POPIA Regulations prescribes, delivered to the Information Officer
Objection (section 11(3)(b))	Object to processing that rests on ICASA’s public law duty or on its legitimate interests	Form 1, which Regulation 2 of the POPIA Regulations prescribes, delivered to the Information Officer
Withdrawal of consent (section 11(2)(b))	Withdraw the consent that you give at clause 12, without affecting the lawfulness of the processing that took place before the withdrawal	A written notice to the Information Officer
Complaint (section 74)	Ask the Information Regulator to investigate the way in which ICASA processes your personal information	Form 5, which Regulation 7 of the POPIA Regulations prescribes, delivered to the Information Regulator

10. What follows if you decline to supply the information or withdraw your consent

Refusal carries different consequences on the two footings that Table 1 sets out. Where you decline to supply information on the voluntary footing, ICASA does not compel you, but ICASA may be unable to complete the verification, to enrol you on a benefit, or to consider you for a post whose inherent requirements include that verification. Where the information sits on the mandatory footing, refusal is not open to you, because the obligation binds ICASA and does not rest on ICASA’s discretion, and a missing tax reference number leaves ICASA in breach of the Fourth Schedule to the Income Tax Act.

Withdrawal of consent carries a consequence of the same shape. Where you withdraw the consent on which a purpose in Table 1 depends, and no other ground in section 11(1) of POPIA supports that purpose, ICASA stops processing your information for that purpose. Therefore the outcome that depended on the processing falls away with it, so an enrolment that ICASA cannot administer lapses and a verification that ICASA cannot complete leaves the appointment unconfirmed. ICASA does not treat the withdrawal itself as a breach of your contract.

11. Security compromises

Section 22 of POPIA obliges ICASA to notify you where there are reasonable grounds to believe that an unauthorised person has accessed or acquired your personal information. The Information Officer gives that notification in writing and as soon as reasonably possible after the discovery of the compromise, and the Information Officer notifies the Information Regulator of the same compromise. The notification states what happened, which of your information was involved, what ICASA has done about it, and what you can do so that you limit the harm to yourself.

12. Declaration and consent

By selecting “I Agree” and proceeding to view the available jobs, I sign this form as the data subject, and I declare and consent as follows. I confirm that the information which I have supplied to ICASA is complete, accurate and not misleading. I undertake to notify the Human Resources Division in writing of every change to that information. I consent to ICASA collecting, processing, storing and destroying my personal information for the purposes that Table 1 sets out and for no other purpose. I consent to the disclosure of my personal information to the recipients that Table 2 lists, on the grounds that Table 2 states. I consent, specifically and separately, to the processing of the special personal information that clause 4 identifies. I confirm that I have read clauses 1 to 11, that I understand the rights that Table 3 records, and that I give this consent voluntarily.

Information Officer email: compliance@icasa.org.za