Does our club need the Information Regulator's authorisation to post photos of children?

Q: Does our club need the Information Regulator's authorisation to post photos of children?

Not if the processing fits one of the exceptions in section 35(1), most commonly the prior consent of a competent person (a parent or guardian). When an exception applies, the section 34 prohibition does not apply, so no authorisation is needed. Authorisation under section 35(2) is for a responsible party that wants to process children's personal information without one of those grounds. The Regulator may grant it by notice in the Gazette only if the processing is in the public interest and appropriate safeguards are in place. It can attach conditions, such as letting a competent person review the information and refuse further processing, giving notice of what is processed and how, and not encouraging a child to disclose more than is reasonably necessary. The Regulator's 2021 Guidance Note on Processing of Personal Information of Children sets out the application process. Applications are made on the form in the guidance note and emailed to authorisationIR.PIC@justice.gov.za (post and hand delivery are also accepted). Sources: POPIA (Act 4 of 2013) ss 34-35; Information Regulator, Guidance Note on Processing of Personal Information of Children (2021).

Question

Accepted Answer

Not if the processing fits one of the exceptions in section 35(1), most commonly the prior consent of a competent person (a parent or guardian). When an exception applies, the section 34 prohibition does not apply, so no authorisation is needed.

Authorisation under section 35(2) is for a responsible party that wants to process children's personal information without one of those grounds. The Regulator may grant it by notice in the Gazette only if the processing is in the public interest and appropriate safeguards are in place. It can attach conditions, such as letting a competent person review the information and refuse further processing, giving notice of what is processed and how, and not encouraging a child to disclose more than is reasonably necessary.

The Regulator's 2021 Guidance Note on Processing of Personal Information of Children sets out the application process. Applications are made on the form in the guidance note and emailed to authorisationIR.PIC@justice.gov.za (post and hand delivery are also accepted).

Sources: POPIA (Act 4 of 2013) ss 34-35; Information Regulator, Guidance Note on Processing of Personal Information of Children (2021).