Episode 8

Welcome back everyone! I’m Linda Reid, head of Data at Lightstone.

Today we’re going to answer your questions about Lightstone products that are related to POPI. But before we get started on your questions, let’s come back to one of the most important and fundamental points - POPIA compliance. We need to be very clear that whenever we talk about whether something is POPIA-compliant, that this compliance relates to the ORGANISATION DOING THE PROCESSING, and not to the DATA. POPIA compliance is related to the processing. There’s no such thing as data that is POPIA compliant. There is only a company that has handled the data in compliance with POPIA.

Exactly and thank you for making that critical distinction Linda. And hello again from me to all our listeners. I’m Esteani Marx, Head of Real Estate Agents at Lightstone.

So going back to the distinction you just made .. what this means is that no company – not Lightstone or any other company – can make data POPIA-safe for you. Every single Responsible Party that handles the data has to do so within POPIA’s framework. For example, the Deeds Office has to handle the Personal Information it manages within POPIA’s stipulations. Then Lightstone also needs to handle that same data within POPIA’s requirements. And so it carries on, for every single company that handles that data.

Yes. So when you retrieve information from Lightstone, you are now also a Responsible Party, as you’re choosing what to retrieve and what to do with it. And so you need to adhere to the Eight Conditions for lawful processing, which we discuss in this Podcast series in episodes three and four.

I hope this is crystal clear for all our clients, as this is fundamental to how things will work going forward. With this in mind, what has Lightstone been doing about POPIA compliance?

We have run a very extensive program, for the last 10 months, on all aspects of our business, to ensure we comply with POPIA. This included taking a very close look at all 18 Sections within the Eight Conditions for Lawful Processing, and then making adjustment to many facets of our business to bring us in line. One of the aspects relevant to this conversation is Legal Grounds.

Yes, we keep emphasizing in this podcast that if you process Personal Information as a Responsible Party, you have to have Legal Grounds to do so. Does Lightstone have consent to process the Personal Information of home owners?

So as you know there are Six Legal Grounds, consent being one of them. In Lightstone’s case, consent is not the legal ground that is most appropriate to how Lightstone processes Personal Information. In most cases, Lightstone’s legal ground is that it is in the legitimate interests of the responsible party or a third party to whom the data is supplied, to process that Personal Information.

I can understand why it’s in Lightstone’s and our clients’ interests to process information in order to produce reports and other products. But this seems like a fairly easy justification for the processing?

It’s not as simple as it sounds. If you want to rely on those legal grounds, you need to ensure that your legitimate interest does not override the Data subject’s right to privacy and right to have a say in how their data is used.

How do you do that?

Well, there is no local guidance or precedence yet, as POPIA is still so new. But in the EU, they have a law called the GDPR, which is very similar to POPIA in a lot of ways and has been in action for 3 years now. So we followed the UK guidance on how to do assessments to determine whether Legitimate Interest actually applies. For each product, we did an extensive assessment covering our interests, our clients’ interests, and the interests of the Data Subject.

What’s the point of an assessment like that?

If it’s done correctly and objectively, it identifies whether you can use Legitimate Interests as your legal grounds to process the data. It also identifies any potentially problematic parts of the product, which can then be amended accordingly.

So is this what Lightstone has done?

Yes. For example, there were a few potentially problematic components of our reports that the assessments identified. So we made a couple of changes, which we’ll get into a bit later on.

Okay, thank you for that context. Now for the question that we receive most often from our Estate Agent clients: Will they still be able to purchase the contact details of homeowners to use when canvassing for potential listings?

POPIA is pretty clear on this topic – if you want to process data for the purposes of Direct Marketing to non-customers, you must have their consent. Our current provider of contact details does not have consent from all data subjects for Direct Marketing purposes by Estate Agents. And nor do we. So from their side and ours, this service will not be provided in the same way after 1 July.

I guess all our clients are eager to know how it will work after 1 July. Lightstone has been working hard to find an alternative for our clients, and we’re still working on options. Because Estate Agents are the Responsible Party for the use of that data, they’ll need to contract directly with the suppliers, but Lightstone will facilitate the connection with those suppliers.

What’s important for our Estate Agent clients to truly understand is that the responsibility, and the liability, is yours whenever you handle and use Personal Information. So please be wary of any data providers who claim that the data is POPIA-compliant. As we said earlier on, nobody can make data ‘safe’ for you. If you use data for Direct Marketing, you are responsible and must ensure you have the right to use it.

How do you suggest our Estate Agent clients do that?

Well, if a company tells you that their data is POPIA-Compliant, ask whether that means that the provider has secured written consent for the contact details to be used specifically for purposes of Direct Marketing by Estate Agents to solicit listings. And then ask to see the consent given. If the answer is no, then enquire further about what the data is permitted to be used for.

Okay, so that relates to the contact details. It seems there’s a lot that needs to change in this space.

Yes, this is a very impactful and far-reaching piece of new legislation. Much like when the National Credit Act came into being more than 10 years ago. There will definitely be a period of change, and figuring out what the new normal is. But it is the law and we must all comply.

What about the Lightstone reports and the Personal Information in those?

POPIA is absolutely not intended to stop people from using Personal Information for legitimate purposes. The Act specifically references that its purpose is partly to protect interests such as the free flow of information, but that this must be done by balancing these interests with people’s right to privacy. So the use of Personal Information within Lightstone’s reports is absolutely permitted if it’s used and or processed within the framework of POPIA.

Some of our clients have told us that they’ve heard that the data from the Deeds Office is public data and that POPIA doesn’t apply. Is that true?

Unfortunately that’s a common misconception. POPIA absolutely applies to private and public bodies, though there are a few parts of it where the application for public data is slightly different. Any party who chooses to get Personal Information, even if they’re getting it from a public source, and decides what to do with it, must work within the Eight Conditions for Lawful Processing. That is clear.

What does that mean practically for our clients, in terms of Lightstone’s Toolkit and reports?

In a nutshell, the main consideration is that if you want the reports to contain the name and ID number of the homeowner, you need to have one of those Six Legal Grounds, which we discuss in Podcast episode 2. If you are dealing with a homeowner in order to help sell their home, it’s easy to have one of those legal grounds. Even if you haven’t yet contracted with them yet, but you’re exploring that option, ask if you may retrieve a report on their property that will help you guide them in exploring the possibility of a sale. If they say yes then that’s consent.

But what if you’re not yet in contact with that homeowner and want to understand their home better in order to have that discussion?

If you don’t have legal grounds to receive their Personal Information, you absolutely can still get a report with all the rich property information on it that will enable you to understand that property well enough. The only difference is that it won’t have the owner’s name and ID number on it, if you haven’t got one of the Six Legal Grounds.

But all the rest of the content will still be there?

Almost all. We have removed the names and ID numbers from the Transfer History section, but kept the values and dates because, if you think about it, the people who historically owned that property have nothing to do with the current conversation about the sale of that home. They can’t possibly have a say in the use of their Personal Information on that report, and there is little chance you have legal grounds to see their PI. We believe that this component of the report is not necessary for the purposes that the report exists anyway.

What if our clients believe they do have legal grounds to see the transfer history, including the PI? Or any other elements?

We would very much encourage our clients to talk to us about these cases. Lightstone is absolutely committed to bringing our clients the valuable services that they need from us in order to make their jobs easier, as long as it’s within the bounds of the law. POPIA readiness has been, and continues to be, a journey for us too, and we are very open to amending things, should there be a responsible way to do so.

Also, some types of clients who use our services may well have legal grounds for the use of Personal Information in a way that others may not, and we will then make those services available to them. For example, our Valuation company clients have several very valid and legal-use cases to consume the names of prior owners of a property, so we will enable the purchase of Transfer History information with Personal Information to them.

Yes, so please get in contact with us. If there’s a service you need for which you have legal grounds to process the PI and you’re not able to access that information, let’s look into it.

We’ve mentioned needing to know whether our clients have legal grounds. How will this actually happen?

Our Toolkit will guide you and give you the relevant prompts. We’re very aware that any change in a business practice requires adaptation. So we’ve tried to build changes into our Toolkit that will prepare and guide you around what you need to do, as much as possible. And if you have any feedback on this, or how we could improve it, please do let us know. We want to support you in the best way possible.

So apart from those two changes, will our clients continue to get all the same services from Lightstone?

Not exactly. A couple of our reports contain the Personal Information of a large number of data subjects, and it’s very unlikely that estate agents will have consent or contract with every owner in a street, for example, or any other legal grounds. These reports may not be available in future. The predominant use of these reports is to use the ID number to source contact details in order to canvas prospective listings, and this a purpose that our Legitimate Interests Assessment did not pass the test for, because we do not have permission from all those homeowners to pass on their PI to be used for Direct Marketing purposes.

As you said earlier, this new law is pretty impactful!

Yes. In fact I heard POPIA being described as one of the most far-reaching laws implemented this century. If you think about it, we live in a data processing world so this law will really impact the way so many businesses operate. But as data subjects ourselves, we must never forget that POPIA gives us back the control over our Personal Information, and enforces the right to privacy of every individual. So that, ultimately, is a good thing for everyone. But it will require some adjustments. From all of us.

That’s so true. And Lightstone understands that this period of change will be difficult for many parties. That’s why we spent these past 10 months doing extensive work to make sure we are in the best position to help our clients. And will continue to work tirelessly to make sure we can deliver as much, if not more, value to our clients. So please, if you have any questions or suggestions, send them to us at info@lightstone.co.za. We are here for you and we can support you. Simplifying the complex is what we do after all, and POPIA can be complex!

That is so true. Thank you, once again, to our listeners for joining us. It’s good to know that help is at hand and that Lightstone is doing everything it can to support Estate Agents to stay on the right side of the law.