Review Questions

The following review questions are designed to test your understanding of key concepts from each module. Answer each question in your own words, drawing on the material covered in this course and your own analysis.

A customer provided their email address when purchasing a product from an online store. The company now wants to send marketing emails about unrelated products. Can the company rely on the soft opt-in to send these marketing emails? Explain your answer with reference to the conditions for the soft opt-in under Section 69.

An employer wants to process employees' health information to assess fitness for duty. The employer argues that consent is not required because the processing is necessary for operational safety. What legal basis and authorisations are required for this processing, and what factors should the employer consider?

A company experienced a data breach affecting 500 customers. Personal information including names, addresses, and credit card numbers was accessed by an unknown party. The IT team fixed the vulnerability within 24 hours. What notification obligations exist under Section 22, and to whom must notification be made? What factors should the company consider in deciding whether to notify?

A school wants to implement biometric fingerprint scanning for its cafeteria payment system. The system would collect and store fingerprint data for all students. What POPIA requirements must be addressed before implementing this system? Consider the requirements for processing children's information and biometric information.

A South African company transfers customer data to its parent company in India for processing and analysis. There is no data protection agreement in place between the companies. What are the compliance issues under Section 72, and what mechanisms could be used to address them?

A data subject requests access to all personal information held about them by a retail company. The company estimates that compiling the information will take 60 hours because data is spread across multiple systems. How should the company handle this request under Section 23? Can the company refuse the request on the grounds of effort?

A marketing company purchased a database of email addresses from a data broker and has been sending promotional emails. Recipients have complained that they never consented to receive these emails. What POPIA provisions have been violated? What should the marketing company do now?

An organisation wants to install CCTV cameras with facial recognition technology in its office building to enhance security. The cameras will capture images of employees and visitors. What compliance steps must the organisation take under POPIA, particularly regarding the processing of biometric information?

A company has been retaining employee records, including performance evaluations and disciplinary records, for 20 years after termination of employment. The company has no specific legal basis for this retention. What does POPIA require regarding retention, and what should the company do?

A hospital shares patient records with a research institute for a clinical study on diabetes treatment. The patients were not asked for consent because the hospital considered the research to be in the public interest. Is this sharing lawful under POPIA? What conditions would need to be met?