DAMA JOHANNESBURG CHAPTER EVENT: POPI

John Cato: BIO
John Cato has more than 30 years of experience in the IT industry, approximately half of which have been spent in vendor organisations and the other half in user organisations.  During this time, he has gained experience in strategic planning, infrastructure architecture, information security, business intelligence, compliance, governance, project management and vendor relationship management.
A few years ago, John became aware of the fact that South Africa is more than 20 years behind other countries in privacy and protecting personal information.  Since 2013, he has been placing a strong focus on helping organisations to prepare for complying with the Protection of Personal Information (POPI) Act signed into law in 2013 and best practices for privacy and data protection. He also believes there are good business reasons for taking proactive steps in protecting personal information. 
John has experience in several areas relating to data privacy and protection:

• Co-authored multiple articles about data privacy and protection and POPI
• Spoken at multiple workshops on data privacy and protection and POPI
• Consulted to multiple clients on data privacy and protection and POPI
• Managed multiple projects data privacy and protection and POPI
• Developed multiple consulting tools for data privacy and protection and POPI

 
John Cato: POPI
The Protection of Personal Information (POPI) Act is a law which provides several conditions for the lawful processing of personal information. Preparing for compliance with the act should be a high priority for all organisations in SA. While there have been delays in the full commencement of the act, the Information Regulator has been appointed and is being established at present. The commencement of the POPI Act is expected to be announced towards the end of 2017.  There are a number areas that require action for preparing for POPI compliance. A number of these have implications on information management teams.  They include:

• Information quality of personal information;
• Special personal information;
• Personal information of children;
• Rights of data subjects

 
This presentation highlights how Enterprise Information Management (EIM) can be a key enabler for complying with the POPI Act and how your Information Management team can contribute significantly to your organisation’s compliance initiative.  It will also cover additional benefits that can be obtained through a personal information focused approach to EIM.

Arthur Britz: BIO
Arthur Britz is the CEO of HTSA Pty Ltd, an EOH Company instrumental in driving Information Services forward. An accomplished professional having held many executive positions in data and information related fields having grown through the ranks of EIS developer, project manager, enterprise architect during a career spanning more than 20 years. He has worked with Absa/Barclays, Standard Bank SA, MTN Group, Mr. Price Group, TransUnion, Old Mutual, Liberty Life and other leading business houses in Sub Saharan Africa. He is passionately seeking revolutionary approaches to solve data and organizational challenges to drive value from the use of data/information.
 
Arthur works with senior business and technology stakeholders, driving enterprise architecture, data and information management practices in customer, risk/finance, and core banking and information management. He has architected and deployed numerous applications in the banking domain including advanced analytics, CRM lead management, customer management and business intelligence. He provides strategic advice for program delivery and ensures that programs are running optimally at client locations. Arthur is a certified executive coach and mentor, and holds a current private pilot’s license.
 
Arthur Britz: POPI
More and more stringent regulations are and will continue to be promulgated globally to ensure institutions conduct themselves in a responsible manner when collecting, processing, storing and sharing another entity’s personal information (PI) by holding them accountable should they abuse or compromise your PI in any way. 
Your PI are “precious” and therefore these acts bestow to you, as the owner of your PI, certain rights of protection and the ability to exercise control over it.
PI is scattered across a vast landscape in multiple digital formats, in multiple data stores and used in very diverse usage patterns. 
How do one even start to contain the risk of the PI being compromised or misused given these vast data landscapes to comply with
POPI is a data-centric problem hence emphasis to be drawn on understanding:

• What PI do you have in your custody?
• What is its classification?
• Where is it stored?
• Who uses it and for what purposes are it used?
• How is it used?
• What is the quality of the information stored?
• How is the information maintained and retired as and when required to do so?
• How, if requested by the rightful owner, would the processes (data lineage, data quality, meta data (data about the data)), controls, safeguards and measures pertaining to the collection, storing and processing of the information be made transparent?