Alice Letsoalo: Welcome to Perspectives Fasken Legal Voices on Business.
Hello, everyone. Thank you for joining us.
In this latest episode of Fasken Perspectives, The Voice of Business Law.
My name is Alice Letsoalo, a candidate attorney in the Dispute Resolution practice
at Fasken. I am joined today by my colleagues who will introduce themselves.
Catherine Hendricks: I'm Catherine Hendricks, a Candidate Attorney, also in the Dispute Resolution
practice at Fasken.
Jessica Rajpal: I am Jessica Rajpal, a partner in the Dispute Resolution practice at Fasken.
Catherine Hendricks: On this episode, we will be talking about the relatively new kid on the block, cyber
security. Today we'll be looking at governance risk and cyber crimes in so far as
it relates to the Cyber Crimes Act, as well as the so-called Prince of data protection
Papia. Then we will address how cyber security affects organizations.
And in this part of our discussion, we intend to give a brief overview of key
elements of contracts with service providers who ensure the overall cybersecurity hygiene
of your organization.
And so on that note, I'm going to hand it over to Alice.
Alice Letsoalo: Thank you, Kath.
So first things first is for us to define what corporate governance is as it relates to
cyber security.
And it is defined as a practice by which companies are managed and controlled and as
also being concerned with holding the balance between economic and social goals and
between individual and communal goals.
So for purposes of our discussion today, we want to focus on the role that corporate
governance has on the executive and our board level oversight in cyber security.
And we do know that Jessica is going to touch on that for us a bit later.
So we thought it would be an interesting topic to get into because usually when we
consider corporate governance, we think about the elements of financial integrity,
legal and regulatory compliance and et cetera.
However, we do know that in the wake of cyber attacks, that has cost multiple
enterprises millions.
Corporate governance in the context of cyber security has also become increasingly
important. So I think it begs the question of how cyber governance can be evolved in
order to take into account the threats on our business operations.
Catherine Hendricks: Yes. So some of the four major areas in which cyber governance can be evolved, namely
inverting the cyber security leadership responsibility, adopting the right cyber
security framework, addressing the organization structure.
So let's start with the very first element, Jessica.
What do we mean by inverting the cyber security leadership responsibilities?
Jessica Rajpal: Kath I'm so glad we're having this conversation.
If it isn't front and center of boardroom discussions, it certainly should be.
What we know is that traditionally the approach to cyber security has been a bottom
up approach, meaning that the IT team or an employee with experience is asked to identify
cyber security defense mechanisms and to prepare response policies.
These are usually developed as technical tools, but often have little regard to the
operational implications in a business.
It is, however, important to note that a cyber security governance model that is
inverted to a top down approach may direct the directors and the management of the
enterprise to establish a cyber security framework that takes into account the
financial, legal, regulatory and reputational risks of a cyber attack.
Using this information, a company can then curate the necessary technical tools to
prevent such cyber attacks.
And on that score, Kat, this should raise an alarm in the minds of executives about some
of the legal and regulatory implications in respect of cyber security.
More specifically, the Cyber Crimes Act is important.
Directors must be aware, for instance, of what constitutes a cyber crime, what steps to
take when one is faced with a cyber attack, specifically in relation to the to the Cyber
Crimes Act and some of the protections that are available to them when faced with a cyber
attack. Additionally, Catherine, and in accordance with the proclamation in the
Gazette, we know that certain aspects of the Cyber Crimes Act came into operation on the
1st of December 2021, and we now know that there are a few gazetted cyber crimes that
are punishable by fine or imprisonment.
These include unlawfully accessing a computer system or computer data storage
medium, which allows the person to intercept data or interfere with data or the computer
system and unlawfully intercepting data, for example, acquiring, viewing, capturing or
copying any data that is non-public, so as to make it available to a person other than
the lawful owner or the holder of the data.
There are a few more, Kath, but I won't go into all of them today.
Alice Letsoalo: And if I can just highlight that we also know that the South African police services, its
members and also its investigators have now been given an extensive powers to search, to
access, seize certain articles and investigate these cyber crimes.
Jessica Rajpal: That's correct, Alice.
And it is an interesting development that we are keeping an eye on.
Alice Letsoalo: So bringing it back to the question of corporate governance with an action of the
Cyber Crimes Act, we see a greater need for a cyber governance framework that takes all
of this into consideration.
Most notably absent, however, was the provision in the Act that imposes reporting
obligations by financial institutions and electronic communications service providers.
So as it currently stands, financial institutions and electronic communications
service providers are not yet obliged to report cyber crimes within 72 hours to the
SAPs after having become aware of the offence and to preserve any information that
may assist the SAPs with its investigations relating to the alleged offences.
Indeed, Kath. But I think equally as important to note is it will eventually come
into effect some day in the future and so such enterprises must be aware of this and
they must incorporate reporting procedures in their policies.
Otherwise once it's in operation, this could actually lead to a fine of not exceeding
50,000 rand.
But I think it leads us nicely into our topic regarding Poppy or the Poppy Act,
because more often than not, when we think of a cyber attack.
There's a great possibility that this information was personal information or even
special personal information as defined by Poppy, which was breached.
Jessica Rajpal: Yes, Alice. So the Poppy Act and the Cyber Crimes Act are really meant to complement
each other with the Poppy Act protecting personal information.
And on the same token, one could view the Cyber Crimes Act as a means to also protect
personal information and make data breaches punishable offences where offences relating
to data, data breaches, ransomware attacks, cyber forgery and cyber extortion are likely
to become prevalent.
So Jas, Alice alluded to the reporting obligations that will come into effect in the
foreseeable future in terms of the Poppy Act.
What are some of the reporting duties that may exist under that legislation?
So Kat, certain cyber crimes constitute reportable data breaches.
And in terms of Poppy, what this means is that where there are reasonable grounds to
believe that the personal information of a data subject has been accessed or acquired by
an unauthorized person, the responsible party would, as a general rule, have to
notify the information regulator and the relevant data subjects as soon as possible.
Catherine Hendricks: You mentioned the information regulator with companies getting up to speed with their
poppy compliance.
Briefly recap our listeners on what exactly is the information regulator and what is
their role in the space of data protection and cyber security.
Jessica Rajpal: Absolutely, Kat.
The information regulator is an independent body and it derives its mandate from section
14 of the Constitution, which relates to the right to privacy as well as Section 32 of the
Constitution, which involves the right of access to information.
Among other things, the regulators empowered to monitor and enforce compliance by public
and private bodies, which are referred to in poppy as responsible parties.
Alice Letsoalo: And let's touch on some of the obligations imposed by the Poppy Act.
What we know is that it makes it obligatory to comply with the conditions for lawful
processing of personal information, and that it also places an obligation on responsible
parties to disclose breaches of information and give the information regulator power to
impose severe penalties where responsible parties fail to adequately protect
information or fail to report data breaches.
Jessica Rajpal: Yes. So in a nutshell, this would entail having an incident management plan that
properly sets out the steps to determine whether a cyber crime constitutes a
reportable breach.
Having a robust breach detection investigation and internal reporting
procedure. All of.
This is critical for purposes of mitigating security risks.
Catherine Hendricks: And what are some examples of a good cyber governance strategy Jess?
Jessica Rajpal: So Katz just to name a few things, organizations need to clearly identify their
cyber security obligations and goals.
They need to develop and implement standards to subscribe to.
And an example of this would be ISO 9001 2017, which is a standard that can be used as
a platform on which to base effective cyber security programs.
An organization would have to establish the appropriate internal processes and procedures
to manage cyber risks, determine the necessary protocols to enforce compliance and
quite importantly, equip its employees with the relevant resources and guidance to carry
out the organization's cyber security.
This would of course include ongoing training, etcetera.
Catherine Hendricks: And I imagine mitigating a data breach would be quite difficult.
Not only would an organization have to deal with the operational impact, but the
reputational and legal implications as well.
So what are some of the things that entities would have to be cognisant of in the instance
of a data breach?
Jessica Rajpal: Well, from a legal perspective, organizations need to be aware that a level of transparency
is required by both the Cybercrimes Act and the Poppy Act.
It was mentioned earlier that in terms of the Cyber Crimes Act, electronic service
providers will be required to report cyber attacks within a specific period of time,
although that provision hasn't yet been enacted.
Then in terms of the Poppy Act, security measures must be put in place by responsible
parties to ensure the integrity and confidentiality of personal information in
its possession.
In terms of the Act, responsible parties are required to notify the Information Regulator
as well as any parties whose personal information has been accessed by by an
unauthorised party in the event of a security compromise.
Something important to note, Kat, is that there isn't a threshold in respect of
reporting such compromises.
In terms of Poppy.
Alice Letsoalo: That's a very interesting point, Jess.
So if one considers the implications of notifying the Information Regulator, one can
then imagine that where an organization has faced a data breach but isn't confident about
having established and enforced the appropriate protocols to prevent and mitigate
such a breach, that organization may be reluctant to report this sort of crime.
However, I think it's important that organizations are aware that a failure to
report such incidents may very well expose them to a sanction under the Poppy Act.
Catherine Hendricks: Absolutely. And what exactly should this notification entail?
Jess?
Jessica Rajpal: Well Kat, at the very least the identity of the unauthorized person who access the
information. If this is known by the responsible party, the notification should
provide details regarding the possible consequences of the breach, including details
of the measures that the responsible party will take and recommendations of measures
that should be taken by affected data subjects whose information has been leaked.
Something else to note is that the information regulator could require that the
responsible party publicise the data breach.
Catherine Hendricks: Publicising something like that exposes organizations to serious reputational and
financial harm.
It's quite apparent that organisations really need to have a clear prevention and
response plan when it comes to data breaches.
There's a lot to consider protocols, mitigation strategies, very clear policies,
adhering to the notification requirements.
This really goes to show that the issue of cyber risk and crime can't be overemphasized
in today's risk governance framework.
Alice Letsoalo: Absolutely. I am so glad that we met today to share with our listeners some of the
important factors to know from a legal perspective when it comes to data breaches.
Jess, Kath, thanks so much for sharing your insights.
I think that concludes our conversation for today.
Thank you everyone for listening.
Jessica Rajpal: Thank you very much, Alice.
Goodbye all.
Catherine Hendricks: Thanks so much, Alice.
Goodbye, everyone.