Your Legal Questions Answered

 

Brought to you by Oxigin Verification Systems
http://www.oxigin.biz/
South Africa

Contents

(1) Summary ....
(2) Key points and possible actions ....
(3) What information does Oxigin process about employees? ....
(4) Why does Oxigin obtain and process employee information? ....
(5) Is it lawful for Oxigin to check employee ability? .....
(6) Is it lawful to use Oxigin to check trade union membership? ......
(7) Is it lawful to disclose trade union membership to Oxigin? .......
(8) By using Oxigin, are you lawfully processing personal information?.....
(9) Could an employee claim damages from you as the user? .....
(10) Is it lawful to provide employee information to Oxigin? ......
(11) Are you at risk if Oxigin retains information without prior consent? .....
(12) Could employees be defamed if they fail to get a job? .....
(13) Does Oxigin infringe any rights of employees? ......
(14) Is it lawful for Oxigin to process employee information? ......
(15) Does Oxigin secure the employee information? .......
(16) Does Oxigin unlawfully process personal information in terms of POPI? ......
(17) Can I protect myself and the company? ....
(18) Can Oxigin be included in polices and procedures? .....
(19) If so, do I have to notify my employees? .....
(20) Will this cover all existing and future staff? ......
(21) Must we add a clause in our employment contract? ......
(22) Must employees be informed when uploading incident reports? ......
(23) Can we provide on written warnings that transgressions be uploaded on Oxigin? ....
(24) Can the CCMA force Oxigin to remove a report after a dispute is settled? .......
(25) Does disciplinary action remain in the employee's file? .......
(26) For how long are those records kept? .....
(27) Can I transfer this information to other countries? .....
(28) What are useful links for more information? ....
(29) End Notes ....

 

(1) Summary

This guide answers your frequently asked questions (FAQ) about the legal issues related to Oxigin.
Your risk of being held liable for losses suffered for failing to check whether an employee meets the
needs of a specific job is far higher than the risk of using Oxigin. The risk of being fined, because
Oxigin acted contrary to the law, or being successfully sued for losses by an employee, is very low, if
not non-existent. Oxigin does not discriminate against nor infringe the constitutional rights of any
employees.

(2) Key points and possible actions

1. You may lawfully use and provide employee information to Oxigin.

2. Oxigin may lawfully provide employee information to you.

3. The benefits of using Oxigin far outweigh any possible risks.

4. There is a remote chance of being imprisoned for unlawfully processing personal information.


Key benefits of Oxigin

· You are able to employ effective and trustworthy employees who meet the job requirements.
· You are able to protect and ensure the safely of others.
· You are able to improve your return on investment and manage your risks.

(3) What information does Oxigin process about employees?

'Employee information' means information about an employee's:

· career and employment history;
· identity, educational and possible criminal record; and
· biometric information.

(4) Why does Oxigin obtain and process employee information?

To confirm all employees meet the appropriate standards of competence and behaviour to promote
and ensure:

· the employment of effective and trustworthy employees who meet the job requirements;
· the protection and safely of others; and
· an improved return on investment and management of risks  i

(5) Is it lawful for Oxigin to check employee ability?

Yes. You are lawfully using the services of Oxigin, acting as an operator, to check employee ability.

As a responsible person and authorised user of Oxigin, you should be recording in writing all
defendable truths and:

· protecting not only your legitimate interests, but also the interests of the public;
· collecting employee information to reduce the risk of accidents and save costs;
· checking the ability of employees; and
· checking the trustworthiness of employees.

This is like the grantor of credit checking the credit history and identity of a consumer with a credit
bureau before granting further credit. Such a grantor of credit is legally obliged to do this in terms of
section 69 of the National Credit Act (NCA) ii

(6) Is it lawful to use Oxigin to check trade union membership?

Yes, even without the consent of the employee, because it is necessary to establish, exercise or
defend a right iii 

(7) Is it lawful to disclose trade union membership to Oxigin?

Yes, even without the prior of the employee, because it is necessary to establish, exercise or defend
a right.

(8) By using Oxigin, are you lawfully processing personal information?

Yes, you are doing so lawfully through the use of an operator.

(9) Could an employee claim damages from you as the user?

No. If employees are unable to continue working after you find out from Oxigin about their history, you
are not infringing their legitimate rights. Employees have inherent job requirements and you are not:

· discriminating against any employee;
· infringing any right to privacy or dignity; nor
· engaging in any unfair labour practices in terms of the labour laws.

(10) Is it lawful to provide employee information to Oxigin?

Yes. You are providing information about employees, and can both collectiv and share it with Oxigin v
without the employee's consent.

You, as the provider of employee information, in this instance are:

· collecting the information directly from the employee;
· justified in processing the information;
· protecting your legitimate interests and those of any user of the information vi;
· being open and honest about the processing; and
· limiting further processing.

Oxigin in its capacity as an operator may:

· access the employee informationvii received from you;
· process the information viii; and
· do so because it is consistent with your intended purpose for which you, as the provider,
  collected it.

(11) Are you at risk if Oxigin retains information without prior consent?

No. Prior consent is unnecessary and it is lawful to collect and retain employee information, as
employees do not own it.

Even without the prior consent of employees, the lawix does not prevent you from:

· improving the free flow of personal employee information x;
· collecting such information;
· processing such informationxi; and
· sharing such information with Oxigin.
Oxigin may share employee information with their authorised users.

(12) Could employees be defamed if they fail to get a job?

No. It is a defence to a claim for defamation if the disclosure of the employee information is truthful
and in the public interest.

You as the provider and Oxigin as operator will:

· take reasonably practical steps to confirm the truth of the employee information;
· allow employees to access and correct their information if it is inaccurate; and
· prevent the information from being published to any outsider.

Oxigin only:

· allows authorised users of Oxigin to have access to the information; and
· only shares the information after employees have waived their rights and acknowledged the
  risks associated with consenting to their information being disclosed to an authorised user of Oxigin.

(13) Does Oxigin infringe any rights of employees?

No. Employees do not have absolute fundamental rights and such rights are being justifiably and
legitimately limited.

Employees do have the right to:

· non-discriminatory treatment;
· dignity;
· privacy; and
· fair labour practices.

(14) Is it lawful for Oxigin to process employee information?

Yes xii. Oxigin takes reasonable and practicable steps to:

· ensure that employee information is accurate and of good quality xiii;
· be open and transparent about its processing;
· prevent anyone from declaring that employees cannot work just because there is no
  information about them;
· allow employees to access their information and correct it xiv; and
· process information about the criminal behaviour of employees because it is necessary to
  defend and exercise the rights and obligations of users of Oxigin xv.

(15) Does Oxigin secure the employee information?

Oxigin and its directors and employees:

· take appropriate and reasonable measures to secure the employee informationxvi;
· have a proven track record of protecting information; and
· are trusted by hundreds of users.

(16) Does Oxigin unlawfully process personal information in terms of POPI ?

No. Whilst POPI does prescribe conditions for lawful processing, it does not prevent anyone from
processing personal employee information xvii

(17) Can I protect myself and the company?

Yes. Even though it is not required by law, you can obtain a suitable consent from your employees in
your employment contracts and policies.

(18) Can Oxigin be included in polices and procedures?

Yes, because they are not usually conditions of employment and you do not need employee consent
to alter conditions.

(19) If so, do I have to notify my employees?

Yes. It is always sensible to keep employees informed.

(20) Will this cover all existing and future staff?

Yes, and existing staff need to be informed.

(21) Must we add a clause in our employment contract?

No, but it is prudent to have a clause in all employment contracts stating that management may
amend any policies and procedures provided it is done in the best interests of the enterprise and in
good faith.

(22) Must employees be informed when uploading incident reports?

Yes, it is preferable for the provider of the information (employer) to notify the employee when an
incident report is uploaded to Oxigin xviii. However, it is not necessary if it would prejudice the lawful
purpose of the collection (to warn other prospective employers) about the employee) xix

(23) Can we provide on written warnings that transgressions be uploaded on Oxigin?

Yes, provided the reports are factually correct.

(24) Can the CCMA force Oxigin to remove a report after a dispute is settled?

Yes, provided the settlement makes it clear that the incident giving rise to the disciplinary action did
not take place.

(25) Does disciplinary action remain in the employee's file?

Yes, information will remain in Oxigin for as long as it is necessary to achieve the purpose (or reason)
why it was collected xx. The purpose continues until the person retires.

(26) For how long are those records kept?

They should never be removed from the employers records until the employee leaves as the
relevance of past disciplinary action will depend on future events. The Oxigin HR Check reports will
remain on their name for 5 years.

(27) Can I transfer this information to other countries?

Yes, generally speaking you can transfer across borders to other countries, provided you meet certain
criteria xxi, which is normally the case.

(28) What are useful links for more information?

· www.michalsons.co.za
· www.informationregulator.co.za

About this guide

Copyright
Copyright © 2002 - 2014. Michalsons. All rights reserved. Copyright subsists in this work under the
Copyright Act 98 of 1978. Any unauthorised act infringes copyright. We trust you to respect our copyright.

Disclaimers

1. The content is provided for the jurisdiction of South Africa and is not suitable for other
    jurisdictions.

2. We give no warranty about it, and none may be implied. We are not responsible for any
    mistake in the information or any direct or indirect loss that may follow from it.

3. The guidance has been prepared by Michalsons and is based on their interpretation
    of the principles of South African law at the time of publication. The law may change
    due to future legislative enactments and court decisions.

4. It is a summary or opinion on general principles of law and is published for general
    guidance purposes only. The content does not constitute specific legal, tax,
    investment, accountancy or other professional advice.

5. Seek individual advice from a suitably qualified professional adviser before dealing with
    any specific situation.

(29) End Notes

i Section 13(1) of POPI.
ii Section 69 of the National Credit Act.
iii Section 27(1)(b) of POPI. Section 30(2) is not relevant because the employer is not a trade union.
iv In this context the provider is a responsible party as defined in POPI.
v Oxigin is another responsible party as defined in POPI and is not an operator for the provider.
vi Section 11(1)(f) of POPI.
vii Section 19(1)(b) of POPI.
viii Section 19(1)(b) of POPI.
ix The National Credit Act does not apply to Oxigin because no credit is being provided. Oxigin is not a
   credit bureau as defined in the National Credit Act.
x Preamble to POPI.
xi In section 11(1) of POPI there are six ways in which you can justify why you process personal
   information. One of which is consent. You can rely on any one of them. You do not have to get consent.
xii Section 11(1)(f) and 12(2)(d)(v) of POPI.
xiii Section 16 of POPI.
xiv Condition 8 of POPI.
xv Section 27(1)(b) of POPI.
xvi Section 19 and 21 of POPI.
xvii The Protection of Personal Information Act, 2013.
xviii Section 18(1) of POPI.
xix Section 18(4)(d).
xx Section 14(1) of POPI
xxi Section 72(1) of POPI.