A number of recent rulings by the National Consumer Commission (NCC) have significant implications for both companies and their executive teams. Whereas South African companies have previously escaped violations of legislation with relatively minor consequences, these rulings show that the NCC, which has been set up to enforce the Consumer Protection Act (CPA) of 2008, intends non-compliant organizations to suffer severe consequences, even gaol time.

Examples

In the first case, a local government organization was ordered to rectify errors on resident’s accounts or face penalties of between R100 000 and R500 000 per issue. Historically, data quality issues have not resulted in this kind of penalty. The city in this case has won an appeal on procedural grounds – the appeal tribunal found that the blanket judgment was not lawful, as each individual case needed to be investigated independently.

In a second well-publicized case a local property auctions company, and its CEO, were found guilty of contravening aspects of the CPA. The company was reportedly fined 10% of its annual turnover, while the CEO has reportedly been sentenced to 12 months in jail or a R1 million fine. Lawyers are contesting the judgment on procedural grounds and the final outcome remains to be seen.

The implications for company directors are clear.

While the NCC may lose these test cases on procedural concerns, the intention appears to be that noncompliance with legislation will have significant penalties, which could include fines large enough to bankrupt companies, or jail time for responsible executives.

The NCC is sure to learn from these initial decisions and future penalties can be expected to follow procedures that address issues identified in these appeals.

New Companies Act

It can also be assumed that legislation such as the new Companies Act, which brings the King III (and King IV) corporate governance recommendations into law, and the Protection of Personal Information Act (PoPIA) will be enforced with similarly rigorous penalties.

Data Management Implications

Each of these bills has significant data management implications – in particular legislating how information must be stored, how data privacy must be maintained, and that data quality must be ensured.

Company directors that do not address these, and other requirements, could be placing both themselves and their companies at risk of these severe penalties. 

Data governance, which has historically had a focus on highly regulated sectors such as financial services, is now relevant across all sectors. Business needs to implement appropriate levels of data governance in order to ensure legislated levels of data quality and data privacy are met across the enterprise.