INTRODUCTION
This manual is published pursuant to section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA") which was promulgated in order to nurture an ethos which promotes transparency, accountability and effective governance of all private and public bodies. PAIA gives effect to section 32 of the Constitution of the Republic of South Africa, 1996, which provides for the right of access to information in a manner that affords persons a means to obtain the records of private and public bodies as promptly and as efficiently as reasonably possible to endorse, including but not limited to, mechanisms and procedures that empower and educate all persons.
PAIA requires organisations to compile a manual as a guide to requesters of information. The manual also serves to indicate the types of records held by FaceCamAlert (Pty) Ltd ("FaceCamAlert"/"we"/"us"/"our") and the availability of such records from FaceCamAlert.
In addition, the manual explains how to access, object to, request correction or deletion of, personal information held by FaceCamAlert, in terms of sections 23, 24 and 25 of the Protection of Personal Information Act 4 of 2013 (“POPIA”), and the Regulations Relating to the Protection of Personal Information, 2017 (“POPIA Regulations”).
This manual is not exhaustive of, nor does it comprehensively deal with, every procedure provided for in PAIA. Requestors are advised to familiarise themselves with the provisions of PAIA and POPIA before making any requests to FaceCamAlert in terms of these Acts. However, in terms of section 19 of PAIA, and Regulations 2 and 3 of the POPIA Regulations, FaceCamAlert will provide such assistance as is required in completing the necessary forms, by parties applying for access to information or personal information.
FaceCamAlert makes no representation and gives no undertaking or warranty that the information in this manual or any information provided by it to a requestor is complete or accurate, or that such information is fit for any purpose. All users of any such information use such information entirely at their own risk, and FaceCamAlert will not be liable for any loss, expense, liability or claims, howsoever arising, resulting from the use of this manual or of any information provided by FaceCamAlert or from any error therein.
OVERVIEW OF FACECAMALERT
FaceCamAlert is a national, centralised facial recognition subscription service providing facial recognition matching and alert services for private properties and businesses. FaceCamAlert achieves this by using the infrastructure such as CCTV cameras, access control and reception management devices of its subscribers to receive images and match it against watchlists of banned individuals or individuals on the SAPS wanted list.
INFORMATION OFFICER AND CONTACT DETAILS OF FACECAMALERT
The Information Officer of FaceCamAlert is Tiaan Janse van Rensburg whose contact details are as follows –
| Name | Contact details |
| Tiaan Janse van Rensburg | Email: info@myincidentdesk.com |
GUIDE ON HOW TO USE PAIA AND POPIA
As of 1 July 2021, the Information Regulator has assumed the functions of the South African Human Rights Commission (“SAHRC”) and is responsible for PAIA and POPIA queries.
As part of its functions, the Information Regulator has published a guide on how to use PAIA and POPIA in the new dispensation.
The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA (“Guide”), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.
The Guide contains a description of the following:
the objects of PAIA and POPIA;
the postal and street address, phone and fax number and, if available, electronic mail address of –
the Information Officer of every public body; and
every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA and section 56 of POPIA;
the manner and form of a request for –
access to a record of a public body contemplated in section 11 of PAIA; and
access to a record of a private body contemplated in section 50 of PAIA;
the assistance available from the Information Officer of a public body in terms of PAIA and POPIA;
the assistance available from the Regulator in terms of PAIA and POPIA;
all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging –
an internal appeal;
a complaint to the Regulator; and
an application with a court against a decision by the information officer of a public body, a decision on internal appeal or a decision by the Regulator or a decision of the head of a private body;
the provisions of sections 14 and 51 of PAIA requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual;
the provisions of sections 15 and 52 of PAIA providing for the voluntary disclosure of categories of records by a public body and private body, respectively;
the notices issued in terms of sections 22 and 54 of PAIA regarding fees to be paid in relation to requests for access; and
the regulations made in terms of section 92 of PAIA.
Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Regulator, during normal working hours.
Any information or queries related to the guide, or to PAIA or POPIA should be directed to – Information Regulator JD House 27 Stiemens Street Braamfontein Johannesburg 2001 Website: https://inforegulator.org.za/training/wp/ E-mail: enquiries@inforegulator.org.za
DISCLOSURE IN TERMS OF SECTION 52(1)(a) OF PAIA
The records that are located on the FaceCamAlert website are automatically available to any person requesting this information and it is therefore not necessary to apply for access thereto in terms of PAIA. Our website address where said information or records can be obtained is https://www.myincidentdesk.com/facecamalert.
RECORDS AVAILABLE IN ACCORDANCE WITH LEGISLATION
Records are kept in accordance with legislation as is applicable to FaceCamAlert, which include (but may not be limited to) the following legislation –
Basic Conditions of Employment Act 75 of 1997;
Broad-Based Black Economic Empowerment Act 53 of 2003;
Companies Act 71 of 2008;
Compensation for Occupational Injuries and Diseases Act 130 of 1993;
Employment Equity Act 55 of 1998;
Income Tax Act 58 of 1962;
Labour Relations Act 66 of 1995;
Occupational Health and Safety Act 85 of 1993;
Skills Development Act 9 of 1999;
Unemployment Insurance Act 63 of 2001; and
Value Added Tax Act 89 of 1991.
DESCRIPTION OF THE SUBJECTS ON WHICH FACECAMALERT HOLDS RECORDS AND CATEGORIES OF RECORDS HELD ON EACH SUBJECT
The following table contains a description of the types of records which FaceCamAlert holds and the categories of records held on each subject –
| Subject | Description of record |
| Statutory records | • Company incorporation documents • Share register • Memorandum of Incorporation • Minutes of meetings of the board of directors • Records relating to the appointment of directors, auditors, and other officers |
| Income tax | • Pay-as-you-earn (PAYE) records • Documents issued to employees for income tax purposes • Records of payments made to the South African Revenue Service on behalf of employees • All or any statutory compliance • Value Added Tax • Skills development levies • Unemployment Insurance Fund |
| Labour relations records | • Personnel documents and records • Employment contracts • Medical aid records • Pension Fund records • Disciplinary records |
| • Salary records • Disciplinary code and / or procedures • Leave records • Training records • Training manuals • Address lists • Internal telephone lists | |
| Finance | • Receipts and payments • Bank statements • Budgets • Management accounts • Asset registers • Orders, quotes and invoices • Minutes of meetings • Correspondence |
| Risk and compliance | • Contracts • Testing certificates • Policies and procedures • Risk assessment • Compliance records |
PROCESSING OF PERSONAL INFORMATION
POPIA
Chapter 3 of POPIA provides for the minimum conditions for lawful processing of personal information. These conditions may not be derogated from unless specific exclusions apply as outlined in POPIA.
FaceCamAlert processes personal information in accordance with POPIA. In terms of our Internal Privacy Policy and External Privacy Notice, FaceCamAlert will ensure that all processing conditions of POPIA are complied with at the time of processing of personal information. FaceCamAlert processes personal information of both natural and juristic persons.
Purpose of processing personal information by FaceCamAlert As stated in our Privacy Notice, FaceCamAlert processes personal information for a number of reasons including –
| IN RESPECT OF EMPLOYEES | IN RESPECT OF CUSTOMERS/PARTNERS, THE GENERAL PUBLIC AND SERVICE PROVIDERS |
| Concluding employment contracts | Concluding contracts |
| Human Resource and Finance functions e.g. recruitment, payroll, audit functions, etc. | Conducting due diligence checks |
| Disciplinary/Grievance processes | Onboarding |
| Training and development | Payment of invoices |
| Regulatory compliance | Communication |
| Record keeping | Providing CCTV surveillance services |
Categories of data subjects and their personal information
| Internal personal information (employees) | |
| Full name and surname | Physical address |
| Identity/passport copy | Cell phone number |
| Email address | Tax details |
| Banking details | Marital status |
| Gender | Payroll information |
| Nationality | Education and employment history |
| Age | Next of kin/emergency contact details |
| Income tax information/IRP5 forms | CCTV footage |
| Disciplinary records (e.g. warnings, suspensions, etc.) | Curriculum Vitae (CV) |
| References | Employment performance details (e.g. management reviews) |
| Pension fund details | IP address, usernames, passwords, device and internet usage details |
| Employment agreements | Confidentiality agreements |
| Passwords and computer usage data | Active Directory Logins |
| PSIRA certification | Polygraph test results |
| Internal special personal information (employees) | |
| Race (for B-BBEE purposes) | Health status and records (e.g. medical aid membership information, chronic conditions, allergies, disability, etc.) for emergency and employment equity Purposes |
| Criminal history (background checks) | Biometric data (e.g. fingerprints used to enter FaceCamAlert offices) – these are removed from the system as soon as an employee is no longer under the employ of FaceCamAlert |
| External personal information (Customers/Partners and Service Providers) | |
| Full name and surname | ID/Passport number or company registration number |
| Tax certificate and B-BBEE status/certificate | CIPC certificates |
| Nationality | Contact information (cell/telephone number, email address) |
| Physical address | Confidentiality agreements |
| Banking details | Contracts |
| PSIRA documentation and ID numbers (to set-up the clients and give access to its internal systems) | Customer agreements and independent contractor agreements |
| External personal information (General Public including visitors to FaceCamAlert's premises) | |
| CCTV Footage | Vehicle registration plates |
| Images of vehicles linked to relevant number plate (no details of the owners linked to the number plates are processed) | Access to all camera feeds and databases by support for monitoring watchlist matches |
| Images of face of people entering the premises for matching against watchlists. If no match is found the details and image of the person’s face is immediately deleted. | |
| External personal information (Data subjects included on watchlists) | |
| CCTV Footage | Image of possible facial recognition matches. |
| Name and surname of data subject. | List of crime(s) or transgression(s) of which the data subject has been found guilty, has admitted guilt to, or is a suspect of. |
| Images of face of data subject. If no match is found the details and image of the person’s face is immediately deleted. | Case numbers and warrant of arrest number. |
Disclosure of your personal information We may share information about you with –
companies which are affiliated with FaceCamAlert;
partners, agents or suppliers involved in delivering the services you have requested from us;
partners or agents that conduct customer satisfaction surveys and any other surveys related to the products or services provided to you;
companies who are engaged to perform services for or on behalf of FaceCamAlert;
debt collection agencies or other debt recovery organisations;
law enforcement agencies, regulatory organisations, courts or other public entities if we are required by law to do so;
emergency services;
with any entity or forum wherein we may protect ourselves against fraud or exercise our rights; and
if we are reorganised or sold to another organisation, we may transfer any personal information we hold about you to that organisation.
Transborder/Cross-border flows of personal information Section 72 of POPIA provides that personal information may only be transferred out of the Republic of South Africa if certain conditions are satisfied. FaceCamAlert currently has no planned transborder flows of personal information. Insofar as the transborder flow of personal information may become applicable in future, FaceCamAlert will comply with the conditions set out in section 72 of POPIA.
General description of information security measures
FaceCamAlert takes reasonable and appropriate technical and organisational measures to ensure that personal information is kept secure and is protected against unauthorised or unlawful processing, accidental loss, destruction or damage, alteration disclosure or access. We contractually require that service providers who handle your personal information for us do the same.
FaceCamAlert, on a regular basis, reviews the security controls and related to processes to ensure that personal information is secure.
Some of the controls we have in place are that we use digital environments to host the communications infrastructure that makes up the watchlist network and matching platform–
FaceCamAlert uses protected data storage system and its firewalls are regularly updated;
FaceCamAlert's tech firmware and software is updated regularly and patched up;
FaceCamAlert's networks are private and can be accessed over a private VPN service that encrypts all traffic in terms of industry best practices;
legal documents are stored on a cloud-based server with access granted only to certain individuals;
FaceCamAlert uses various software programs in respect of its facial recognition match processing and storage facilities;
the facial recognition matches are located on FaceCamAlert's systems in accordance with FaceCamAlert's footage request process which, if requested for use as evidence in a case, must be accompanied by a case number;
servers are monitored in real time to limit the risk on infrastructure systems;
patch maintenance is carried out regularly;
firewall systems are in place;
audits are regularly conducted to ensure that there has been no leakage of information or hacking;
FaceCamAlert audits its clients' access to its systems and further requests updated lists of operators from clients to update said access;
FaceCamAlert has further identified some foreseeable internal and/or external risks such as –
the risk of being hacked; and
HOW TO REQUEST ACCESS TO A RECORD
To request a record in terms of PAIA, the requestor must complete the prescribed form attached to this manual as Annexure A. This request must be sent to the Information Officer at the addresses provided at paragraph 3.1.
For POPIA-related requests to object to the processing of personal information, correct or delete personal information, the request must be made in writing on the applicable prescribed Form 1 (objection) or Form 2 (correction or deletion), which are attached to this Manual as Annexure B.
The requestor must provide sufficient detail to enable the Information Officer to identify the record(s) requested and the requestor. The requestor must indicate which form of access is required, identify the right that he/she is seeking to exercise or protect and provide an explanation of why the requested record is required for the exercise or protection of that right.
If the request is made on behalf of another person, the requestor must submit proof of the capacity in which the requestor is making the request, to the reasonable satisfaction of the Information Officer.
PAIA makes provision for certain grounds upon which a request for access to information must be refused. On this basis, the Information Officer will decide whether or not to grant a request for access to information.
PAYMENT OF FEES
PAIA provides for two types of fees, namely –
a request fee, which will be a standard non-refundable administration fee, payable prior to the request being considered; and
an access fee, payable when access is granted which must be calculated by considering reproduction costs, search and preparation time and cost, as well as postal costs.
Subsequent to a request being made, the Information Officer, shall by notice require the requester, excluding personal requester, to pay the prescribed request fee (if any) before further processing of the request.
If the search and preparation for disclosure of the record has been made, including arrangement to make it available in the requested form, requires more than the hours prescribed in the regulations for this purpose, FaceCamAlert will request the requester to pay as a deposit the prescribed portion of the access fee which would be payable if the request is granted.
FaceCamAlert may withhold a record until the requester has paid the fees as indicated.
Annexure C.
A requester whose request has been granted must pay the applicable access fee for reproduction, search, preparation and for any time reasonably required in excess of the prescribed hours to search for and prepare the record for disclosure including making arrangements to make it available in the request form.
In terms of POPIA, a data subject has the right to request FaceCamAlert to confirm, free of charge, whether or not it holds personal information about the data subject and request from FaceCamAlert the record or a description of the personal information held, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information.
POPIA further provides that where the data subject is required to pay a fee for services provided to them, FaceCamAlert must provide the data subject with a written estimate of the payable amount before providing the service and may require that the requestor pay a deposit for all or part of the fee.
APPLICABLE TIME-PERIODS
FaceCamAlert will inform the requester within 30 days after receipt of the request of its decision whether or not to grant the request.
The 30-day period may be extended by a further period of not more than 30 days if the request is for a large number of records or requires a search through a large number of records and compliance with the original period would unreasonably interfere with the activities of FaceCamAlert or the records are not located at FaceCamAlert.
OUTCOME OF THE REQUEST (GRANTING OR REFUSING)
Should the request be refused, the notice will state adequate reasons for the refusal, including the provisions of the PAIA relied upon; and that the requester may lodge an application with a court against the refusal of the request.
GROUNDS FOR REFUSAL OF ACCESS TO RECORDS
In terms of sections 62 to 69 of PAIA access granted to a record may be refused on one or more of the following grounds –
protection of privacy to a third party who is a natural person;
protection of the commercial information of a third-party;
protection of certain confidential information of a third-party;
protection of the safety of individuals and the protection of property;
protection of records privileged from production and legal proceedings;
the commercial information of FaceCamAlert;
the protection of research information of a third-party, and protection of research information of a FaceCamAlert.
Despite any provisions of PAIA, a request must be granted if the disclosure of the record would reveal evidence of substantial contravention of, or failure to comply with, the law or imminent and serious public safety or environment risk, and the public interest in the disclosure of the record clearly outweighs the harm contemplated (section 70 of PAIA).
REMEDIES FOR REFUSAL
Should the requester be dissatisfied with the Information Officer’s decision to refuse access, that person may within 30 days after notification of the refusal apply to a court for the appropriate relief.
AVAILABILITY OF THE MANUAL
This manual is available in electronic format in English. The electronic version of this manual is available on the website of FaceCamAlert accessible at https://www.myincidentdesk.com/facecamalert.
UPDATING OF THIS MANUAL
This manual will be reviewed and updated, if necessary, on a periodic basis.
FORM C REQUEST FOR ACCESS TO RECORD OF PRIVATE BODY
FORM 1 OBJECTION TO THE PROCESSING OF PERSONAL INFORMATION
FORM 2 REQUEST FOR CORRECTION OR DELETION OF PERSONAL INFORMATION
FEES PAYABLE IN RESPECT OF RECORDS REQUESTED FROM FACECAMALERT
| DETAILS OF REQUEST | COST |
| 1 Standard fee for any request to be processed regardless of success of request. | R200 |
| 2 If successful the following amount is payable for the provision of feedback, footage and documentation where applicable. | R400 |
