The interplay between intellectual property and POPIA
This blog was co-authored by: Bongekile Gasa, Candidate Attorney
The purpose of the Protection of Personal Information Act (POPIA) is to safeguard the personal information of individuals and juristic entities alike. The fact that South African data protection legislation regulates and protects the personal information of juristic entities sets it apart from data protection legislation in many other countries. It was this distinction that triggered our thinking around how POPIA and intellectual property (IP) law interplay with one another. We considered how the provisions of POPIA could potentially be used to assist with the enforcement of IP rights.
POPIA broadly defines personal information as any information that can be used to identify a living natural person and, where applicable, an existing juristic person. For purposes of this analysis, personal information includes “any identifying number, symbol, online identifier or other particular assignment to the person”.
POPIA sets out eight requirements which must be met by responsible parties in order to lawfully process personal information. Consent is often a fundamental requirement for the processing of personal information of Data Subjects, but not always. There are a number of other lawful grounds for processing personal information set out in POPIA. POPIA provides for the imposition of significant administrative fines on responsible parties that do not comply with these lawful processing principles. Where personal information is used or processed for unlawful purposes, the provisions of POPIA can be effective in challenging such conduct. We have found this to be the case in tackling IP infringements online on various social media platforms since POPIA became fully effective in July 2021.
IP constitutes intangible property, in the form of creations of the human mind, for which legal rights are given to the creator to exclusively exploit and benefit from the IP in question, for a period of time subject toexceptions or restrictions, depending on the nature of the intellectual property in question. One example of an IP right is a trade mark.
A mark is any mark which is capable of being represented graphically, and includes a name and a logo. A trade mark is any mark that is used to distinguish one person’s goods or services from the same or similar goods or services of another person. The most important function of a trade mark is therefore to operate as a distinctive “badge of origin”. On this basis, and given the inclusion in the definition of personal information of identifying numbers, symbols, online identifiers or other particular assignment of persons, in many instances, a trade mark may constitute personal information in the event that it identifies, in particular, a juristic entity itself (and not just the goods or services it provides), especially where that entity is well-known.
The upshot of this analysis, is that where a person uses another’s trade mark unlawfully, without the permission of the owner of the trade mark, they may not just be liable for trade mark infringement under the Trade Marks Act, 1993, but may also be contravening the lawful processing principles of POPIA. In the context of POPIA, where a trade mark is capable of identifying a person, or juristic entity, the consent of the owner of the trade mark would be required to use, store or distribute their trade mark, in the same circumstances that POPIA requires consent for the lawful processing of personal information, as the exceptions set out in POPIA would not apply. The infringement of a trade mark may therefore also constitute a contravention of POPIA. This is a technical argument that has been accepted by social media platforms, particularly Facebook, when we have lodged complaints with them on behalf of our client’s regarding infringements of the brands by other users of the platform. It has given us another arrow in our quiver to tackle this type of unlawful conduct online, which has proved to be very useful.
