Comparing the protection and use of online personal information in South Africa and the United Kingdom in line with data protection requirements

Abstract

Purpose The purpose of this study was to investigate the difference between South Africa (SA) and the United Kingdom (UK) in terms of data protection compliance with the aim to establish if a country that has had data protection in place for a longer period of time has a higher level of compliance with data protection requirements in comparison with a country that is preparing for compliance. Design/methodology/approach An insurance industry multi-case study within the online insurance services environment was conducted. Personal information of four newly created consumer profiles was deposited to 10 random insurance organisation websites in each country to evaluate a number of data privacy requirements of the Data Protection Act and Protection of Personal Information Act. Findings The results demonstrate that not all the insurance organisations honored the selected opt-out preference for receiving direct marketing material. This was evident in direct marketing material that was sent from the insurance organisations in the sample to both the SA and UK consumer profiles who opted out for it. A total of 42 unsolicited third-party contacts were received by the SA consumer profiles, whereas the UK consumer profiles did not receive any third-party direct marketing. It was also found that the minimality principle is not always met by both SA and UK organisations. Research limitations/implications As a jurisdiction with a heavy stance towards privacy implementation and regulation, it was found that the UK is more compliant than SA in terms of implementation of the evaluated data protection requirements included in the scope of this study, however not fully compliant. Originality/value Based upon the results obtained from this research, it suggests that the SA insurance organisations should ensure that the non-compliance aspects relating to direct marketing and sharing data with third parties are addressed. SA insurance companies should learn from the manner in which the UK insurance organisations implement these privacy requirements. Furthermore, the UK insurance organisations should focus on improved compliance for direct marking and the minimality principle. The study indicates the positive role that data protection legislation plays in a county like the UK, with a more mature stance toward compliance with data protection legislation.

Comparative study of personal data protection regulations in Indonesia, Hong Kong and Malaysia

“…South Korea has its own PDPA, the PIPA, passed in 2011. The UK has also regulated personal data protection in the Data Protection Act 1998 (Bechara and Schuch, 2021; Da Veiga et al , 2019).…”

“…Personal data is a set of data related to and used to identify a certain person (Addae et al , 2017; Da Veiga et al , 2019). Article 4 of the European Union’s General Data Protection Regulation (GDPR) defines personal data as “information relating to an identified or identifiable natural person.” It explicates that the subject protected under the regulation is not a legal person, but a natural person , who is a “data subject” (Giakoumopoulos et al , 2018).…”

“…According to the EU regulation, the information contains data of a person when: An individual is identified or identifiable by the information; or An individual, while not identified, can be singled out by this information in a way that makes it possible to find out who the data subject is by conducting further research (Da Veiga et al , 2019; Giakoumopoulos et al , 2018). …”

“…An individual, while not identified, can be singled out by this information in a way that makes it possible to find out who the data subject is by conducting further research (Da Veiga et al , 2019; Giakoumopoulos et al , 2018).…”

“…2. Literature review: legal aspects of personal data 2.1 Definition, subject and nature of personal data Personal data is a set of data related to and used to identify a certain person (Addae et al, 2017;Da Veiga et al, 2019). Article 4 of the European Union's General Data Protection Regulation (GDPR) defines personal data as "information relating to an identified or identifiable natural person."…”