South African Data Regulator Grapples with AI's Challenge to Privacy Laws

South Africa's Information Regulator (InfoReg), tasked with enforcing the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA), is confronting significant complexities arising from the rapid advancement of artificial intelligence. The regulator notes that the current legal framework, established nearly a decade ago, struggles to address the unprecedented scale of personal data collection and processing facilitated by AI technologies, including generative AI, automated decision-making, and biometrics.

InfoReg chairperson Pansy Tlakula highlighted that while AI offers immense opportunities for economic growth and service delivery, it also introduces substantial risks to privacy, transparency, accountability, and human rights. Key challenges include managing consent, ensuring data retention aligns with intended purposes, maintaining transparency in AI systems, and the absence of a national AI policy in South Africa. The regulator emphasized that AI models often retain personal information beyond its original purpose, directly contradicting POPIA principles.

The InfoReg stressed the critical need for a paradigm shift, asserting that data privacy should not impede innovation but rather go hand-in-hand with it, viewed through a human rights lens. They advocate for integrating data protection from the conceptualisation phase of AI systems, rather than treating it as an afterthought. Furthermore, InfoReg executives called for thorough audits of AI system development within South Africa to ensure compliance with existing legislation.

The lack of a national AI policy in South Africa is identified as a major impediment, leading to a