Topic 2: Data Ethics, Privacy and Compliance with POPIA

Data Ethics and POPIA

The following are the key principles that need to be followed when handling data:

  • • Accountability: Under the section 8 of POPIA, it states that the business owner is responsible for protecting the user's data even if third-party data is used.
  • • Minimality and Purpose: With section 10 and 13 it explains that you should only ask for what is needed.
  • • Security safeguards: Section 9 states that safety measures need to be put in place to keep store data safe and secure, like using secure logins for staff.

CIA Triad

Keeping data secure is done by balancing these 3 concepts - confidentiality, integrity and availability.

  • • Confidentiality refers to the details of purchases and customer records never being available on open networks or obtainable to unauthorised eyes. In practice this means that data should be encrypted, and separate networks should be used for the stores data storage and public store Wi-Fi.

  • • Integrity ensures that tampering with transactions should be prevented, prices must stay accurate. Any unauthorised changes to pricing while a transaction is happening must be stopped, a direct connection from the till to the cloud storage should be used to prevent interception from outside devices.

  • • Availability states that sales should be able to continue even in a case of a power outage. Offline software must be used to enable data caching and continue business operations.

The AAA Model

As a small business grows the more shared logins become a problem. The Authentication, Authorisation and Accounting (AAA) model is used to establish accountability and responsibility to all users.

  • • Authentication: All employees must have their own login credentials to access the system. Managers accessing important tools and sensitive data must use Multi-Factor Authentication to verify that it is the correct user trying to access the resources.

  • • Authorisation: Members of the business should only have necessary features for their assigned job role. An example being that regular cashiers only can print receipts and ring up purchases, while refunding transactions must be authorised by a higher up like a store manager.

  • • Accounting: A system should be in place to have logs on who is doing what, the system should have an automatic record of all transaction and or storage. This keeps track of users’ activity and allows business managers to monitor any potential activity that might be suspicious.

POPIA Compliance Integration

The Point of Sale (POS) system is built around the compliances with POPIA, it is built in the till or ledgers workflow.

  • • Under the Accountability and Responsible Party (Section 8), the shop owner or manager is clearly named as the Information Officer, they are responsible for data governance. Naming the shop owner as Information Officer gives accountability.

  • • Minimality and Purpose Specification (Sections 10 and 13) state that on the customer-facing till sign-up, prompts such as lay-by delivery addresses or loyalty sign-ups ask for essential fields like ‘Name’ and ‘Phone Number’ and clearly exclude high-risk identifiers such as South African ID numbers. This is done to protect customers.

  • • Marketing consent is kept separate from the issuance of standard receipts by using explicit opt-in mechanisms, this keeps routine transactional contact details from being wrongly turned into marketing lists. Keeping marketing consent separate protects customers from emails. This falls under Further Processing and Consent (Section 15).

Security and Access Control (CIA & AAA)

Through the CIA Triad, secure communication channels are used as encryption for data and a cloud system is put in place to prevent data loss in case of a power outage.

ACID principles are also used to guarantee recovery from lost data.

The AAA model ensures that till employees are given unique Personal Identification Numbers (PINs) and each PIN has a different type of access. Normal employees only have the necessary abilities to process purchases, but for cash refunds a manager must authorise the transaction.

Design and Pedagogy of Reasoning

Small business retailers deal with the storage of customer’s contact information and transaction history in loyalty schemes; hence, they may be exposed to privacy invasion and penalties for non-compliance with South African law. This topic was designed with the intention of converting statutory requirements of the Protection of Personal Information Act (POPIA) into practical actions. Through the consideration of cybersecurity from the perspective of CIA Triad and AAA model, we have provided an easy guide to non-technical store owners on how to keep their customers' data safe without incurring enterprise IT costs.