Unique Identifiers: The POPIA Issue That Can Derail Data Commercialisation Or Monetisation

Many organisations are looking for ways to monetise or commercialise the data they already hold. This may include enriching customer profiles, combining datasets, creating new analytics products, building customer insights, supporting AI models or collaborating with third parties. Under the South African Protection of Personal Information Act (“POPIA”), a legal blind spot that many organisations miss when seeking to monetise or commercialise data is that the use of unique identifiers may require prior authorisation from the Information Regulator.

A unique identifier is defined under POPIA as “any identifier that is assigned to a data subject and is used by a responsible party for the purposes of the operations of that responsible party and that uniquely identifies that data subject in relation to that responsible party.” This is not the most helpful of definitions but for practical purposes this can include information such as an ID number, customer number, account number, employee number, telephone number or other identifier used by a responsible party to uniquely identify a person.

POPIA does not require prior authorisation merely because an organisation processes a unique identifier. The risk arises (i) where the organisation uses the identifier for a purpose other than the purpose for which it was originally collected and (ii) does so with the aim of linking that information with information processed by another responsible party. When one considers the widely held view that each entity within an organisation or group of companies are each responsible parties in their own right, Chapter 6 of POPIA (Prior Authorisation) can easily be triggered.

This matters directly for data commercialisation or monetisation initiatives and far too many organisations appear oblivious of this risk.

Consider a bank, retailer, insurer, health, telecommunications or any other company that uses an ID number, mobile number or customer reference number to match its customer data against information held by another organisation (including an organisation within its own group). The purpose may be to create richer customer profiles, generate new insights, improve targeting, develop data products, cross-sell or support AI-driven analytics.

That type of data matching can potentially trigger POPIA’s prior authorisation regime under Chapter 6 of POPIA.

The issue is therefore not simply whether an organisation has the right to use the underlying personal information. Even if there is a lawful processing basis to do so, including consent, prior authorisation may still be required if the specific section 57 requirements are met. For organisations pursuing data monetisation, the practical questions should be:

• “Why was the identifier originally collected?
• What are we using it for now?
• Are we using it to match or combine datasets?

Does any of that data come from another responsible party (including a company from our own group)?”- This becomes particularly important for customer-360 initiatives, data enrichment, data clean rooms, loyalty ecosystems, cross-selling and upselling, digital identity projects, AI initiatives and commercial data partnerships.

There is also an important distinction between sharing information with an operator and linking it with information controlled by another responsible party. Sending data to a cloud or analytics provider acting purely on instructions does not necessarily create the same section 57 issue as combining data with an independently controlled third-party dataset, so the opportunity to carefully structure data commercialisation or monetisation initiatives exist using this as a potential mechanism to escape the application of Chapter 6 of POPIA.

The practical takeaway

Any meaningful data commercialisation programme should include a prior-authorisation assessment as part of its privacy impact assessment and data-governance process. The biggest mistake is to assume that because an organisation lawfully holds data, it is automatically free to combine, enrich and commercialise it, and especially so if the dataset originates from different responsible parties within a group.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.