REPUBLIC OF SOUTH AFRICA COMBINED SECOND PERIODIC REPORT UNDER THE AFRICAN CHARTER ON HUMAN AND PEOPLE`S RIGHTS and INITIAL REPORT UNDER THE PROTOCOL TO THE AFRICAN CHARTER ON THE RIGHTS OF WOMEN IN AFRICA 178. Since PAIA became operational, our courts have emphasized that the right of access to information can only be limited when there is justification for such a limitation vis-à-vis other fundamental rights considerations.109 Legislative and policy measures to protect personal information 179. The new Protection of Personal Information Act, 2013110 deals with privacy of personal information. It regulates data protection and privacy in South Africa and imposes a number of stringent obligations on all persons who deal with personal information. It deals with the rights of personal privacy and the issue of how to balance those rights against the rights of freedom of expression. 180. The reason the Bill took a long time to be finalised is because of this complexity thereof and there was also considerable public participation in the process. There were extensive public hearings and some 36 submissions from various interested parties. When drafting the legislation special consideration was given to ensure that the Bill did not unduly restrict journalists or unduly restrict bloggers or the so-called citizen journalists, law enforcement agencies or any other literary or artistic expression. 181. The Protection of Personal Information Act, 2013111 establishes a set of conditions for the processing of personal information. These include both general conditions and more detailed conditions for the processing of special personal information such as religious or philosophical beliefs, race and ethnic origins, political persuasion, to name of few. It also establishes an independent Information Regulator to regulate the implementation of the law. There will also be reliance on codes of conduct, approved by the Regulator for the various sectors, which would be legally enforceable. This implementation includes education and research, monitoring and enforcing compliance and the handling of complaints. The Regulator will have many functions to perform. It will be there to, not only, enforce compliance. It will also have a supervisory function. Sectors are encouraged to regulate themselves by drawing up codes of conduct for the processing of personal 109 In Mittalsteel SA (Ltd) (formerly ISCOR Ltd) v Hlatshwayo 2007 (1) SA 66 the focus was on the definition of a public body. The definition of “public bodies” subject to disclosure under PAIA includes state-owned companies that perform a government function and are under the control of the state, even if indirectly, and a formerly state-owned iron company must thus release records of meeting minutes. The Court found that, based on the facts and upon a review of comparative law, Iscor was under the control of the state, performed a public function in providing South African industry with a supply of government-regulated steel and, generally, met the test for a public body. In Unitas Hospital v Van Wyk 2006 (4) SA 436 (SCA) a request for access to a record generated by a private hospital was lodged by the widow of a patient who had died at the hospital. The lower court granted the request for access, but that decision was appealed against in the Supreme Court of Appeal. In the majority judgment of the Supreme Court of Appeal it was noted that in general the question of whether a particular record is “required” for the exercise or protection of a particular right is inextricably bound up with the facts of the matter. The court found that the threshold requirement is that the requestor must show that the information will be of assistance although assistance alone is not sufficient. The information must be reasonably required in the circumstances and the requestor must demonstrate an element of need or substantial advantage. 110 Act No. 4 of 2013 111 Act No. 4 of 2013 53