Regulating Automated Decision-Making: An Analysis of Section 71 of POPIA and Its Implications For Privacy and Data Protection

The rapid evolution of technology and its integration into various sectors of society has necessitated comprehensive data protection legislation to safeguard individuals’ privacy rights. This paper conducts a comparative analysis between the Protection of Personal Information Act (POPIA) of South Africa and the General Data Protection Regulation (GDPR) of the European Union, focusing particularly on their regulatory frameworks concerning automated decision-making and its implications for privacy and data protection. POPIA, enacted in 2013 after seven years of development, seeks to regulate the processing of personal information within South Africa, aligning with international data protection standards. However, with the emergence of automated decision-making systems powered by artificial intelligence and machine learning algorithms, concerns arise regarding privacy, transparency, and accountability. This paper explores how POPIA’s principles, including accountability and data processing conditions, address these challenges, while also acknowledging potential gaps. Drawing parallels with the GDPR — recognised as the international benchmark for data protection — reveals areas where POPIA could enhance its regulatory approach. The GDPR’s emphasis on transparency, explicit consent, and the right to explanation in ADM processes provides valuable insights for POPIA’s refinement. Furthermore, the GDPR’s provisions for regulatory strategies, codes of conduct, and remedies offer potential avenues for strengthening POPIA’s enforcement mechanisms. By evaluating the foundational concepts and core values of both legislations, this paper offers recommendations for aligning POPIA more closely with GDPR best practices, particularly in the context of ADM. It underscores the importance of continuous adaptation and international collaboration in addressing the evolving challenges of data protection in the digital age.