ID Like To Know: Unique Identifiers Under POPIA

Organisations often assume that if information has been reduced to a reference number, account number or other unique identifier, it falls outside the scope of the Protection of Personal Information Act 4 of 2013 (“POPIA”). This assumption is based on the belief that only the organisation can link the identifier to a specific person and that third parties would be unable to use the identifier to identify that person. In practice, however, the position is seldom that straightforward.

Section 1 of POPIA defines a unique identifier as “any identifier that is assigned to a data subject and is used by a responsible party for the purposes of the operations of that responsible party and that uniquely identifies that data subject in relation to that responsible party”. In broad terms, a unique identifier is any identifier distinguishes a person from others and enables that person to be singled out, either directly or indirectly.