JUSTIFIED: The Sunday Times's exposé last year involving the medical records of former minister of health Manto Tshabalala-Msimang was found to be in the public interest

There can be no doubt that requiring compliance will grossly undermine the media's ability to report news

In principle, the bill must be welcomed. South Africa has fallen hopelessly behind many other countries in protecting the personal information of its citizens, and this bill aims to rectify that.

"Personal information" is widely defined in the bill to include information such as race, gender, sex, physical or mental health, education and employment history, identity numbers, physical and e-mail addresses, telephone numbers, personal opinions of or about the person and their preferences, and even the name of the person if this would itself reveal information about the person.

The bill contains eight core principles which must be complied with by all public and private bodies engaged in the processing of personal information, and "processing" is widely defined to include collecting, receiving, organising, using and disseminating the information. The principles include the following:

• The person to whom the information relates (the data subject) must, in general, consent to the processing;
• The information must be collected for a specific and explicitly defined purpose of which the data subject is aware, and may not be retained for any longer than is necessary for achieving this purpose;
• Reasonable steps must be taken to ensure that information is complete, accurate, not misleading and is updated;
• Before processing takes place, there must be notification to a new administrative body, the Information Protection Regulator, and to the data subject;
• The integrity of information must be secured; and
• The data subject has the right to request a description of the personal information held and to request the collection of information.

And some information cannot be processed at all unless certain narrowly defined exceptions apply. This includes religious or philosophical or political beliefs, race or ethnic origin, trade union membership, health, sexual life or criminal behaviour, and information about a child. Unless a specific exemption applies to such processing, it may only take place with the prior consent of the regulator.

The bill has pretty sharp teeth: the regulator may issue an enforcement notice compelling the public or private body responsible for the breach to stop processing information or to take other specified steps. Also, data subjects or the regulator may institute civil claims for damages where the principles are breached.

The bill has significant business and legal implications.

What the media should be gravely concerned about, however, is the bill's implications for their core functions of reporting and commenting on public affairs. The media process personal information all day and every day. To compel them to comply with the principles would wreak havoc on its functions.

Now, the drafters of the bill had the foresight to include an exemption for the media. Clause 4 (d) states that the legislation will not apply to processing for exclusively journalistic purposes by bodies who are subject to a "code of ethics that provides adequate safeguards for the protection of personal information". The problem with this exemption is that it requires the codes to provide "adequate safeguards", and this can only mean that the codes must be beefed up so that they mirror the principles and probably the sanctions contained in the bill.

This will simply relocate the source of the restriction of media freedom: from the bill to the media's own code of ethics.

There can be no doubt that requiring compliance with the principles will grossly undermine the media's ability to report news and express opinion. It would mean that this week's editorial in The Times calling for Joel Santana, Bafana Bafana's soccer coach, to be fired, would ideally have required Santana's consent, and ought to be notified to the regulator; so, too, Zapiro's cartoons in similar vein (they contain views about Santana, and hence process personal information). It means that court reports on the Jackie Selebi trial that refer to Glenn Agliotti's conviction for drug trafficking would require to be authorised in advance by the regulator - a draconian prior restraint. Photographs of a pregnant celebrity walking in a busy shopping mall would be hit. And even biographies or documentary films which contain personal information about public figures such as their age, education and employment history would have to comply.

The existing common law of privacy, and the codes of conduct that apply to the press and to broadcasters adequately protect citizens against abuses by the media: there is no need for this bill to do the dirty work. The existing rules hold the media liable for publishing private information unless the media can prove that consent was provided, or that the publication was in the public interest.

The Sunday Times exposé of the implications of the medical records of the former minister of health, Manto Tshabalala-Msimang, was held by the High Court to be in the public interest even though private information had been published.

From the reaction of many of the committee members at the hearings on the bill this week, the disastrous consequences for the media were never intended. The way to avoid them is to ensure that a watertight exemption from the bill protects the media.

The bill should not apply to the processing by any person of any journalistic, literary or artistic material. Only a blanket exemption of this kind will cure the harm that will otherwise follow - and it is harm to democracy itself.

• Milo is a media law specialist at Webber Wentzel attorneys. He made submissions on the bill for Avusa, the publisher of the Sunday Times