One of the objectives of the Protection of Personal Information Act, 2014 (“POPIA”) is to promote the right to privacy enshrined in the Constitution. One of the ways in which this is done is to set conditions for the lawful processing of the personal information of what are termed as “data subjects” (ie, natural and juristic persons).
While South African courts have yet to deal exhaustively with the legislative interpretation of POPIA, the Commission for Conciliation, Mediation and Arbitration (“CCMA”), was recently confronted with the interpretation and application of POPIA in the context of an employment relationship dispute.
In Koliswa Sheburi v Railway Safety Regulator, Ms Sheburi alleged that her employer had committed an unfair labour practice by failing to provide her with certain benefits that had been provided to other employees. These benefits were described in the referral form as salary notch and cost of living increases. In support of her claim, she put up a bundle containing a number of documents
At the hearing, the employer raised a preliminary point to the effect that Ms Sheburi's bundle of documents contained two confidential offers of employment made to other employees. The documents disclosed the salary levels linked to the employees' job profiles and the employer argued that the disclosure of these documents constituted a contravention of the POPIA. This was because they contained salary information of third-party employees not involved in the matter. It was also argued that this amounted to the unlawful distribution of personal information.
The employer relied on section 3(1) of the POPIA to support its assertion that the offers of employment constituted confidential information protected under POPIA. In response, Ms Sheburi contended that, in terms of section 6(1), POPIA does not apply to the processing of personal information relating to the judicial functions of a court and that the confidential documents were voluntarily made available to Ms Sheburi by the employees in question. There was thus valid consent to the processing of the personal information.
In his ruling, the Commissioner held that the CCMA was not a court of law and that therefore the exclusion provided for in section 6 of POPIA did not apply. The Commissioner also held that POPIA does not apply to the processing of personal information in the course of a purely “personal or household activity” and accordingly found that the presentation of a case by a party at a CCMA arbitration arguably constitutes a purely personal activity in terms of POPIA. With regard to the question of consent, the Commissioner held that Ms Sheburi must have obtained consent from the two uninvolved employees.
On the issue of whether Ms Sheburi was disseminating the employees' information in contravention of POPIA, the Commissioner held that POPIA will only apply to the processing of personal information “entered in a record by or for responsible party…” and that Ms Sheburi was not a responsible party in terms of the definition in the Act.
The Commissioner therefore dismissed the employer's application for an order that the two confidential offers of employment to be removed from Ms Sheburi's bundle of documents.
It is apparent from the ruling that no evidence was placed before the Commissioner to the effect that the two employees actually granted Ms Sheburi consent to the processing or using of the documents in the CCMA hearing. The ground of consent required in POPIA is “a voluntary, specific informed expression of will in terms of which permission is given for the processing of the personal information”. The Commissioner, on the face of it, ought not to have simply assumed that consent was obtained without evidence being placed before him to support this contention.
The finding by the Commissioner that the legal proceedings constituted, “a purely personal activity”, appears to be questionable and controversial. Despite POPIA not containing any guidance on what constitutes a “personal or household activity”, it does not appear that dispute resolution between employers and employees can be generically termed as a “personal or household” activity.
Interestingly, section 11(1)(f) of POPIA states that personal information may only be processed if the “…processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied…” (our emphasis).
As is apparent from this definition, ”legitimate interests” include the interests of a third-party individual. Ms Sheburi could thus have probably successfully argued that the offers of employment were indeed relevant and necessary for her legitimate interests in the case.
The CCMA is an administrative tribunal that regrettably, does not have the status of a court of law with inherent powers nor are there clear provisions in its rules relating to discovery. It is therefore likely that CCMA Commissioners will in the future, be increasingly faced with having to determine whether the use of documents relating to data subjects is in breach of POPIA.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.