ARTICLE
22 January 2025

Privacy On Trial

E
ENS

Contributor

ENS is an independent law firm with over 200 years of experience. The firm has over 600 practitioners in 14 offices on the continent, in Ghana, Mauritius, Namibia, Rwanda, South Africa, Tanzania and Uganda.
As the world enters 2025, the tension between privacy rights and public access continues to unfold in South African courts, presenting novel challenges for regulators...
South Africa Privacy

As the world enters 2025, the tension between privacy rights and public access continues to unfold in South African courts, presenting novel challenges for regulators, institutions, and the judiciary. Two recent cases, the Department of Basic Education's (“DBE”) publication of matric results and the privacy concerns surrounding The Devi Show, underscore the evolving nature of privacy law under the Protection of Personal Information Act 4 of 2013 (“POPIA”). While the courts upheld the long-standing tradition of publishing matric results without student names, they took a different approach in allowing the broadcast of The Devi Show. These cases highlight the complex balancing act required to navigate the intersection of privacy, transparency, and freedom of expression in the modern era.

Publication of matric results not a violation of POPIA, court says

The Information Regulator encountered a setback in its efforts to prevent the DBE from publishing matric results in the media on January 14, 2024. On 8 January 2024, Judge Ronel Tolmay dismissed the Regulator's urgent court application, arguing that the publication would infringe upon POPIA.

In December 2024, under the leadership of Advocate Pansy Tlakula, the Regulator issued an infringement notice to the DBE, imposing a ZAR5 million fine for failing to comply with a prior enforcement notice regarding the necessary consent for publishing student results. In turn, the DBE challenged this enforcement notice by filing an application to have it set aside in the High Court. This will be the second time that the Regulator has issued a fine for non-compliance with POPIA.

Ruling

Judge Tolmay's ruling noted that the Regulator sought a final interdict to prevent the DBE from publishing results in any media outside of educational platforms, citing non-compliance with the enforcement notice. The judge emphasised that the publication of matric results has been a long-standing tradition, and the law has evolved to better protect personal information. This evolution led to a prior agreement allowing results to be published without disclosing students' names.

The judge referred to a previous settlement in which the parties agreed that results could be published as before, provided individuals' names remained confidential. This approach has been consistently followed from 2021 to 2023. Thus, the ruling indicates that while POPIA now enforces privacy protections, the traditional practice of publishing results will continue in accordance with the updated guidelines.

2022 Court Application

The backdrop to this dispute lies in January 2022, when the DBE announced it would no longer publish matric results in newspapers, citing privacy concerns under POPIA. Instead, students were instructed to register on the department's website to access their results. This decision was swiftly challenged by matriculant Anlé Spies, lobby group AfriForum, and Maroela Media through an urgent High Court application.

The court in Spies ruled in favour of the applicants, ordering the DBE to publish results on public platforms, as had been the historical practice while anonymising data to protect students' identities. The DBE complied with this order, adopting the agreed practice of using anonymised student numbers to release results.

Are student numbers personal information under POPIA?

Another issue that this matter brings up is whether student numbers constitute personal information under POPIA. In our view, yes. Whilst student numbers on their own do not inherently identify a student unless they are linked with other information, such as a name, school, or contact details, the fact that such linkage is possible means that a student can be identified by their student number. This interpretation raises complex issues about the practical scope of POPIA, particularly in cases where anonymised identifiers are used in good faith to achieve transparency without compromising privacy.

Does removing names qualify as anonymisation?

Another unresolved issue is whether stripping names from results amounts to anonymisation under POPIA. Unlike other privacy laws, POPIA does not explicitly recognise the concept of "anonymisation." Instead, POPIA does not apply to the processing of personal information that has been de-identified to the extent that it cannot be re-identified again. Where information can be linked by a reasonably foreseeable method to other information that identifies the data subject, such information constitutes re-identified personal information the processing of which is regulated under POPIA. By this standard, simply removing names may not suffice, as student numbers can be linked to identifiable data through external databases or records. It follows that the processing of the matric results does not fall outside the scope of POPIA.

Broader implications

This case underscores the potential for conflict between court orders and regulatory enforcement. The DBE found itself in the unenviable position of adhering to a binding court order while simultaneously facing regulatory penalties. Judge Tolmay's ruling serves as a reminder of the importance of clear guidance and collaboration between the judiciary and regulatory bodies, particularly when navigating the evolving landscape of privacy law.

For now, the ruling affirms that the publication of matric results – without student names - does not violate POPIA. This decision balances the public interest in maintaining a long-standing tradition with the legal imperative to protect personal information.

The Devi Show

In another notable legal case at the end of last year, Els v eMedia Investments [2024] 25902-21 (GJ), Gregory John Els, a corporate adviser, became embroiled in public controversy following an unexpected confrontation at a Sandton coffee shop. Scheduled to meet a prospective client, Els instead encountered Devi Govender, host of The Devi Show, who confronted him with allegations of financial misconduct related to his firm, Praxley Corporate Solutions, while filming the encounter. In response, Els filed an urgent legal application to block the broadcast of the footage, arguing that it was obtained under false pretences and violated his privacy under POPIA.

eMedia Investments, the parent company of The Devi Show, defended its actions by asserting that the allegations were of significant public interest, claiming that the footage could encourage others to come forward and promote public accountability. They also cited POPIA's provisions that protect journalistic activities conducted in the public interest.

On 19 November 2024, the Gauteng High Court dismissed Els' application, allowing the broadcast to proceed. The court acknowledged the seriousness of the allegations against Els and concluded that, as a public figure in the business sector, his right to privacy was diminished. However, the court also underscored the necessity of balancing privacy rights with freedom of expression.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See More Popular Content From

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More