In De Jager v Netcare Limited (Case No. 42041/16) heard in the High Court of South Africa, Gauteng Division, Mr de Jager raised concerns about privacy violations following the collection of his photos and videos via surveillance, arguing that this was done without his consent or knowledge. Mr de Jager instituted an action against Netcare, in which he sought payment exceeding ZAR24 million. Netcare processed Mr de Jager's personal information, following the institution of the action, for purposes of defending the action. According to Netcare, it gathered evidence to dispute the plaintiff's health status, which was central to the case.
Legal considerations
The plaintiff relied solely on section 14 of the Constitution (right to privacy) rather than the Protection of Personal Information Act, 2013 ("POPIA"). The court applied the principle of subsidiarity and held that when legislation like POPIA exists to protect a constitutional right, it must be relied upon instead of invoking the Constitution directly.
The court held that the informational privacy law in South Africa has been codified in POPIA. Accordingly, Mr de Jager's objection to the evidence ought to be dismissed on the basis that he failed to rely on the provisions of POPIA.
The court did not stop there. It went further and analysed whether the implicated evidence would pass muster under POPIA. In doing so, the following provisions of POPIA were considered:
- Section 6(1)(e): The exclusion of POPIA relating to judicial functions of a court referred to in section 166 of the Constitution relates to the processing of personal information within courts in South Africa and within the courts' functions.
- Section 11(1)(f): Personal information can only be processed if the processing is necessary for pursuing the legitimate interests of the responsible party. Since POPIA lacks a definition of "legitimate interest," the court applied the analysis contained in section 36 of the Constitution to assess lawfulness and reasonableness. The court found that the surveillance was justified, as no less restrictive means were available to achieve the defendant's goal.
- Section 18: Notification must be given to a data subject whose
personal information is being processed. The court held that
compliance with section 18 was not required per section
18(4)(c)(iii). The court commented that "the sting in any
surveillance is in the element of surprise and
surreptitiousness" and correctly concluded that if Mr de Jager
had been warned, he would have organised his affairs
accordingly.
Section 18(4)(c)(iii): Notification of to the data subject, that his personal information is being processed, is not necessary for the conduct of proceedings in any court or tribunal that have been commenced or are reasonably contemplated. The court held that this subsection could have been relied upon if section 27(1)(b) did not apply. - Section 26 which prohibits the processing of special personal information must be read together with section 27 (the general authorisation concerning special personal information). According to the court, section 26 "shared the centre stage" with section 27.
- Section 27(1)(b) which excludes the prohibition of special personal information does not apply if the processing is necessary for the establishment, exercise, or defence of a right or obligation in law. The court confirmed that Netcare was defending a right in law after a summons was issued. It was held that the processing of evidence through surveillance would have been lawful under section 27(1)(b). The court commented that section 27(1)(b) would not extend to, for example, the taking of pictures of a party inside their home, bedroom, or bed.
- Sections 34 and 35: The court expressed its displeasure at the processing of personal information of children and non-data subjects. The court ordered that the personal information of the children and those family members of Mr de Jager who were not data subjects should be redacted in an attempt to ameliorate the harm they faced.
Key findings and takeaways
- Privacy claims should be based on POPIA rather than only constitutional rights. A failure to do so may result in the dismissal of the claim.
- The processing of special personal information (such as health data) is justified under seton 27(1)(b) when it is necessary to defend a legal right.
- Legitimate interest must be assessed using a section 36 constitutional analysis, considering whether the processing of personal information is reasonable and justifiable in an open and democratic society.
- Prior notification under section 18(4)(c)(iii) of POPIA may be omitted, when notifying the data subject would undermine the purpose of the surveillance.
- Section 6(e) of POPIA, which exempts judicial functions, only applies to courts' processing of personal information.
- Personal information of irrelevant third-party data subjects must be redacted in order to protect the privacy of individuals visible in the footage.
- Surveillance evidence, when crucial to a party's defence, may be admissible in the interests of justice.
Our reflections
- We support the section 36 analysis to assess a legitimate interest. It is more detailed than the ICO's three-step test (purpose, necessity, and balancing), but deference can still be given to international approaches. The South African approach provides a structured constitutional framework, reinforcing the balance between privacy rights and justifiable data processing.
- The case highlights an important point about the role of privacy notices. While the court was correct in finding that Netcare did not need to notify Mr de Jager immediately before conducting surveillance, a standard privacy notice explaining that personal information could be collected for legal defence purposes may have been beneficial. This would align with POPIA's principles. In addition, it maintains transparency with patients without undermining the defence process.
- However, we disagree with the court's approach regarding so-called "non-data subjects." The fact that an individual's information is not relevant to the case does not make them a non-data subject. Any identifiable person in the surveillance footage qualifies as a data subject under POPIA. The proper legal question should be whether their data must be redacted based on relevance and data minimisation principles, not whether they qualify as data subjects in the first place. The court reached the correct conclusion on redaction, but the reasoning behind it could have been more precise.
The case underscores the complexity of balancing privacy rights with the legitimate need to defend legal rights, especially when sensitive personal information, such as health data, is involved.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
