In the recent case of De Jager v Netcare Limited & Others (42041/16) [2025] ZAGPPHC 141 (17 February 2025) the way forward for privacy law and litigation was outlined.
The unlucky plaintiff, Mr Nicolaas J De Jager ("De Jager"), went blind in one eye following cataract surgery, and instituted an action against Netcare for R25 million. De Jager objected to the use of surveillance data, which was obtained by Netcare that was introduced to prove that his blindness was not impacting his life to the extent claimed.
The Legal Issues
The Constitution vs POPIA
De Jager based his claim on his constitutional right to privacy which is enshrined in section 14. The issue was whether De Jager could solely rely on section 14, when the Protection of personal Information Act, 4 of 2013 ("POPIA") had been introduced to regulate privacy laws. The Court relied on the principle of subsidiarity, which stipulates that where legislation has been enacted to give effect to a constitutional right, a litigant must rely on that legislation or challenge the constitutionality of that legislation, as opposed to invoking the Constitution directly.
Legitimate Interest
While the claim still would not have succeeded had De Jager relied on POPIA, the Court analysed whether the evidence was admissible in terms of POPIA.
Section 9 of POPIA states that the processing of personal information is lawful on certain grounds, namely:
"Personal information must be processed lawfully; and in a reasonable manner that does not infringe the right of privacy of the data subject."
The first amicus, Professor Donrich Thaldar stated that the processing of the personal information would be lawful as it complies with section (11)(1)(f) of POPIA, which states that "processing is necessary for pursuing the legitimate interest of the responsible party or of a third party to whom the information is supplied."
The term legitimate interest is not defined in POPIA, accordingly the Court used the test set out in section 36 of the Constitution focused on the balancing of competing interests and considering the 5 elements, being the nature of the right, the importance of the purpose of the limitation, the nature and extent of the limitation, the relationship between the limitation and its purpose, and less restrictive means to achieve the purpose.
Conclusively, the Court held that the surveillance was obtained through footage in a public setting, therefore limiting the invasion of privacy and established that there was a sufficient link between obtaining the surveillance and the need to provide evidence of De Jager's true condition.
Special Personal Information
Section 26 of POPIA prohibits the processing of special personal information, such as information relating to one's health, unless it the processing can be justified under the exclusions set out in section 27. The first amicus argued that section 27(1)(b) allows for the processing of special personal information when necessary for the establishment, exercise or defence of a right or obligation, asserting that such processing should therefore be deemed admissible. In contrast, the second amicus took an opposing stance contending that explicit consent should have been obtained.
After reviewing both submissions and considering section 18(4)(c)(iii) of POPIA, which stipulates that compliance with section 18 consent requirements is not necessary when data is collected "for the conduct of proceedings in any court or tribunal that have been commenced or are reasonably contemplated," the court concluded that the processing of evidence through surveillance would be lawful under section 27(1)(b) of POPIA. However, the court clarified that this position would not extend to taking pictures or videos of a party inside their home, bedroom or bed. Additionally, the court emphasised that this protection extends to the personal information of children and individuals who are non-data subjects.
What this means for Businesses and Healthcare Providers
Use of personal information may be admissible in legal cases. If a company or healthcare institution becomes involved in a legal dispute, it may lawfully process and admit personal information, such as patient health records or surveillance footage, where necessary to defend its legitimate interests.
Health data may be processed without requiring explicit consent. Businesses and healthcare providers may lawfully process personal information without the data subject's consent when necessary for legal proceedings, whether already initiated or reasonably anticipated, as demonstrated in this case. Section 18(4)(c) of POPIA further delineates exceptions where informing the data subject of the collection, purpose, or intended transfer of their information to a third party is not required.
Privacy policies must be updated in line with POPIA requirements. This case underscores the critical need for businesses and healthcare institutions to continuously review and refine their privacy policies and procedures to ensure compliance with evolving legal standards. Organisations must implement robust safeguards to guarantee the responsible collection, use, and storage of sensitive information.
The Way Forward
The application of privacy law in South Africa must be consistent with our constitutional values. The importance of privacy must continue to be recognised while simultaneously acknowledging the practical realities and legitimate need for the use of personal information.
For organisations, this ruling serves as a prompt to ensure that their policies and procedures are fully aligned with the requirements of POPIA.
For the public, it is a reminder that while our privacy is protected, there are times when this protection must be weighed against other, more compelling interests in the pursuit of justice.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
