FIFI PETERS: Earlier this week, the Department of Basic Education said it would not be publishing the results of the class of 2021 matrics – I think it’s the class of 2021. But on a public platform, like in the media, the department said that it was doing this in line with the Protection of Personal Information Act, Popia, which prevented it from doing so.
To discuss the legal stance of the basic education department, I’m joined by Ahmore Burger-Smidt, the director and head of data privacy and cybercrime practice at Werkmans Attorneys. Ahmore, thanks so much for your time.
Just my limited understanding of the Popia is – it’s essentially out there to protect personal information, and it requires the permission of the individual involved prior to publishing their personal information. In this case, we are talking about matric results. So would you say that the Department of Education is acting within the law in its current stance?
AHMORE BURGER-SMIDT: Fifi, good evening. Indeed we are living in interesting times; just reflect on your previous interview as well. But if we look at the matric results debacle carrying on at the moment, I find it terribly disappointing that the statement reads that the Protection of Personal Information Act, Popia, prohibits the publication of the information because Popia at its cause, as you said, aims to protect the right to privacy and the personal information of individuals.
In terms of the Constitution we do have a right to privacy, but in protecting the right to privacy, the act does not prohibit, in itself, the publication of personal information. In fact, what the act requires is that you will abide by and comply with the conditions when it comes to the protection of personal information and how to deal with it.
So the department, in stating that the act prohibits it from publishing the matric results, and then also stating that the act [prohibits this] in terms of privacy and dignity – ‘the protection of personal information’ does not refer to dignity at all; it deals with privacy and the right to privacy.
So it seems that there’s a general lack of understanding as to what the Protection of Personal Information Act actually requires, as information regulator Advocate Pansy Tlakula pointed out over the past two days in a lot of detail, very succinctly.
People in this country ought to start to understand what this piece of legislation actually requires and means.
FIFI PETERS: So would you say that, if the department went ahead in publishing the matric results on public platforms, it would be lawfully within its right to do so?
AHMORE BURGER-SMIDT: There are two elements that we need to look at.
If we look at it from a Popia perspective and the publication of information on children, those matriculants below the age of 18, for the publication of that information you need consent and you need consent from the parents to publish it.
Now, if we take a step further and we look at the publication of the matric results of the young people and learners above the age of 18, consent is not the test, because Popia is not in all aspects based on consent.
There is something called ‘legitimate interest’. Then you need to consider to what extent is it in the legitimate interest of third parties, or maybe the public interest, to actually publish this information.
I’ve spoken to a lot of people and I’ve spoken to a lot of colleagues in the office about this as well, and there’s still a misconception that the names of students are being published, and that’s not the case.
It’s the exam number that will be published, together with the ID number.
So if we just break it up, and it’s only the publication of the exam number without publication of the ID number, I think we are moving in a completely different territory where it might indeed be personal information.
But is it identifiable personal information in the public domain? We need to ask ourselves this question.
So I think this was a knee-jerk reaction based on the fact that the department doesn’t have privacy policies in place. There are no procedures to comply with the legislation, and the decision was made and the press release issued saying that the Popia legislation prohibited it; but in itself, as I’ve said, the legislation does prohibit it out-and-out. It’s whether you comply with the conditions of lawful processing.
FIFI PETERS: It sounds like quite a complex terrain to navigate.
AHMORE BURGER-SMIDT: I think that you’ve put your finger on a very important, very crucial factor in terms of the application of Popia.
The legislation, if you read it, is not an extensive piece of legislation. It might seem to be a very simple piece of legislation and, together with that, there’s an absolute misconception that as long as you’ve got consent you can do with personal information whatever you want, which is not the case.
The legislation, and interpreting it and applying it, could be exceptionally and extremely complex.
But the first point we need to start at, as South African society, is to realise, yes, the Constitution affords us the right to privacy.
Step number two, this right to privacy is not absolute. You can actually disclose the information of data subjects, individuals such as you and I, under certain circumstances, with understanding where you can do it and how you can do it while not transgressing the legislation. Therein lies a lot of interpretation and sometimes complexities.
FIFI PETERS: Well, Ahmore, thanks so much for weighing in on that for us. We’ll leave it there for now. Ahmore Burger-Smidt, the director and the head of data privacy and cybercrime practice at Werksmans Attorneys.
We also had a recent statement coming out of the regulator on this matter. It is the view of the regulator that the Department of Basic Education has a duty to ensure that matriculants do receive their results, and that all matriculants can access the results in an appropriate manner.
The statement goes on further to say that, with regard to Popia, a responsible party such as the Department of Basic Education is empowered to decide how to bring its actions or decisions in compliance with Popia. In this case, the regulator says that it plans to assist any decision regarding the publication of matric results based on the provisions of Popia.
So clearly a lot more in store on that front, but we’ll leave it there for now.