South Africa’s Data Privacy Authority Mandates Non-Publication of Matric Results in Newspapers
In a stringent enforcement of data privacy laws, the Information Regulator (InfoReg) has levied a R5 million fine against the Department of Basic Education (DBE) for violating the Protection of Personal Information Act (POPIA). This marks a continued effort to uphold privacy rights, as it follows a similar fine imposed on the Department of Justice in 2023 after a breach of personal data.
The recent controversy surrounds the DBE's traditional practice of publishing matric results in newspapers. The regulator issued an enforcement notice prohibiting the publication of 2024 matric results in newspapers, mandating the department to use privacy-compliant methods to distribute these results directly to students. This move aims to enhance the privacy and protection of student data.
Despite receiving the notice, the DBE did not provide the necessary assurances to comply within the stipulated 31 days, nor did it effectively communicate any intent to adhere to the InfoReg’s orders. With no appeal against the enforcement notice effectively served by the deadline, the InfoReg’s directives stand.
Reports indicate that the DBE lodged an appeal against the decision in the high court, believing the appeal would suspend the enforcement notice. This belief led the DBE to consider continuing the release of results to media houses in the established practice, where only exam numbers are used. However, unless this appeal is acknowledged and accepted, the regulator's orders remain in effect, and the DBE must refrain from publishing the results publicly in newspapers.
The DBE has been given a 30-day window from December 23, 2024, to settle the administrative fine or arrange payment terms. Failure to resolve this issue might lead to further legal proceedings.
This case highlights the critical importance of adhering to data protection laws and the consequences of non-compliance, especially concerning the sensitive nature of educational results. It also reflects a shift towards more privacy-conscious practices in the dissemination of such information in South Africa.