Department of Basic Education - Ref OIA02/23

Authority:	POPIA - SA
Jurisdiction:	South Africa
Relevant law:	Section 11(1)(a)-(f) of POPIA; National Policy Pertaining to the Conduct, Administration and Management of the National Senior Certificate Examination and Regulations; Section 28(2) of the Constitution
Type:	Own Initiative Assessment
Outcome:	Violation
Started:	N/A
Decided:	6 November 2024
Published:	6 November 2024
Fine:	N/A
Parties:	Own-Initiative Assessment in terms of section 89 of POPIA on Department of Education
Case No.:	Reference OIA02/23
Appeal:	N/A
Original Source:	PAIA
Original contributor:	MZIZI Africa

Contents

Summary

This enforcement notice, issued by the Information Regulator of South Africa on 6 November 2024, cites the Department of Basic Education (DBE) for breaching the Protection of Personal Information Act (POPIA) by publishing matriculation examination results in newspapers without consent. The notice details multiple specific violations of POPIA, primarily concerning unlawful processing of personal information. The DBE is ordered to cease this practice immediately for 2024 results and implement a consent-based system for future publications, with strict deadlines and potential penalties for non-compliance.

Facts

The Information Regulator of South Africa initiated an assessment of the Department of Basic Education (DBE) concerning the publication of matriculation examination results in newspapers.

The concern was that the DBE published learners' personal information without obtaining consent, potentially violating the Protection of Personal Information Act (POPIA).

The DBE argued that their actions were justified based on various provisions of POPIA, including:

Section 11(1)(c) and 11(1)(d) read with Section 28(2) of the Constitution: The DBE asserted that publishing the results was necessary to comply with legal obligations and served the best interests of the child.
Section 11(1)(e) and 11(1)(f): The DBE claimed that publishing results was necessary for fulfilling public duties and pursuing their legitimate interests

The Information Regulator refuted the DBE's justifications, concluding:

Lack of Consent: The DBE failed to obtain consent from learners over 18 or parents/guardians of learners under 18 before publishing their results.
No Legal Obligation: The Regulator found no legal obligation in the cited documents compelling the DBE to publish results in newspapers.
Unproven Legitimate Interests: The DBE did not demonstrate how publishing the results protected learners' legitimate interests or served the DBE's interests.
Overriding Learners' Rights: The Regulator emphasized that DBE or media interests could not supersede learners' fundamental rights.