The Information Regulator of South Africa (IR) continues to make strides at home and abroad in the fulfilment of its legislative mandate on the protection of personal information and the promotion of access to information. The recent developments in the work of the IR attest to its efforts at being a world-class institution in the protection of personal information and the promotion of access to information. The IRSA is proud to announce the following developments:
1. The IR has been elected to serve on the Executive Committee of the Global Privacy Assembly (GPA), a network of over 130 data protection and privacy authorities from all over the world. This election took place earlier this month during the five-day conference in the self-governing British Crown Dependency island of Jersey. Delivering the acceptance statement on behalf of the IR, the chairperson of the IR, Adv. Pansy Tlakula said it was an honour to be elected. “We are truly honoured and privileged to be given the opportunity to be part of the leadership of this august body. We will not only be representing ourselves on the Executive Committee, but we will also be representing the data protection authorities on the African continent. Through our membership in the Executive Committee, we hope to amplify the voices of African data protection authorities in the GPA, which are often faced with more challenges than their counterparts in other parts of the globe,” she said.
2. The IR has been shortlisted in the Top 3 of the Public Sector category for the BCX Digital Innovation Awards for its pilot eServices Portal project. The BCX Digital Innovation Awards recognise innovation in digital and technological excellence for the improvement of service delivery. The winner will be announced on 20 November 2024. The shortlisting of the IR’s eServices Portal for the BCX Digital Innovation Awards follows the recognition of the IRSA’s Chief Information Officer (CIO), Mr. Tando Luyaba, as one of the world’s Top 200 CIOs for 2024 by the Global CIO Forum, which represents around 44,000 CIOs and CISOs from 52 countries.
3. The IR has issued the Electoral Commission (IEC) and the Department of Basic Education (DBE) with an Infringement Notice and an Enforcement Notice respectively. These were issued as a result of non-compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) by both institutions. The IR is empowered to monitor and enforce compliance with POPIA, and non-compliance results in administrative fines and imprisonment.
3.1 On 10 September 2024 the IEC was issued with an Enforcement Notice following the security compromise (data breach) it experienced, which saw the unlawful release of candidate lists for the 2024 elections. The IR conducted an own-initiative assessment into compliance with POPIA and found that the IEC had inadequate organisational measures to protect the integrity of personal information of data subjects. The IEC failed to show the IR how it had complied with the Enforcement Notice within the stipulated time frame (within 31 days). Therefore, the IR has issued an Infringement Notice with an administrative fine of R100 000 against the IEC.
3.2 The DBE was issued with an Enforcement Notice on 4 November 2024 following the IR’s own initiative assessment into the compliance with POPIA by the department. The IR found that the department was not compliant with section 11 of POPIA and was in breach of the conditions for the lawful processing of personal information by failing to obtain consent for the publication of matric results from the learners or that of parents/guardians of learners that sat for the 2023 National Senior Certificate examinations. The IR found that no legal justification existed for the DBE to continue with the publication of the results in the newspapers. It directed that the results of the 2024 matriculants should not be published in the newspapers, and must make these results available to the learners using methods that are compliant with POPIA, such as each learner obtaining their result from the school or using the secure SMS platform of the DBE which enables each learner to access their results confidentially.
3.3 In the Enforcement Notice, the IR has directed the DBE to obtain the consent of learners or the parents/guardians of learners who will write the matric examination in 2025 before publishing their results in newspapers. The DBE must also, among others, develop a system which will enable it to obtain the consent of the learners or their parents/guardians before the publication of their matric results in newspapers. The IR has directed that the DBE should not publish the results of the 2025 matriculants if the Enforcement Notice instructions are not complied with.
