“Oops, I did it again, I published your marks and my reasons are lame” (sung to the tune of Britney Spears’ famous hit). South Africa’s Department of Basic Education (“DBE”) is, in my view, about to make its second Protection of Personal Information Act (“POPIA”) “oops” in two years. This, is as it pushes ahead with its intention to publish matric exam results in newspapers and other media.
The dispute was heard in the the Pretoria High Court yesterday, after South Africa’s Information Regulator launched an urgent application to stop the publication of matric results. The Judge did not go into the merits of the matter (for the non-lawyers, this means that she did not consider the facts: only whether the dispute is urgent enough to be heard on such short notice), and dismissed the Information Regulator’s application because she did not regard the dispute as urgent.
The Judge took the view that the matter is a highly complex one involving different rights such as freedom of expression and privacy. Her view was that the urgent court should not be burdened with having to deal with such complex matters and that the dispute should be dealt with in a way where these issues can be properly considered.
The dispute is therefore likely to be decided when it is heard by another court in the near future. When a court does adjudicate the dispute, I think that, for the reasons below, the Information Regulator will be successful.
Background
The DBE’s entire case hinges on whether a student’s exam number is personal information or not. It argues that it is not personal information, does not identify a student and that publishing an exam number with matric results does not infringe a student’s right to privacy. As I explain below, my view is that the DBE’s argument is simply wrong.
The matric results privacy issue first came to a head in January 2022, when matric student – Anlé Spies, civil rights organisation – AfriForum and Maroela Media (“the Applicants”) won a court order against the DBE, compelling it to publish high school final exam results on public platforms like newspapers and websites.
The DBE had initially (correctly, in my view) argued that privacy considerations under South Africa’s POPIA, prevented it from publishing the matric results. However, what many may not know, is that after the DBE received the Applicants’ court papers, it simply rolled over and did not oppose the court application. This means that Judge Miller – who heard the 2022 court application and granted the court order – only heard the Applicants’ side of the argument. The Applicant’s five main points in the 2022 case were that:
· POPIA protects the personal information of an identifiable living natural person and that a student’s published exam number is not personal information;
· by revoking the publishing of matric results, the DBE failed to balance the protection of personal information against the free flow of information, including the right to a free press;
· because results were published in the past, they should continue being published;
· the prohibition on publishing exam results would deprive media institutions “of the opportunity to earn income” from advertising campaigns; and
· it would be inconvenient for learners to go to their schools to get their results.
The current situation
South Africa’s Information Regulator regarded the privacy aspects of publishing matric results as very important. It investigated the issues and, in November 2024, determined that publishing matric results in newspapers infringed students’ privacy rights and contravened POPIA.
It issued an enforcement notice in November 2024, ordering the DBE to make matric results available to students using POPIA-compliant methods, such as by students obtaining their results directly from their schools or from a secure SMS-enabled platform. The Information Regulator has since also imposed a R5 million fine because the DBE has not complied with the notice.
The DBE has decided to stand its ground in 2024, arguing that an exam number does not identify a student, is not personal information and that publishing it would not infringe on a student’s privacy rights and would not contravene POPIA. This is despite the fact that some of the world’s democracies, like India, Australia and Singapore have adopted privacy-protecting approaches similar to what the Information Regulator has ordered.
AfriForum has also re-entered the fray and has raised the argument that, because Judge Millar ordered the results to be published in 2022, the court order still stands and the DBE is compelled to obey it.
Why the Information Regulator will eventually succeed
There are fundamental flaws to the DBE’s argument. POPIA states that personal information must relate to an “identifiable” person. This means that if there is any way of reasonably connecting a student’s examination number to other information that allows them to be identified, then that exam number is personal information for purposes of POPIA. So, for example, if a teacher leaves a file with exam numbers and the corresponding students’ names, on a bus, those students are identifiable. Even if the DBE is more security conscious than some government departments and assigns a code to each student, a type of pseudonymisation, for example student No. 99999 is assigned code AA1 and only the DBE knows who student AA1 is, the student is still identifiable.
The “identifiable” issue is nicely explained in a project that got the London Underground a lot of bad publicity. London Underground needed to determine how people used the underground trains, so it could plan better. It used Wi-Fi to track commuters through their phones and similar devices, using each device’s unique number, known as a MAC address. It initially promised that commuters would not be capable of being identified, because the MAC addresses would be depersonalised. The truth however was that the MAC addresses may have been depersonalised, but they were not anonymised. So, anyone with the right tools could reasonably identify any London Underground commuter and potentially track all their movements across the city of London.
The parallels between the DBE’s approach and those of the London Underground are clear. In both instances the individuals could reasonably be identified.
As far as AfriForum’s argument is concerned, my view is that a judge cannot be faulted for making a decision when they did not have all the facts or opposing arguments before them. South Africa’s courts have on many occasions overturned decisions where a judge had been prejudiced by not having all the facts. This is one such case and I doubt that AfriForum’s argument will fly.
The DBE and AfriForum argued strongly on, and the Judge raised the question about, whether South Africans have sufficient access to communications that would allow them to access results electronically e.g. by SMS or online. In my view, the argument or concerns on this aspect are not a factor. Research done in early 2024 shows that 195% (yes, that is correct, one hundred and ninety five percent, i.e. almost two phones for each person) of South Africans had active mobile phones. 99.9% of South Africa’s geographic area is covered by 3G cellphone signals. Further, 75% of South Africa’s population were internet users and 75% of households had internet access. South Africa’s Department of Health demonstrated how quickly an SMS-based system could be set up, when it implemented its Covid-19 track and trace system, so there is no real impediment to the DBE doing the same.
With the Department of Basic Education and the Information Regulator’s first court skirmish on matric results and privacy, decided for now, I think that when the matter returns to court for a full hearing, we are likely to see a very different court order to the one handed down in 2022 and today. It may well be that we will see the DBE singing another version of Ms. Spears’ famous song – “Oops, I did it again, I published your marks, and my fine is so big”.
Lucien Pierce is an attorney at PPM Attorneys in Johannesburg and focuses on cybersecurity, technology and telecommunications law
