by: Armand Swart, Director and Isabella Keeves, Candidate Attorney

On 3 June 2026, the Gauteng High Court refused the Information Regulator’s application for leave to appeal to the Supreme Court of Appeal against the order of 12 December 2025, in which a full bench held that the Department of Basic Education may lawfully publish matric results using examination numbers. The court concluded that the Regulator has no reasonable prospects of success. The practical upshot: matric results will continue to be published in newspapers using examination numbers without names or surnames. However, many questions remain.

This article examines the decision and analyses what it means for the interpretation of “personal information” under the Protection of Personal Information Act 4 of 2013 (“POPIA“) and the Act’s application as a whole. Was the court’s refusal of leave a missed opportunity to secure authoritative guidance on questions of public importance?

History of the Matter

The dispute began when POPIA came fully into effect on 1 July 2021, prompting the Department to halt its long-standing practice of publishing matric results in newspapers. In January 2022, a matriculant, Ms Anle Spies, together with other parties, brought urgent proceedings against the Department. The Regulator was cited as a respondent. The matter was settled by a consent order, which the Regulator confirmed: results would be published using examination numbers only, without student names or surnames. Results have been published in this manner since then.

The Regulator subsequently conducted an own-initiative assessment, and in November 2024, it issued an enforcement notice ordering the Department to cease publication of the 2024 matric results in newspapers and obtain consent before any future publication. The Department did not comply. The Regulator then brought urgent enforcement proceedings, which were struck from the roll on 8 January 2025 for lack of urgency. On 12 December 2025, a full bench upheld the Department’s appeal, set aside both the enforcement and infringement notices, and ordered the Regulator to pay the costs of the appeal. The latest development is that the Regulator’s application for leave to appeal was refused on 3 June 2026.

In our view, it is unfortunate that leave was not granted. The underlying questions discussed below are of considerable significance.

Arguments in the High Court

In the High Court matter which resulted in the December 2025 judgment, the Department argued that examination numbers, published without names or surnames, do not relate to an “identifiable” person and therefore do not constitute “personal information” for purposes of POPIA. The Regulator, on the other hand, contended that because examination numbers are issued sequentially, a learner could memorise where their classmates sat and identify one another’s results by cross-referencing published numbers. Judge Mooki dismissed this as “fanciful”, akin to “a poorly constructed thought experiment” unsupported by empirical evidence.

The judgment turned on a single dispositive question: whether the manner of publication constitutes “personally identifiable information” for purposes of POPIA. The court answered in the negative, and it upheld the appeal against the enforcement notice on that basis, declining to address the remaining arguments of the parties.

In refusing the application for leave to appeal the December 2025 judgment, Judge Mooki stated: “I am not persuaded that the expression ‘personally identifiable information’ offends against the POPIA, or that it constitutes legislation by a court,” adding that the expression “goes no further than a description of essential facts in the dispute between the parties”.

Practical Implications of the Dismissal

The December 2025 judgment establishes that information published in a form that does not permit the identification of a specific individual without more does not constitute “personal information” under POPIA.

The court’s reasoning invites comparison with the EU General Data Protection Regulation (“GDPR“) and the UK GDPR. Those frameworks draw a critical distinction between anonymisation (which requires that re-identification be irreversible and effectively impossible) and pseudonymisation (which merely replaces direct identifiers with codes whilst keeping information allowing re-identification separately). Crucially, pseudonymised data remains personal data under both regimes, subject to the full suite of data protection obligations. Examination numbers assigned to learners would, on a conventional European analysis, constitute pseudonymised data rather than anonymised data.

The High Court, by contrast, applied a narrower test, asking whether a person could, “without any particular diligence” and “without more”, identify a learner. Because the answer was no from the general public’s perspective, the court concluded that POPIA did not apply at all.

Did the Court Get It Right?

The court’s reasoning is defensible on its own terms: no learner had complained, and no harm had been demonstrated across the consecutive years of publication. The court specifically referred to no privacy infringement being demonstrated, and Judge Mooki stated that he considered all the other issues as “incidental”. This counted against the Regulator’s case.

That said, tensions remain. The court’s binary approach – data being either personally identifiable or not – did not engage with the intermediate category of pseudonymised data recognised under EU and UK frameworks. Additionally, the expression “personally identifiable information” is not a term used in POPIA itself. The Regulator’s Chairperson, Advocate Pansy Tlakula, has maintained that the examination numbers are “not de-identified” because they remain “linked to a student”, a position that carries considerable force under European norms.

If pseudonymous data is effectively excluded from POPIA’s protective ambit, the consequences for data subjects could be significant. Responsible parties would be able to process, disseminate, and share coded personal data without: a lawful basis (like consent); providing notice to data subjects; conducting impact assessments for high-risk processing; or responding to data subject access requests. In other words, a responsible party would not be required to comply with POPIA at all. This is simply because the recipients of the data cannot, without more, independently identify the individuals concerned. Data that remains personal in the responsible party’s hands would be treated as non-personal once disclosed to third parties. This appears to be in direct tension with POPIA, which excludes from the Act’s application only information “that has been de-identified to the extent that it cannot be re-identified again”, i.e. truly anonymous data, not pseudonymous data where re-identification remains possible (POPIA, section 6(1)(b)).

The court also declined to address whether a lawful basis for processing existed. Had it treated examination numbers as personal information, the question would have shifted to justification. A legitimate interests analysis, balancing the substantial public interest in educational transparency against the minimal privacy intrusion of publishing a learner’s examination number, could have still found that publication is proportionate and justified. The court could also have considered whether the Department’s constitutional mandate in relation to education, and its legislative obligations regarding the dissemination of examination results, supported a public law duty justifying the publication of results using examination numbers under POPIA (section 11(1)(e)).

Conclusion

In refusing leave, Judge Mooki stated: “I am also not persuaded that the application raises compelling reasons that warrant granting leave to appeal”. The Regulator raised legitimate questions about the interpretation of POPIA, and the primary concern now is that the High Court judgment results in an unjustified narrowing of the definition of personal information. Whether the Regulator chooses to petition the SCA directly remains to be seen. If it does, the SCA will have the opportunity to consider whether the High Court’s binary approach to what constitutes personal information is consistent with POPIA’s broader purposes, or whether a more nuanced assessment – one that acknowledges pseudonymised data as a recognised intermediate category – better serves the statute’s protective aims whilst accommodating justified processing in the public interest.