Legal updates and opinions
News / News
POPIA and consent, the biggest misunderstanding?
“Sometimes you have to travel a long way to find what is near” Paulo Coelho
It has been over a year since the compliance deadline of the Protection of Personal Information 4 of 2013 (POPIA), and yet there are still many misconceptions, misleading interpretations and misunderstandings regarding POPIA. A specific example in this regard is the fact that POPIA remains to be considered as “consent driven”.[1]
Most recently, the Information Regulator (Regulator) of South Africa pronounced that the consent of matric candidates or their parents will have to be obtained if the Department of Basic Education wants to publish matric results at the end of the year.[2] This again adds to the unfortunate impression that consent is the be-all and end-all when it comes to the processing of personal information – something not supported by POPIA itself.
POPIA is not consent-driven
Simply put, POPIA is not consent-driven, meaning that a responsible party[3] does not necessarily need a data subject’s[4] consent in all instances to process their personal information. However, there are certain instances when a responsible party must obtain a data subject’s consent, such as when the personal information of children is concerned – consent must be obtained from a parent or guardian.[5]
There are five other grounds, apart from consent, that allow for the lawful processing of personal information, these are when the:
- processing is necessary to carry out actions to conclude or perform in terms of a contract;
- processing complies with an obligation imposed by law on the responsible party;
- processing protects a legitimate interest of the data subject;
- processing is necessary for the proper performance of a public law duty by a public body; or
- processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.
Accordingly, even though consent is a lawful basis for processing, there are alternatives. Consent is not inherently better or more important than these alternatives.
Read more about POPIA: A Guide to the Protection of Personal Information Act of South Africa.
POPIA sets a high standard
POPIA sets a high standard for consent, which must be a “voluntary, specific and informed expression of will” under which permission is given for the processing of personal information.[6] POPIA also gives a specific right to data subjects to withdraw consent at any point. Since consent can be withdrawn by a data subject at any time, consent could possibly be one of the weakest grounds for processing.
We say this because if consent is withdrawn this would deprive a responsible party’s ability to continue processing personal information of a data subject lawfully. Furthermore, a responsible party bears the burden of proof to demonstrate that a data subject has provided consent.
From this, the following characteristics of consent become apparent:
- consent must be freely given, giving data subjects genuine ongoing choice and control over how a responsible party uses their personal information.
- consent must be obvious and require a positive action to opt-in, this means that consent requests ought to be prominent, unbundled from other terms and conditions, concise and easy to understand.[7]
Accordingly, a “catch all‘ or “blanket” type of consent contained in, amongst others, contracts and terms of use will not suffice and in fact constitute invalid consent.
Consent is consequently multifaceted
Consent is consequently multifaceted, therefore public authorities, employers and other organisations may find it difficult to demonstrate voluntary and specific consent. Consent should be avoided, unless it can be confidently demonstrated that consent is freely given.
In the context of the national long-standing tradition of publishing matric results, this issue was hotly contested in the High Court in January 2022. Relying on matriculants’ rights to privacy and rights under POPIA, the Department of Education (DBE) sought to do away with the historic practice of having matric results published and, instead, have matriculants collect their results from their schools. The High Court ordered that the DBE must publish the results “as was the practice in previous years” and that this publication is not to reflect “the first names and/or surnames of any of the learners“.[8]
The order of the High Court is interesting because it questions whether a matric exam number in and of itself (and separate from a learner’s ID number, name and surname) constitutes personally identifiable information.
Indeed, this is an important question because if a matric exam number does not constitute personally identifiable information, then it cannot be linked to or used to identify a matric learner.
One could ask if it is in the public interest for matric results to be published. If it indeed is the case, the Regulator could authorise a newspaper owner to proceed with the publishing of matric results on the current basis i.e., exam number and results and no consent would be required.
Robust understanding of what consent actually requires and when it should be obtained is without doubt important.
“Sometimes you have to travel a long way to find what is near” Paulo Coelho
Footnotes
[1] See, for example, “POPI D-Day: Impact on WhatsApp groups and what you should know“, accessed on 18 July 2022, where it was discussed that WhatsApp group admin is responsible for obtaining consent from members to process their personal information such as phone numbers and profile photos.
[2] See “Govt may need to get parents’ consent before publishing this year’s matric results” T Monama, accessed on 18 July 2022.
[3] A responsible party is a public or private body who alone or together with others determines the purpose of and means for processing personal information.
[4] A data subject is the person (natural or juristic) to whom personal information relates.
[5] See sections 34 and 35(1)(a) of POPIA.
[6] See generally the note on consent issued by the Information Commissioner’s Office, accessed on 19 July 2022.
[7] See section 1 of POPIA.
[8] See Spies and Others v Minister of Basic Education and Others (1652/2022) [2022] ZAGPPHC 2 (18 January 2022).
Latest News
“All change is good”: potential implications of the proposed changes to taxation of income subject to withholding taxes awarded by South African trusts to foreign beneficiaries
and Benedict Ngobeni - Candidate Attorney Reviewed by Ernest Mazansky - Director, Werksmans Tax (Proprietary) Limited Currently, income arising in [...]
The changing landscape of the Companies Act, 2008: the Second Amendment Bill, 2023
In the wake of the Zondo Commission of Enquiry into State Capture's recommendation that certain provisions in the Companies [...]
A definite end to an infinite loop – the interpretation of section 153(4) of the Companies Act, 71 of 2008
It is evident from recent judgments handed down by the Supreme Court of Appeal (the "SCA") that various provisions [...]
A South African perspective on the role of Pro Bono lawyers
This article was first published in TYL, a publication of the American Bar Association's Young Lawyers Division As a [...]
Employment in South Africa – a relationship built on trust
The employment relationship between an employer and its employees is heavily regulated in South African law and there are [...]
Testing the reliability of breathalyser tests
and Nombulelo Bashe, Candidate Attorney Whilst employers regularly rely on the convenience and accessibility of a breathalyser test to determine [...]