With the Protection of Personal Information Act, 2013 ("POPIA") having come into effect just over a year ago, it is imperative for those who have their personal information in the hands of a third party and those who handle the personal information of data subjects to understand their rights and responsibilities and to know the link between POPIA and the Promotion of Access to Information Act, 2000 ("PAIA")
PAIA came into operation on 9 March 2001. The Act gives effect to the constitutional right of access to any information held by a public or private body or person where it is required for the exercise or protection of any right. This right is subject to certain limitations, including grounds for refusal set out in PAIA.
A request for a record from a public body excludes a request for access to a record containing personal information about the requester. However, in the case of a request for access from a private body, it includes a record containing personal information about the requester or the person on whose behalf the request is made.
"Personal Information", in terms of PAIA, means information relating to an identifiable natural person such as a home address, names, photographs, etc. This however does not include information about an individual who has been dead for more than 20 years.
In contrast, "personal information", in terms of POPIA, means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person.
PAIA (as amended by schedule 1 to POPIA) obliges public and private bodies to compile a manual to enable a person to obtain access to the information the body holds and stipulates the minimum requirements that the manual has to comply with.
POPIA gives effect to everyone's constitutional right to privacy. It promotes the protection of personal information processed by public and private bodies, including certain conditions so as to establish minimum requirements for the processing of personal information. The Act balances the need for access to information against the need to ensure the protection of personal information by the establishment of the Information Regulator, which has oversight over the processing of personal information.
In terms of POPIA, data subjects are given certain rights, including the right to request a responsible party to confirm, free of charge, whether or not the responsible party holds personal information about the data subject; and request from a responsible party the record or a description of the personal information about the data subject held by the responsible party, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information.
The responsible party may not refuse to provide this information to the data subject unless it has the grounds for refusal as set out in PAIA.
In the recent case of Smuts and Another v Botha, the Supreme Court of Appeal ruled that where a person exposes their personal information in the public domain by their own actions, the information ceases to fall under the protection of the right to privacy and can be published online by another party in the exercise of their right to freedom of expression.
In this case, a group of cyclists was given access to Mr Botha's farm for an adventure race organised by a third-party.
During the ride across the farm, one of the cyclists came across two cages containing dead animals. He photographed the scene and sent the pictures to Mr Smuts, an avid wildlife conservationist who then published his opinion on Facebook on what he regarded as unethical animal trapping practices by Mr Botha.
In doing so, he made reference to Mr Botha's personal information, including the name and Google search location of his business, his home address, and his telephone numbers, as well as the name of his business. Mr Smuts also included a picture of Mr Botha holding his six-month-old daughter and a WhatsApp conversation between Mr Smuts and Mr Botha.
The post generated many comments on Facebook, which were mostly critical of Mr Botha and the particular practice of trapping animals.
Mr Botha sought an urgent interdict from the High Court of the Eastern Cape Division, on the basis that his right to privacy had been infringed. The court ruled that the name of the farm and Mr Botha's identity constituted personal information and, as such, were protected by his constitutional right to privacy. On appeal, however, the Supreme Court of Appeal ruled in favour of Mr Smuts' right to freedom of expression.
The court took into consideration that Mr Botha placed his identity and information relating to his farm in the public domain, "weakened" his right to privacy himself, when he allowed members of the public access to his property without hiding his practice of animal trapping.
The court also took into consideration that information about Mr Botha and the farm could also easily be found in the deeds office, as well as on Google. The court held that this "is not information which Mr Botha can legitimately exclude from the public. The fact that he disclosed his personal information strips him of the right to claim privacy in respect of that information."
This case demonstrates that the right to privacy is not absolute, but must be balanced against other rights, such as the right to freedom of expression and of course the right to access a record in terms of PAIA.
It must be emphasised that the facts of this case occurred before POPIA became (mostly) effective on 1 July 2021. Personal information that has been made deliberately public by the data subject or derived from a public record is protected in terms of POPIA, but some lenience is given to responsible parties to process such information in certain instances.
For example, in terms of POPIA, personal information must be collected directly from the data subject, unless the information is contained in or derived from a public record or has deliberately been made public by the data subject. The outcome of the case (including the publication of the picture of Mr Botha holding his six-month-old daughter) may well have been different if POPIA was considered.
ENSafrica can assist with all forms of POPIA and PAIA compliance, including responding to PAIA requests, compiling and updating PAIA manuals, and developing a POPIA/PAIA request decision tree.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.