The Information Regulator (Regulator) welcomes the action that has been taken by the Department of Basic Education (DBE) to align its processes on the publication of matric results with the requirements of the Protection of Personal Information Act 4 of 2013 (POPIA). The re-issuing of a POPIA-compliant consent form for the publication of matric results is a commendable action by the DBE. Following last year’s uncertainty, confusion, and conflicting sentiments on the implications of POPIA on publishing Matric 2021 results on various mediums, the Regulator and the DBE have met to resolve the matter. The matter was on the right to privacy as it relates to the protection of personal information of the data subjects (the matriculants) and the social need or public interest for the results to be published.
In a meeting held on 12 January 2022 relating to the publication of the matric results, the Regulator had clarified that DBE, as a responsible party, is empowered to decide on the approach to issue or publish the matric results. However, the Regulator will assess the decision for publication based on the provisions of POPIA and the adherence to the 8 conditions for lawful processing of personal information. The cardinal points that the Regulator raised were consent and safeguards for processing the personal information of matriculants.
The Regulator, on 15 September 2022, met with DBE and provided guidance in so far as obtaining consent as outlined in chapter 2, section 11 (1) (a) of POPIA, wherein it states that personal information may only be processed in a fair and lawful manner and only with the consent of a data subject or competent person (where a data subject is a child). DBE, after that, issued a consent form to approximately 900 000 matriculants who would be sitting for this year’s examinations. However, upon assessment of the form, the Regulator found that the form fell short of the requirements in POPIA. The areas of concern were that the form was not purpose-specific and it did not afford the data subject an opportunity to either consent or not consent to each area that required the processing of their personal information. Still, also it did not give an opportunity to withdraw the consent given to process personal information. Therefore, the Regulator instructed the DBE to withdraw the form.
Whilst the Regulator has an obligation to ensure that there shall be no unnecessary impediments to the free flow of information, including personal information, it also has a concomitant duty to ensure that such personal information is processed in accordance with the conditions for lawful processing of personal information. Following a meeting with DBE on 17 November 2022, the DBE has since revised the consent form to allow learners or competent persons to choose what they consent to and are also given an opportunity to withdraw consent. The Regulator takes note of the risks DBE cited regarding the disruptions that may be caused during the examination process by re-issuing the consent form. However, the Regulator cannot postpone or put on hold the constitutional right to privacy of a matriculant, nor can the Regulator waive adherence to the law no matter the circumstances.
“I am pleased that the department has accepted our proposals and the form is now compliant, and I commend the department for their commitment to comply with POPIA,” said the chairperson of the Information Regulator, Adv Pansy Tlakula.
The Regulator will be embarking on a full compliance assessment of the DBE’s policies and practices on the processing of personal information. This will be an own initiative assessment as outlined in section 89 of POPIA. This will seek to assess and monitor the Department’s compliance with the provisions of POPIA in its entire operations and not just one area of its work.
