The Information Regulator (Regulator) notes the decision of the Department of Basic Education (DBE) to stop the publication of matric results on public platforms ostensibly in compliance with the Protection of Personal Information Act (POPIA).
The Regulator met with DBE on 12 January 2022 to discuss the DBE’s approach in bringing the processing of personal information in the form of matric results in compliance with POPIA and the conditions that must be adhered to in so doing.
It is the view of the Regulator that DBE has a duty to ensure that matriculants receive their results and that all matriculants can access the results in an appropriate manner. With regards to POPIA, a responsible party such as the DBE, is empowered to decide how to bring its actions or decisions in compliance with POPIA. In this case, the Regulator will assess any decision regarding the publication of matric results based on the provision of POPIA.
POPIA makes provision for such eventuality under clear rules for safeguarding of the personal information, which is the cardinal principle. These rules include, for example, a requirement for agreement between the department and a dissemination platform prescribing how that platform should process the personal information. Such an agreement should bind the platform on processing personal information in terms of POPIA, with a specific requirement for safeguarding of personal information supplied to the dissemination platform.
In instances where personal information related to results being disseminated, POPIA would also require that the matriculants be advised of such an intention to disseminate the information and be advised of their right to object to such dissemination of information. Once a matriculant, or a competent adult acting on their behalf, has objected to dissemination of their information, the department and dissemination platform have an obligation to ensure that such personal information is deleted from the record before it is disseminated.
