Privacy over publicity: DBE must revise matric results publication method to meet legal standards

The Information Regulator has prohibited the Department of Basic Education (DBE) from publishing the 2024 National Senior Certificate exam results in newspapers.

On 6 November 2024, the Information Regulator issued an enforcement notice to the department for failing to comply with the Protection of Personal Information Act (Popia). 

Speaking on Newzroom Afrika on Wednesday 2o November  chairperson of the IR, Pansy Tlakula, said that directives issued through an assessment report and enforcement notice are binding unless challenged in court. "It doesn't mean that if students are not published in the newspapers they are not going to obtain their results...So I am at a loss as to who is being disadvantaged, unless we are talking about newspapers that generate revenue from the publication of results, but we have to weigh the right to privacy viz a viz the right to make money...as far as we are concerned the privacy of the children comes first." said Tlakula.

The independent body found that the department did not comply with section 11 of Popia by failing to obtain consent from learners who are 18 years old and above and from parents/guardians of those under 18 to publish their matric results in the newspapers.

The Information Regulator said in a statement that there was no legal justification for the department to continue publishing the results.

“The department must make these results available to the learners using methods that are compliant with Popia, such as each learner obtaining their result from the school or using the secure SMS platform of the DBE, which enables each learner to access their results confidentially.”

‘No provision’ for newspaper publication

Section 11 of Popia provides that personal information may only be processed if one of the following conditions is met: 

“(a) The data subject, or a competent person in the case of a child, consents to the processing;

“(b) The processing is necessary to perform or conclude a contract to which the data subject is a party;

“(c) The processing complies with a legal obligation imposed on the responsible party;

“(d) The processing serves to protect the legitimate interests of the data subject;

“(e) The processing is essential for the proper performance of a public law duty by a public body;”

“(f) The processing is necessary for pursuing the legitimate interests of the responsible party or a third party to whom the information is provided.”

The enforcement notice stated that the department failed to demonstrate that publishing matric results in newspapers was necessary for concluding or performing any contractual obligation related to learners and that the department admitted it did not secure consent from learners over 18 years old or from the parents or guardians of learners under 18 who participated in the 2023 National Senior Certificate examinations, yet proceeded to publish their personal information in newspapers.

In a letter dated 21 December 2021 to the Information Regulator, Hubert Mwelithe, Director-General for Basic Education, justified the department’s processing of learners’ personal information under sections 11(1)(c) and 11(1)(d) of Popia, emphasising the constitutional principle in section 28(2) of the Constitution that a child’s best interests are paramount in any matter concerning the child.

Mwelithe also cited the National Policy Pertaining to the Conduct, Administration and Management of the National Senior Certificate Examination (Government Notice No. 564, Gazette No. 30048, 6 July 2007, as amended), which governs the administration of matric exams, as well as the Regulations for the Conduct, Administration and Management of Assessments for the Senior Certificate (Government Notice No 1044, Gazette No 28156, 21 October 2005, as amended). Both documents outline legal obligations for managing and administering assessments, which the department relied on to justify the processing.

While the department relied on these documents to justify its processing activities, the Information Regulator found this justification insufficient. 

“The DBE has failed to demonstrate that the above-mentioned documents impose a legal obligation on it to process personal information of learners by publishing the matric results in the newspaper. There is no provision in the aforementioned documents for the publication of matric results in the newspapers,” read the enforcement notice.

Citing section 28(2) of the Constitution, the department also said publishing the results was justified as being in the best interests of the child. However, the Information Regulator found that Mwelithe’s letter failed to demonstrate how publishing matric results in newspapers protected any legitimate interest of learners, especially since alternative methods for accessing results were available.

The enforcement notice also states that the department could not identify any legal obligation in the cited Regulations for the Conduct, Administration and Management of Assessments for the Senior Certificate or other regulations that required the publication of matric results in newspapers.

Read more: The pressure of matric exams – don’t judge a fish by its ability to climb a tree

Consequences

As the regulator responsible for enforcing Popia, the Information Regulator has the authority to monitor compliance and impose penalties for violations, including administrative fines and imprisonment.

The department has the right to appeal against the Enforcement Notice within 30 days from the date of receipt, as well as 31 days and 90 days respectively to respond to its instructions.

“There are consequences to non-compliance with the Enforcement Notice and if DBE fails to comply, it is guilty of an offence and liable to a fine or to imprisonment for a period not exceeding 10 years or to both,” said spokesperson for the Information Regulator Nomzamo Zondi.

Zondi said the Information Regulator had engagements and several meetings with the department on the matter over the past two years. 

“We then conducted a compliance assessment in terms of section 89 of Popia. We have instructed the DBE to submit a report to us in 90 days of receipt of the Enforcement Notice with the undertaking that it will design a system which will be used to obtain consent before the publishing of the results,” she said.

DBE spokesperson Elijah Mhlanga said the department was reviewing the matter internally.

“Once all the deliberations are concluded the department will provide a detailed response. For that reason we cannot comment beyond this,” he said. 

Striking a balance

On what role the Information Regulator sees for public accessibility and transparency, especially for students in rural areas, in balancing privacy concerns with the need for information access, Zondi said the regulator had a dual mandate on the right to privacy and the right of access to information as contained in Popia and the Promotion of Access to Information Act. 

“We have the responsibility to ensure the balance of these two rights. We are not saying DBE must not publish the results, we are saying that they should do so within the ambit of the law and we urge them to explore other mechanisms to ensure access to the information (results) whilst respecting the right to privacy of learners,” she said.

Zondi said the Information Regulator had proposed other mechanisms already in place, such as the use of a digital platform where learners could privately obtain their results and/or have access to results from their schools. 

“We also proposed that if DBE continues with the publication of the matric results, then the exam numbers must be de-identified, ie, randomise exam numbers so it is not linkable to the learner,” she said. 

Read more: South Africa’s matric results — we should not confuse quantity with quality

In response to the ban on publishing matric results, lobby group AfriForum announced that it had instructed its legal team to prepare a case “to ensure that this year’s matric results can be published on media platforms”.

According to Alana Bailey, AfriForum’s head of cultural affairs, it was in the public’s interest that this information was shared on public platforms. 

“To label it as a violation of individuals’ right to privacy does not make sense, as only examination numbers appear in the media. The court has previously ruled in favour of AfriForum and the other parties that this does not infringe on anyone’s right to privacy,” she said.

In January 2022, the department announced that, in compliance with Popia, which came into effect in July 2020, matric results would no longer be published in newspapers or on digital platforms, requiring pupils to collect their results from their schools.

However, AfriForum, Maroela Media and a matriculant successfully challenged this decision in court. Judge Millar ruled that the results should be published as in previous years but without learners’ names and surnames.

Judge Millar emphasised that while online access was an option, it was not viable for many in South Africa, particularly those from modest backgrounds, where a shared newspaper provided a more practical solution for accessing results.

According to Zondi, the court did not deal with the merits of whether the processing of personal information of matric learners by publication in newspapers complied with Popia.

Strict conditions for 2025 matric results

The enforcement notice also requires the department to obtain the consent of parents or guardians of learners sitting for the 2025 matric exams before their results can be made public. The notice further directs the department to create a system that ensures consent can be obtained from the learners or their guardians before any matric results are published in newspapers.

Within 90 days, the department must provide the Information Regulator with an undertaking to design a system for obtaining consent from learners or their parents/guardians before publishing the 2025 matric results. The Information Regulator must also be allowed to verify the system’s compliance with Popia before deployment.

The department must devise a new method for assigning examination numbers to learners. If the current method is retained, it must ensure that published results cannot be used by learners within the same school to identify others.

If a new numbering method is introduced, it must comply with Popia and the department must provide proof of this system to the Information Regulator within the same 90-day period, ensuring that learners remain unidentifiable.

The Information Regulator has warned the department that it cannot publish results for the 2025 cohort if it fails to comply with these recommendations. DM