The Information Regulator of South Africa has imposed a significant R5 million fine on the Department of Basic Education (DBE) for contravening regulations related to the publication of the 2024 matric results. This penalty follows the DBE's failure to comply with an enforcement notice, which explicitly prohibited the publication of these results in national newspapers.
On December 23, 2024, the Information Regulator issued the infringement notice citing non-compliance with the earlier enforcement order dated November 18, 2024. The enforcement notice came as the result of the DBE’s violation of several provisions under the Protection of Personal Information Act (POPIA).
According to the Regulatory body, the enforcement notice stipulated the DBE was required to provide assurance within 31 days — until December 19 — not to publish the results of the 2024 matriculants. It directed the DBE to use methods compliant with POPIA for disclosing results to learners, ensuring the privacy of students' personal information was safeguarded. The Act mandates, among other things, the use of exam numbers instead of names when disclosing results.
Advocate Pansy Tlakula, chairperson of the Information Regulator, clarified the legal position, stating, “The DBE cannot disobey lawfully issued orders of the Regulator without following the procedure stipulated in POPIA.” She emphasized the enforcement orders hold the “fullest legal force and effect” and must be adhered to until revoked or suspended legally.
Despite reports claiming the DBE had filed for appeal against the enforcement notice at the High Court on December 13, 2024, the Regulator noted it had not received any official documentation confirming this appeal by the stipulated deadline. The DBE argued it had proceeded with its plans to publish the matric results without names, positing such action would not infringe on the stipulations of POPIA.
The DBE spokesperson, Elijah Mhlanga, reiterated the department's intention to comply where possible, stating, “We maintain we have filed our appeal application as of December 13; it was approved by the Court on December 17.” The department intends to engage with the Information Regulator to resolve the matter urgently.
The situation has raised questions about the legal authority of the Regulator and the DBE's interpretation of compliance under the POPIA framework. Legal experts have noted the importance of adhering to privacy laws, particularly concerning sensitive information such as academic results.
With the fine now imposed, the DBE has 30 days from the date of the infringement notice to either pay the fine or arrange for payment options. The maximum penalty for such violations can reach R10 million, highlighting the seriousness of compliance under POPIA.
This conflict reflects broader issues related to privacy rights and the management of personal information within educational contexts, particularly as South Africa strives to balance transparency with the protection of individual privacy rights. The continuing legal tussle between the Information Regulator and the DBE is likely to have significant ramifications for the department’s future operations and adherence to the law.
