POPIA: Litigants, is your personal information protected?

The Protection of Personal Information Act 3 of 2014 (“POPIA”) came into operation on 1 July 2021, after years of legislative refining in its Bill phase. POPIA sets the conditions for responsible parties to lawfully process the personal information of data subjects (natural and juristic persons) and is centered around the protection of South African data subjects from harm such as breaches of confidentiality of personal information. As a counterpart to the new cyber laws, POPIA is also centered around the  prevention of cyber crime and the enforcement of constitutional rights such as the rights to dignity and privacy.

POPIA litigation soon to take center stage

Litigation by its very nature involves the disclosure of information. Mechanisms built into the legal process, such as, among others, discovery, allow for disclosure of information. Disclosure of information does not necessarily result in a “blanket release” and consideration needs to be given to factors such as relevance and privilege. Suffice to say that the overarching purpose of disclosure is to facilitate proceedings transparently in the interests of both the parties, the court and ultimately, justice. With the advent of POPIA, data subjects are likely to raise their ‘POPIA rights’ during litigation,  as a legal defence to protect their personal information from being disclosed.

Disclosure of medical records

This is exactly the position that unfolded in the case of Divine Inspiration Trading 205 (Pty) Ltd v Gordon and another v Katherine Gordon and Others (“Divine Case”)[1], (which was incidentally just before POPIA was enforced as law) and has possibly marked the beginning of inevitable POPIA-centered litigation. This case involved an application for an order directing the second and third respondents (“medical practitioners”) to provide the medical records of the first respondent, in their possession, to the applicants as well as to the court.[2]

• The application was centered around a subpoena duces tecum, which is one of two types of subpoenas under Rule 38(1) of the Uniform Rules of Court, and has the effect of requiring witnesses to produce (a) document/s relevant to the proceedings. The medical records were required from the medical practitioners in terms of rule 38(1).

The medical practitioners refused to make a disclosure on the basis that the National Health Act 61 of  2003 and the Ethical Rules of Conduct for Practitioners Registered under the Health Professions Act 56 of 1974 prohibited them from disclosing a patient’s medical records without the consent of the patient, which was unequivocally refused. The patient also relied on her rights under section 11 of POPIA, which require consent from the patient, as a data subject, before her personal information was to be processed.

“…unless required by law”

The court found that the relevant health legislation and ethics code relied on by the medical practitioners permitted disclosure of confidential information provided that such disclosure was required by law. Additionally, the court held that the subpoena met the definition of ‘law’ as contained in Rule 38 and that medical privilege could thus not be claimed. The court also held that the relevance of the information was of paramount importance given that, for the purposes of the case in question i.e. the assessment of the quantum, such information could evidence a history of anxiety, drug and alcohol abuse on the part of the patient, which could have impacted her earning capacity and not necessarily the injury she sustained.

The court also relied on the following sections of POPIA:

• Section 12(2)(d)(iii), which permits the collection of data from a source other than the data subject when it is required for the conduct of proceedings in any court or tribunal; and
• Section 15(3)(c)(iii), which provides that the further processing of personal information once it has been collected is allowed if it is necessary for the conduct of proceedings in any court.

Ultimately, the court held that the legislature did not intend for POPIA to conflict with the Rules relating to discovery or the procurement of evidence for trial by way of subpoenas under Rule 38 and that the Rules of court may in certain instances trump the protective provisions, thus affording data subjects limited protection.

Linking back to the potential platform for POPIA-centered litigation, quite recently, the publication of the National Senior Certificate results, as a long standing national tradition, was hotly contested in court in light of the provisions of POPIA.[3] Relying on matriculants’ constitutional rights to privacy and their rights under POPIA, the Department of Education (“the DBE”) sought to do away with this historic practice and, instead, have matriculants collect their results from the schools at which they attended. Concerned by this resolution, an affected matriculant brought an urgent application to the High Court in an attempt to have the DBE’s decision set aside. Notably, it is not only data subjects themselves that seek to protect their own rights to privacy but responsible parties and/or operators managing the personal information of such data subjects.

The High Court ordered that the DBE publish the results as has been done recently and that the results not reflect the names and surnames of the matriculants concerned. This ruling serves as an example that POPIA ought not to be used either by data subjects or responsible parties and/or operators as a catch all phrase guaranteeing privacy in all instances.

Key  points of interest

• As a general rule, our law encourages full disclosure of documents for purposes of litigation. This is based on the understanding that such documents would be used for the purpose of litigation only and not for any ulterior motives.
• In respect of the Divine Case, the disclosure of medical records was crucial to the proceedings as they constituted vital evidence. A reliance on medical privilege and on the protective provisions of POPIA will not suffice if the privilege can be dispensed with by the court on the basis of the relevance of the information that is subject to the privilege. The court may also disregard the rights raised under POPIA if the personal information needed is indeed materially relevant to the court proceedings.
• On the flip side, litigants ought to be cautious when using the Rules of court as a tool to drive the disclosure of documents during litigation proceedings. The unscrupulous use of discovery process, to obtain information where there exists no legitimate purpose or where information or documents sought are irrelevant or insufficiently relevant to the case will be considered as an abuse of the court process and fishing expedition.
• Disclosure thus requires firstly, controlled measures and, a balancing of mutual interests.[4] The objective being to support the claim formulated to dispose of a matter fairly. A litigant should not weaponize a disclosure process to debilitate a party.
• As a final parting shot, rights granted under POPIA’s counterpart legislation, the Promotion of Access to Information Act 2 of 2000 (PAIA), do not allow pre-litigation discovery. Therefore, litigants cannot rely on the rights in PAIA to request or prohibit access to information once litigation proceedings have already started as the governing rules will be those of discovery, and not those under PAIA.