- The Information Regulator insists the Department of Basic Education breached POPIA by publishing results with identifiable exam numbers.
- The department argues the Regulator’s interpretation is too strict and undermines the constitutional right to access information.
- Afriforum and media supporters argue that the enforcement notice constitutes censorship, threatening press freedom and public accountability.
The Gauteng High Court in Pretoria is facing what may be the most important data protection case since South Africa’s Protection of Personal Information Act (POPIA) took effect.
The main question is whether the Department of Basic Education can keep publishing matric results in newspapers and online with exam numbers and school names, or if this practice breaks privacy laws.
The dispute began with the Information Regulator’s 2024 enforcement notice to the DBE, ordering an immediate stop to the publication of results in this manner. The Regulator found that, even without learners’ names, the use of sequential exam numbers and school identifiers made pupils “reasonably identifiable” under section 1 of POPIA.
In its report, the Regulator stated: “The DBE must provide the Regulator with a commitment that it will not publish the results of the 2024 matriculants in the newspapers and must make these results available to the learners using methods compliant with POPIA.”
The Regulator also insisted that for future results, the department must get explicit consent from each learner or create a numbering system that prevents any student from deducing another’s results.
Information Regulator: Unlawful processing, no power to condone appeal
Arguing for the Regulator, senior counsel Kennedy Tsatsawane SC told the court that the department’s actions “constitute the unlawful processing of personal information without consent, without any legal obligation, and without a legitimate purpose.”
He stated that the examination numbers are “unique identifiers” under POPIA, and their publication, even without names, allows for recognition of individual learners within school communities. The Regulator also maintains there is “no constitutional, statutory or international duty” compelling the DBE to publish results publicly.
A key procedural issue is the DBE’s late appeal. Section 97(1) of POPIA requires that an appeal must be filed within 30 days of receiving an enforcement notice. The Regulator argues that the department missed this deadline and that the High Court lacks the power to condone the delay.
The Regulator cites section 97 directly: “A responsible party on whom an enforcement notice has been served may, within 30 days of receiving the notice, appeal to the High Court for the setting aside or variation of the notice.”
Tsatsawane argues that Parliament intentionally left out any provision for exceptions and that “the court cannot give itself powers that the Legislature has chosen not to give.” The Regulator compares this with laws like PAJA and the Institution of Legal Proceedings Act, where Parliament explicitly allowed for exceptions, something POPIA does not do.
The Regulator argues that the department’s right to appeal “has lapsed and cannot be revived under the guise of inherent jurisdiction or the interests of justice.”
Department of Basic Education: A public duty to inform
The department, represented by the Minister and Director-General as applicants and appellants in three combined cases, offers a sharply different view. It claims the Regulator has misinterpreted POPIA and overlooked the constitutional and societal value of transparency in education.
In its court filings, the DBE insists that publication is a public function rooted in accountability and tradition, not a privacy violation. It emphasizes that results are anonymized and asserts that “no ordinary person can identify a learner by their examination number.”
It cites section 11(1)(e) and (f) of POPIA, which allow for processing when needed for fulfilling a public duty or pursuing legitimate interests. The DBE argues that publishing results “ensures that the integrity of the examination system is open to public scrutiny” and helps confirm that no manipulation or corruption occurred in releasing results.
The department further claims that the Regulator exceeded its authority by issuing a proactive enforcement notice about future conduct, referencing section 95(1) to assert that enforcement notices are meant for past or present violations, not hypothetical future actions.
In its words: “The proactive enforcement notice served by the Information Regulator regarding the future publication of matric examination results is null and void.”
On procedure, the DBE insists the court has inherent constitutional power to allow a late appeal, citing sections 34 and 173 of the Constitution. It argues that to do otherwise would “close the doors of justice” and undermine the fundamental right of access to courts.
Afriforum and media respondents: The public interest cannot be redacted
Afriforum, represented by Anlé Spies, along with Maroela Media Ltd, the South African National Editors’ Forum, and Arena Holdings, have joined as respondents opposing the Regulator’s enforcement notice. Their involvement stems from the original 2022 litigation that led to the anonymised publication regime, and they now argue that the public’s right to know cannot depend on consent forms.
In their submissions, they describe the enforcement notice as “an attack on freedom of expression and on the media’s role in reporting national education outcomes.” They view the publication of anonymized results as “a legitimate journalistic and civic exercise that has existed for decades.”
Afriforum’s filing states: “The Information Regulator’s interpretation would render the public record unclear and make the media’s function impossible. Transparency about the outcomes of a public examination system cannot be recast as a breach of privacy.”
They also stress that the 2022 High Court order permitting publication “settled the matter in principle” and that the Regulator is “trying to reopen what the courts have already resolved.”
Competing visions of constitutional balance
As Tsatsawane SC stated in court, “POPIA was enacted to protect personal information, not to shield public institutions from scrutiny. The publication of results is not scrutiny; it is exposure of learners.”
In contrast, the department’s counsel argued that “the Regulator’s perspective would mean that no information of public significance can be shared unless every affected individual consents—a requirement that undermines public administration.”
The Full Bench and what comes next
A Full Bench of three judges heard oral arguments beginning Monday, 27 October 2025. The proceedings featured vigorous discussions on what constitutes “identifiability” under POPIA and whether the High Court’s inherent jurisdiction can override statutory deadlines.
The judges were expected to reserve judgment after the second day of hearings on Tuesday, 28 October 2025.
Get your news on the go. Click here to follow the Conviction WhatsApp channel.
