In response to the South African Police Services allegedly disclosing the personal information of the Krugersdorp rape victims, the Information Regulator released a media statement on 29 August 2022, confirming that a summons had been issued against the SAPS.

The personal information of eight women who were sexually assaulted by a mob in Krugersdorp in July was disclosed on social media, but the Regulator has not been able to gather enough details around the circumstances of the disclosure.

According to the statement, the Regulator discovered after the horrifying incident that WhatsApp had been used to share the victims’ names, ages, addresses, and the specific nature of the violations committed against them. Their information was allegedly leaked by SAPS officials.

In accordance with section 90 of the Protection of Personal Information Act (POPIA), the Regulator sent a Notice of Information to the SAPS, requesting that it provide information regarding the alleged leak.

This information includes the reason for drafting the WhatsApp message, the identities of the drafters, the recipients of the messages, and the date or dates on which it was forwarded to the recipients.

Observing that the initial WhatsApp message was shared with people outside of its intended audience, the Regulator requires SAPS to confirm when this occurred, who else it was sent to, and who shared it.

SAPS was also requested to confirm whether the message had been shared in any other format or on any other platform aside from WhatsApp in order to assist the Regulator with its investigation into the disclosure.

The Regulator further requires a report from the SAPS Information Officer that the rape victims’ identities were processed in accordance with the POPIA processing conditions, and, finally, a report on the SAPS’ own investigation into the circulation of the victims’ personal information.

The Regulator first requested SAPS to provide this information by the middle of August 2022, but SAPS requested an extension to comply, which finally resulted in a response last week.

However, this response indicated that further investigation was necessary and that SAPS was unable to provide an update on when information would be available.

The Regulator deemed this to be inadequate, which led to the issue of the summons.

“We do not take kindly to the non-responsiveness or inadequate responses to issued Information Notices by responsible parties, because this interferes with the Regulator’s ability to conduct investigations into reported matters or those initiated by us. This has a serious inditement for the Regulator to provide necessary recourse to the victims of whom the right to privacy was possibly violated,” said Adv Pansy Tlakula, Chairperson of the Regulator.

As the Information Regulator has been increasing its prosecution capacity, it is clear that it is now ready to begin acting in data subjects’ interests.

Additionally, it should serve as a warning to all responsible parties, especially when dealing with sensitive information, to be extra vigilant.

Stay tuned for updates as we monitor these important developments.

The content does not constitute legal advice, are not intended to be a substitute for legal advice and should not be relied upon as such. Kindly contact us on info@cklaw.co.za or 021 556 9864 to speak to one of our attorneys.