Mistakenly sent emails are data breaches in South Africa — Legal experts

[Luis]

Copying the wrong person on an email could be considered a data breach in South Africa

Misdirected internal emails that expose personal information can trigger mandatory data breach reporting under South Africa’s data privacy law, POPIA, even when the disclosure was accidental.

Armand Swart, Hlonelwa Lutuli, and Isabella Keeves from Werksmans Attorneys said an Information Regulator enforcement notice against Central Johannesburg TVET College confirmed this position.

 

[SkillBeatsAll]

Happened to me. I’ve never gotten an email from them regarding my policy, but other customers have!



Asked them to send me the email too, but of course, ignored.

 

[SkillBeatsAll]

@Luis is it considered a data breach if the data sent included documents encrypted with the recpient's ID number as a decryption key?

Well, if the PDF is encrypted with older standards like RC4, it’ll take a few minutes to crack;

AES-256 would take quite some time, but it helps that we know it’s a 13 digit ID, and you can infer some details like male / female from the email which can reduce the permutations.

Either way, should be treated like a breach, encrypted or not!

 

[konfab]

I regularly get random medical correspondence for medical aids claims, bookings etc.

 

[_TrXtR_]

So they didnt consider it a data breach? Omw