Posting someone’s personal information to social media platforms may not be a violation of the Protection of Personal Information Act (POPIA), but it can still land you in legal hot water in South Africa.
This is according to an analysis by Zamathiyane Mthiyane, senior associate for healthcare and lifesciences at Werksmans Attorneys.
“POPIA aims to protect an individual’s right to privacy by offering protection against the unlawful collection, retention, dissemination and use of personal information,” Mthiyane stated.
“The question that we explore is whether or not the protection afforded by POPIA also extends to photos of, and pictures including ‘memes’, of ‘data subjects’, as defined in POPIA, which are posted on social media platforms.”
Mthiyane explained that on a simple reading of POPIA the subject of a post may be considered a data subject and the person who posted the photograph may be considered a “responsible party”, as defined in the Act.
Posting someone’s personal information on social media would also, arguably, amount to the dissemination of personal information as contemplated in the definition of “processing” in POPIA.
The consequences of being considered a responsible party in terms POPIA are substantial and include the requirement for a responsible party, among other things, to comply with the eight conditions of lawful processing of personal information, as prescribed in the Act.
“The conditions include a requirement to obtain the consent of the data subject prior to posting a photograph or the views of that data subject on a social media platform,” stated Mthiyane.
The responsible party would also be required to appoint an information officer and publish and comply with a POPIA manual.
“Arguably, the application of POPIA in the above circumstances would lead to an absurd result where every individual who posts photos, memes, videos or the views of another person is considered a responsible party who must comply with onerous conditions,” Mthiyane said.
“To prevent the abovementioned situation from arising, section 6(1)(a) of POPIA states that POPIA does not apply to the processing of personal information in the course of a purely personal or household activity.”
Mthiyane said that the repercussions of this section of POPIA is, arguably, that:
- POPIA applies only to business or professional activities
- Any pictures or video taken or views shared that are disseminated on social media or any other platform in a personal capacity, POPIA arguably does not apply
POPIA does not define the terms “personal activity” or “household activity”, Mthiyane noted.
The aforementioned terms may have to be interpreted not only by the ordinary grammatical meaning of the words but also by taking into account, on a case-by-case basis, what contemplates work as opposed to personal use taking into account the context of the social media user making the posts.
Disgruntled individuals who find their personal information posted on social media platforms without their consent are not without legal remedy, though.
“Our common law, as codified in the Constitution of the Republic of South Africa, 1996, protects an individual’s right to privacy on a professional and personal basis,” Mthiyane said.
“Thus, social media users who post what may be considered as personal information should do so keeping in mind that the subject of the posts, although falling out of the ambit of POPIA, are still protected by the common law in the event that the post breaches the privacy of the subject.”