Section 11(1)(c) of the Protection of Personal Information Act 4 of 2013 (“POPIA”) states that information can be processed if there is an obligation imposed by law on the responsible party.
Sections 12(2)(d)(iii); 15(3)(c)(iii), and 18(4)(c)(iii) of POPIA; state that information of a data subject can be collected from another source; can be further processed; and that the data subject does not have to be made aware of such processing where non-compliance is necessary; “if such processing is for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated”
Therefore, the question arises whether a data subject can object to his information being used by a party who was legally obligated to do so for proceedings in any court.
In the case of Divine Inspiration Trading 205 (Pty) Ltd v Gordon and Others, the Applicant requested the medical records of the 1st Respondent for a court proceeding for a claim of damages. The Applicant subpoenaed the doctors (the 2nd and 3rd Respondent) of the 1st Respondent to disclose the medical records. The 2nd and 3rd Respondent stated they could not disclose the medical records as the 1st Respondent did not give them consent to do so.
The Applicants then filed a Rule 35(3) notice to disclose information of the 1st Respondent. The 1st Respondent objected to processing her information and stated that disclosing her medical records would unjustifiably infringe on her rights under section 11 of the POPI Act.
The court held that section 11(3) of the POPI Act states a data subject can object to the processing of personal information in terms of section 11(1)(d) to (f) unless legislation provides for such processing. It further stated that there is a good reason that section 11(1)(c), which states information can be processed if the processing complies with an obligation imposed by law, was excluded from section 11(3). The legislature never intended to exclude the processing of information where the law required such processing.
The court summed up section 11 of the POPIA by stating that information can be processed when there is a legal obligation imposed by law and where the processing is necessary for pursuing the legitimate interest of the responsible party or by third parties to whom the information is supplied. A data subject can object to the processing regarding the first instance but not the second.
The court further held that Section 12(2)(d)(iii) and Section 15(3)(c)(iii) permits the collection of information from another source and that when information has already been collected, the information can be processed again if the processing is for the conduct of proceedings of any court that has commenced or is contemplated.
The court held the 1st Respondent could not object to the release of her medical records maintained by the 2nd and 3rd Respondent. The court ordered that the 2nd and 3rd Respondents must disclose all the medical records they held regarding the 1st Respondent.
From the above, the following can be confirmed:
- When a law obligates a party to process information, a data subject cannot object to such processing;
- A subpoena places a legal obligation on a party to process personal information;
- When information is needed for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated, the following applies:
- A responsible party can collect information on the data subject from a third party;
- Information of the data subject can be further processed; and
- The data subject does not have to be made aware of such processing if non-compliance is necessary.
Want to know what to do when confronted with a request for information? Contact your SEESA Consumer Protection and POPI Legal Advisor assistance. Alternatively, leave your contact details on our website, and a SEESA representative will contact you.
About The Author:
Justin Blignaut is a Labour and Consumer Protection & POPI Legal Advisor at the SEESA Klerksdorp branch. He obtained his B.Com LLB Degree from the North-West University Potchefstroom.
Resources:
- Divine Inspiration Trading 205 (Pty) Ltd v Gordon and Others 2021 (4) SA 206 (WCC);
- Protection of Personal Information Act 4 of 2013.