Feb 18, 2019

Failure to report misconduct could cost you your job

Employers have often faced the frustrating predicament where they had to rely on information from their employees to identify the actual perpetrators of misconduct, and they blatantly refuse to provide the information.

Employees that intentionally refuse to disclose the identity of actual perpetrators may be dismissed because they breach the duty of fidelity towards the employer which makes the employment relationship intolerable.

This remedy was confirmed by the Labour Appeal Court in the case of Numsa obo Ngonezi and others v Dunlop Mixing and Technical Service (Pty) Ltd and others (2018).

The Court refers to this form of misconduct as ‘Derivative misconduct’. It is a term used to capture a complex idea. This term is used to label a species of misconduct evidenced by a breach of the employee’s duty of good faith by refusing to disclose information relevant to harm caused to the employer and which extends the liability of the perpetrators to them.

The concept is founded ultimately on a breach of duty of good faith which renders the employment relationship intolerable.

Derivative misconduct

The application of derivative misconduct entails a factual inquiry aimed at establishing whether the members of a group can reasonably be suspected of having material information relevant to harm caused to the employer, which will identify the actual culprits.

The existence of such knowledge must be proved on a balance of probabilities. Derivative misconduct cannot be based on negligence. An employee must, intentionally, decide not to disclose.

In a violent protected strike during which strikers threw stones and petrol bombs, set fire to the homes of managers, scrawled death threats on billboards, assaulted non-striking staff, blocked entrances with rubble and defied a court interdict, the employers called on strikers and their union to identify the culprits.

79 workers were charged for failing to provide the employer with the names of individuals guilty of actual misconduct, or explaining why they could not. Only one employee attended the hearing and she exonerated herself from any wrongdoings. The other 78 employees were found guilty and dismissed.

The employees denied that any violence had occurred. A CCMA Arbitrator ruled the dismissals of those employees who had been proved to have committed unlawful acts and those who were found to be present when those acts were committed, procedurally and substantively fair, but ruled the dismissals of those not found to have been present, unfair. They were reinstated.

The Labour Court overturned that finding on review and ruled all the dismissals substantively and procedurally fair.

The Labour Appeal Court (LAC) noted that the case was not about the right to strike, but about a strike that had ceased to be functional to collective bargaining because it was marred by violence.

The question to be answered was whether the Arbitrator has reached a reasonable decision?

The LAC held that once it can be inferred from the evidence that the employees probably were present during the violence, the employer’s onus is satisfied and the burden passes to the employees to rebut the inference.

In this case, the Arbitrator had reasoned that, since the employer had not proved that the employees were present during the violence, the employees had no reason to respond, because there was no proof that the employees must have known of the perpetrators.

The LAC had found this approach amounted to a misdirection because the Arbitrator had not applied his mind to the indirect evidence that showed that the employees were probably present.

There were several aspects of the evidence which showed that the employees were probably present when the violence occurred:

  • They were all engaged in a strike in which they were collectively involved; and
  • they had flatly denied that any violence had taken place which was a collective lie from which an adverse inference could be drawn.

The LAC held that the Labour Court had correctly concluded that it was reasonable of the employer to expect protected industrial action to be conducted in an orderly manner and that the dismissals were fair.

The LAC held further that derivative misconduct requires proof of actual (not merely putative) knowledge of the misconduct, which triggers a duty to speak.

The LAC advised employers to clarify this form of misconduct in their disciplinary codes

POPIA compliance in 2026: the basics every business still gets wrong

Even years after POPIA came into full effect, the same compliance gaps continue to surface across different industries. Many businesses believe they are POPIA compliant until a complaint, audit, or data breach proves otherwise.

Here are some of the most basic POPIA mistakes we still see:

  1. Information Officers appointed “on paper only”.
    The Information Officer is registered on the Information Regulators e-Services portal, but there is no real understanding of the role, no internal authority, and no ongoing oversight of compliance activities.
  2. Outdated or generic privacy notices
    Outdated or generic privacy notices often misrepresent actual processing activities in the company.
  3. No POPIA training beyond management
    POPIA compliance is treated as a legal or HR issue, while frontline employees, who handle personal information daily, receive little or no training.
  4. Assuming IT equals POPIA compliance
    Strong IT systems alone are not enough. POPIA also requires policies, procedures, access controls, and human behaviour management.
  5. Weak access control and data minimisation
    Employees often have access to personal information they do not need, increasing the risk of internal breaches and unauthorised disclosure.
  6. No clear process for data subject requests
    Businesses struggle to respond within reasonable timeframes because there is no documented procedure for handling requests.
  7. Not reporting data breaches to the Information Regulator
    Many organisations do not fully understand what constitutes a data breach under POPIA or how to report it. As a result, breaches are often ignored or being overlooked entirely.
  8. Failure to review and update data processing agreements with Operators
    While operators are identified, many businesses fail to put proper data processing agreements in place or to review them regularly.
  9. Treating POPIA as a once-off exercise
    Compliance is viewed as a project with an end date, rather than an ongoing process requiring regular review, updates, and monitoring.

POPIA compliance is about awareness, accountability, and continuous improvement. Identifying and fixing these common gaps is often the first step towards meaningful compliance.