The Information Regulator has written to the Department of Basic Education (DBE) to request information regarding the alleged leaked 2024 matric results.
In a statement, the regulator says it became aware of social media posts alleging that matric results were being made available to the public, via a website, upon payment of a fee of R100, ahead of the official release of the results by the basic education minister.
“The regulator is concerned that the personal information of data subjects may have been unlawfully accessed and compromised. On Monday, 13 January, the regulator became aware of a public announcement by the minister of basic education that there was a breach of the DBE’s information through the leaking of the matric results on a private website,” it says.
During the announcement, basic education minister Siviwe Gwarube said the State Security Agency of SA and the Hawks are investigating a possible data leak.
The regulator says it cannot address the specifics of the security compromise of personal information of learners held by the DBE until the department has fulfilled its obligations under Section 22 of the Protection of Personal Information Act 4 of 2013 (POPIA), to provide all the relevant details.
Section 22 of POPIA states that when a responsible party has suffered a security compromise, the public or private body must notify the regulator within a reasonable time.
It also requires that the responsible party, such as the DBE, should notify the Information Regulator and data subject(s) of the security compromise that it has suffered.
“The regulator has not yet received such a notification from the DBE. Any unlawful access to, and usage of personal information of data subjects, is treated with extreme seriousness and concern by the regulator. The security compromise of learners' personal information under the custody of the DBE is no different.”
The Information Regulator has requested the DBE to provide it with details and sufficient information to allow the data subjects to take protective measures against the potential consequences of the compromise.
The requested information must reach the regulator by the end of business today, it says.
Share