The Information Regulator has welcomed action taken by the Department of Basic Education (DBE) to align its processes on the publication of matric results with the requirements of the Protection of Personal Information Act (POPIA).
This comes after the DBE re-issued POPIA-compliant consent forms to matriculants for the publication of their matric results.
In a statement, the Information Regulator reveals it met with the DBE in September, to provide guidance on obtaining consent for the publication of personal information where a data subject is a child.
After the meeting, the DBE issued consent forms to the approximately 900 000 matriculants who sat for this year's examinations.
However, upon assessment of the form, the information watchdog says it found it fell short of the requirements in POPIA. It notes the areas of concern were that the form was not purpose-specific and did not afford the data subject an opportunity to either consent or not consent to each area that required the processing of their personal information.
The DBE has since revised the consent form to allow learners to choose what they consent to and are also given an opportunity to withdraw consent, according to the regulator.
Information Regulator chairperson advocate Pansy Tlakula says: “I am pleased the department has accepted our proposals and the form is now compliant, and I commend the department for their commitment to comply with POPIA.”
Earlier this year, the two entities butted heads on the unauthorised publication of matric exam results on media public platforms.
At the core was the issue of ensuring the processing of matric results is done in compliance with POPIA, with the Information Regulator stating the cardinal principle of POPIA is to safeguard citizens’ personal information.
According to the regulator, in a meeting held on 12 January, relating to the publication of the matric results, it clarified that DBE, as a responsible party, is empowered to decide on the approach to issue or publish the matric results.
This, however, must be based on the provisions of POPIA and the adherence to the eight conditions for lawful processing of personal information.
The regulator adds it will embark on a full compliance assessment of the DBE's policies and practices on the processing of personal information. This will be an own initiative assessment as outlined in section 89 of POPIA.
“This will seek to assess and monitor the department's compliance with the provisions of POPIA in its entire operations and not just one area of its work.”
Share