The publication of matric results has been a long-standing tradition in South Africa. Newspapers and online platforms annually announce the results of students who have completed their National Senior Certificate (NSC) exams, which is often accompanied by a celebration of academic milestones.
However, this practice is now under scrutiny as the South African Information Regulator has banned the publication of matric results in an enforcement notice issued to the Department of Basic Education (Department) on 6 November 2024 in terms of the Protection of Personal Information Act (POPIA).
Following an own-initiative assessment in respect of the Department’s compliance with the provisions of POPIA, the Information Regulator found that the Department had failed to obtain the prior consent of learners (or that of parents/ guardians for learners below the age of 18 years) to publish their 2023 NSC exam results in newspapers.
Consequently, the Information Regulator has ordered the Department to, among other things: (i) provide it with an undertaking that it will not publish the NSC exam results of the 2024 matriculants in the newspapers; and (ii) in respect of the 2025 matriculants, develop a system to obtain the voluntary and informed consent of learners or their parents/ guardians before the publication of their results, which system must be verified by the Information Regulator before deployment to ensure compliance with the provisions of POPIA.
The legal framework under POPIA
POPIA, enacted to promote the protection of personal information, imposes conditions relating to the collection, use and dissemination of such information by public and private bodies. For purposes of POPIA, personal information is information relating to an identifiable, living natural person, and where applicable, an existing juristic person. It expressly includes an individual’s educational history, an individual’s name if it appears with other personal information, an individual’s identity number and any other identifying symbol, such as an examination number.
In terms of POPIA, personal information may only be processed on limited justifiable grounds. These grounds include where: (i) the processing is necessary to comply with an obligation imposed by law; (ii) the processing protects a legitimate interest of the data subject; (iii) the processing is necessary to pursue the legitimate interests of the organisation or a third party; or (iv) the data subject consents to the processing.
Whilst the Department sought to justify the publication of the results with reference to laws, including the National Policy Pertaining to the Conduct, Administration and Management of the NSC Examination and the Constitutional injunction that a child’s best interests are of paramount importance, the Department failed to demonstrate that these laws imposed a legal obligation on it to publish the results in the newspapers.
Moreover, the Department contended that the publication of the matric results was necessary to protect the legitimate interests of the learners concerned. Whilst theoretically there may be an argument that the publication of results in newspapers ensures access for all learners, this is not the only method available to learners to obtain their matric results.
The Department also failed to demonstrate how its own legitimate interests would be pursued by publishing the results in the newspapers and what those interests were. Notwithstanding this, the Information Regulator noted that the interests of the Department or the media cannot override the interests or freedoms of the learners.
In the circumstances, the only justifiable ground upon which the Department could publish the matric results was with the consent of each learner (or their partner/ guardian) concerned.
Right to privacy vs access to information
The Information Regulator’s decision has sparked a national debate about the need to balance the right to privacy with the principles of transparency and public access to information.
Advocates for the ban may argue that publishing the results without consent may subject learners to undue exposure. Whilst certain learners may welcome public recognition, not all students achieve their desired outcomes making them vulnerable to potential stigma or exacerbating their feelings of failure. The publication of identifiable information could also lead to unwanted contact by organisations or individuals, and learners may be less equipped to navigate such risks.
Critics of the ban, on the other hand, may argue that it restricts access to information that serves a public interest. The publication of results has historically offered a measure of transparency into the country’s educational performance and has fostered a collective recognition of learners’ achievements. Moreover, educational institutions, employers and other stakeholders may seek to rely on the results to make certain decisions.
In this context, one needs to consider whether there are any measures that could address the privacy concerns of learners whilst at the same time providing the public with access to information relating to matric results.
The middle groundÂ
De-identifying or aggregating the matric results may present an alternative approach. In this regard, POPIA does not apply to the processing of personal information that has been sufficiently de-identified. This means that the information that identifies an individual or can be used, manipulated or linked by reasonably foreseeable methods to identify the individual, has been deleted.
Whilst previously the names and surnames of learners were deleted and only the learner’s examination number was published in the newspapers, it was still possible for learners in the same school to identify other learners and their results.
If the Department can develop a method of assigning examination numbers to individual learners that ensures that a learner cannot be identifiable, it is arguable that POPIA would not apply to the publication of the results.
Even if it is not possible to sufficiently de-identify the matric results, newspapers could still publish aggregated or generalised results. For example, if a newspaper reported that 60% of all learners passed or 4% of learners achieved three distinctions, it may not be reasonably possible to use these percentages to identify the relevant learners. This would assist in serving the public interest to transparency without compromising learners’ right to privacy.
One of the main drivers for the publication of results is the collective celebration of top achievers, and the Department, schools and media ordinarily seek to acknowledge these learners by publishing their names, results and photographs.
The acknowledgement of top achievers will still be possible provided that the voluntary and specific consent of the learner (or their parent/ guardian) is obtained (which consent is unlikely to be withheld), or the learner has deliberately made her/ his results and personal information publicly available on a social media platform.
Publishing the results of top achievers only, with their consent, will uphold the right to privacy of the many learners who did not achieve their desired results or who do not wish for their results to be made public.
In conclusion, whilst the Information Regulator’s decision underscores the importance of the right to privacy, it also challenges a long-standing tradition of transparency. It is, however, possible to celebrate the achievements of learners and keep the public generally informed as to the performance of a particular year of matriculants, within the ambit of, and in compliance with, the provisions of POPIA.
Whether through informed consent, de-identification, or alternative publication methods, finding a middle ground will assist with addressing the needs of learners, the Department, educational institutions, and the public at large.
