South African newspapers will continue to print matric results, but now only with examination numbers, after the Supreme Court of Appeal granted the Information Regulator leave to appeal an earlier judgment. The regulator had argued that even coded results breach the Protection of Personal Information Act (POPI Act), which protects personal data.
The POPI Act defines personal information as any data that can identify a living person. The regulator’s position is that a matriculant’s result, even when linked only to an exam number, still points to an identifiable individual and therefore requires consent before publication. The Department of Basic Education chose to ignore an enforcement notice from the regulator and published the results with numbers, a move the court said was permissible under the current legal framework.
AfriForum, an education advocacy group, welcomed the court’s decision. Alana Bailey, AfriForum’s head of cultural affairs, told BusinessTech that the case is about more than school results: “The IR neither realises the futility of this case, nor the risks that a ruling in its favour would entail. While the IR is playing power games, it is the future of information that must be disclosed in the public interest that is at stake.”
What this means for businesses
The regulator’s appeal could reshape how any industry that publishes data using codes or numbers handles privacy. Research firms, background-check providers and even small retailers that share customer information with partners often rely on anonymised identifiers. If the court ultimately sides with the regulator, those practices may need to be re-engineered, adding compliance costs and requiring new consent mechanisms.
For SME owners, the takeaway is clear: POPI compliance is not optional, and the definition of “personal information” can expand as courts interpret the law. Companies should review their data-handling policies now, especially where they use coded identifiers, and consider using tools such as our compliance document generator to audit their processes.
The appeal is still pending, and the court has not yet ruled on the broader balance between privacy and public interest. Until a final judgment is issued, businesses should treat the current newspaper practice as lawful but remain vigilant for any regulatory changes.
Read more analysis on similar regulatory developments in our Regulatory & Policy section.
The Information Regulator, established under POPIA, has increasingly asserted itself in disputes over how personal information is published or handled by media and other organisations, and a Supreme Court of Appeal ruling on its standing to appeal in a matter like this one has implications beyond the specific matric results dispute, since it clarifies how far the regulator’s own enforcement reach extends into matters already decided by a lower court. The Information Regulator’s own case disclosures track its litigation history on matters like this. For related coverage, see this site’s Regulatory and Policy coverage.
South African courts have generally been cautious about extending a regulator’s own standing to intervene in disputes that were not originally brought by or against it, since doing so can significantly expand the range of matters a body like the Information Regulator can involve itself in going forward, well beyond the specific case at hand.
The underlying matric results dispute itself has drawn attention beyond its immediate parties because it touches on how publicly available exam data can be used without running afoul of privacy protections meant to shield individual students from being singled out.
Newspapers and other media houses that publish exam results drawn from publicly released data have generally argued they are performing a legitimate public interest function, tracking school performance over time, a position this case will help clarify the legal boundaries of.
