NN 21/2024

 MEDIASTATEMENT:  unilateral promulgation of 
     Minimum Uniform Norms and Standards for

Public School Infrastructure

The SAOU issued the following media statement on 3 June 2024:

It is with great concern that the SAOU took cognisance of the fact that the Department of Basic Education (DBE) on 28 May 2024 promulgated in Government Gazette 50724 new regulations pertaining to the Minimum Uniform Norms and Standards for Public School Infrastructure.

These regulations were made without any prior notice or consultation with role-players in education.

The SAOU engaged with the DBE regarding this matter since 2023 and even obtained a court order against the DBE with costs as will more fully appear from Annexure A hereto.

Surprisingly the DBE ignored the court order, and contrary to the partnership model created in the South African Schools Act, unilaterally promulgated the regulations.

The SAOU today sent a letter to the Minister of Basic Education demanding the immediate withdrawal of the regulations, pending an open, transparent and comprehensive consultation process with all role-players in the Education sector.

If the regulations are not withdrawn promptly, legal steps will be taken by the SAOU to prevent the implementation thereof.

THE POPI ACT IN A NUTSHELL

The application of the Personal Information Protection (POPI) Act is still a vague topic in schools which gives rise to numerous questions that we shall attempt to answer in this newsletter.

Background of the POPIA

It is important to understand that the POPI Act is not a new piece of legislation. Parliament approved the POPI Act in 2013 with various enforcement dates for different sections of the Act.

What does the POPI Act entail?

The POPI Act was established to protect personal data (information) of the data subject (the person to whom the personal information belongs).

What will be a data subject in a school?

The term is defined in the Act as any person to whom the personal information relates.

What information is considered personal information in terms of the POPI Act?

Information relating to an identifiable, living, natural person or legal entity. This includes, but is not limited, to the following:

• Race;
• Gender;
• Pregnancy;
• Marriage Status;
• National, ethnic or social origin;
• Colour;
• Sexual Orientation;
• Age;
• Physical or mental health;
• Wellbeing;
• Disability;
• Religion;
• Conscience;
• Belief;
• Culture;
• Language and birth of the person;
• Information relating to the education or the medical, financial, criminal or work history of a person;
• Any identification number, symbol, email address, physical address, telephone number, location information, online identifier or other specific assignment to a person;
• The biometric information of a person;
• The personal opinions, views or preferences of a person;
• Correspondence sent by a person which is implicitly or expressly of a private or confidential nature or further correspondence which would reveal the content of the original correspondence;
• The views or opinions of another individual about a person; and
• The name of the person if it appears together with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

How should schools protect personal information?

• By obtaining consent from the data subject for the processing of the personal information. Consent in terms of the POPI Act will be sufficient if it is a specific, informed expression received on a voluntary basis.
• By processing the personal information only for the purpose for which it was collected.
• The school must destroy personal information properly as soon as the purpose for collection has expired.
• By storing the personal information properly to prevent the leakage thereof.

What can happen if a school does not obtain the necessary permission for the collection of personal information?

A complaint can be lodged with the Information Regulator against the offender. This can have serious consequences.

Sections 100–106 of the POPI Act deal with instances where parties would find themselves guilty of an offense. The most relevant of these are:

• Any person who hinders, obstructs or unlawfully influences the Regulator;
• A responsible party which fails to comply with an enforcement notice;
• Offences by witnesses, for example, lying under oath or failing to attend hearings;
• Unlawful Acts by responsible party in connection with account numbers;
• Unlawful Acts by third parties in connection with account number.

Section 107 of the Act details which penalties apply to respective offences. 

For the more serious offences the maximum penalty is a fine not exceeding R 10,000,000.00 or imprisonment for a period not exceeding 10 years or to both a fine and such imprisonment. 

This article must be read in conjunction with the POPI Act which can be downloaded from Act No. 4 of 2013: Protection of Personal Information Act, 2013.

Is there any provision in the POPI Act which allows the collection of personal information without the consent of the data subject?

Yes, personal information may be collected without consent in the following cases:

• If the processing is necessary in terms of a contract to which the data subject is a party;
• If there is a legal obligation to carry out the processing;
• If processing offers protection of a legitimate interest of the data subject;
• If a public body is obligated to undertake the processing;
• If the processing is necessary to pursue the legitimate interest of the data controller/third party.

With specific reference to the personal information of children, Article 35(1) of POPI states that the prohibition on the collection of personal information of children is excluded in the following cases:

• If the information is collected with prior consent, and if consent is not granted:
• If the collection of personal information is necessary to maintain rights and/or obligations in terms of legislation;
• If the collection of personal information is necessary to comply with an obligation of International Public Law;
• If the collection of personal information is done for historical, statistical or research purposes; and
• If the personal information was deliberately disclosed by the child himself with the consent of a competent person.

Which POPIA rules are important for schools to remember?

• Do not collect more personal information than is necessary.
• Make sure the informed consent from the data subject has been received.
• Be sure of the purpose of the personal information and use it only for that purpose.
• Be open and honest with the data subject about the purpose for which the personal information is collected.
• Exercise proper security measures in the storage of the personal information.
• Despite the exceptions, obtain consent from the data subject before collecting personal information.
  

PRINCIPALS' SYMPOSIUM

Principalship: Be the light in the lighthouse!
Date:  1 – 4 September 2024, Venue: Boardwalk Conference Centre, Gqeberha

The SAOU Principals’ Symposium 2024 promises to, once again, exceed all expectations. A thousand SAOU deputy-principals and principals, excellent presenters, extremely relevant, hot topics, phenomenal SAOU hosting and a venue synonymous with quality: THAT is what you can expect, nothing less.

Visit our web page for further information regarding the event, with specific reference to the following:

1.      The registration page;

2.      The programme; and

3.      Information relating to accommodation.

The Symposium is almost fully booked! To avoid disappointment, register today.