South Africa publishes matric results in newspapers and other broadcast media. This violates personal privacy laws and should be stopped immediately.

As a case in point, the recent failure to protect users information by Facebook has brought discussions around privacy laws into the limelight.

Europe reacted with the institutional interventions as outlined in the EU General Data Protection Regulation (GDPR).  GDPR is the most important change in data privacy regulation in recent history. The regulation has fundamentally reshaped the way in which data is handled across every sector, from healthcare, education to banking and beyond. It took four years of preparation and debate the GDPR was finally approved by the EU Parliament on 14 April 2016. It was enforced on 25 May 2018 – and organisations that are not compliant could now face heavy penalties.

South Africa has comprehensive data protection and privacy law called The Protection of Personal Information Act (called the POPI Act or POPIA).

The POPI Act recognises the right to privacy enshrined in the Constitution and gives effect to this right by mandatory procedures and mechanisms for the handling and processing of personal information. The POPI Act is in line with current international trends and laws on privacy. ‘Processing’ is widely defined, including the ‘collection, recording, organisation, storage, updating or modification, retrieval, consultation, use, dissemination by means of transmission, distribution or making available in any other form, merging, linking, as well as blocking, erasure or destruction of personal information.’

The POPI Act provides eight information protection principles to govern the processing of personal information. There are specific provisions for:

1. direct marketing,
2. automated decision making,
3. the processing of cross-border flows of data (see section 72 of the POPI Act).

The need for an Information Regulator to enforce the provisions of the POPI Act has also been recognised, and provision is made for penalties and offences in certain instances.

POPIA is based on the following eight principles for the processing of personal data:

1. Collection Limitation Principle – There should be limits to the collection of personal data, data should be obtained by lawful and fair means, and where appropriate, with the knowledge or consent of the data subject.
2. Data Quality Principle – Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date.
3. Purpose Specification Principle – The purpose of the collection of data should be specified at the time of collection and data should not be used for anything other than its original intention without again notifying the data subject.
4. Use Limitation Principle – Personal data should not be used for purposes outside of the original intended and specified purpose, except with the consent of the data subject or the authority of the law.
5. Security Safeguards Principle – Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data.
6. Openness Principle – There should be a general policy of openness about developments, practices and policies with respect to personal data. Individuals should have easy access to information about their personal data, who is holding it, and what they are using it for.
7. Individual Participation Principle – An individual should have the right to know if a controller has data about him/her and to have access to that data in an intelligible form for a charge, if any, that is not excessive. An individual should also have the right to challenge a controller for refusing to grant access to his/her data, as well as challenging the accuracy of the data. Should such data be found to be inaccurate, the data should be erased or rectified.
8. Accountability Principle – Data controllers should be accountable for complying with the measures detailed above.

Using the 8 pillars above as a basis for argument, the proposal is that the practice of sharing personal matric results should be stopped. It is of no benefit to the matriculant and society at large.

Learners or their parents do not sign any contracts with the Department of Basic Education giving them express permission to share their matric results with third parties. Newspapers and other media that broadcast these results have no legal mandate to do so. The Department should be investigated how it transfers that data from Umalusi to these broadcasters. This data is being obtained illegally by 3rd parties.

The transferring and subsequent publishing of matric results does not have any relevance in the education value chain. The broadcast of results does not add any value to the learner, parent, department and all other stakeholders. Minister Angie Motshekga has to explain the relevance of this practice.

There is a direct abuse of learners’ data as it is being used for purposes that it was not intended for. The objective of collecting the data is not to publish it in public domains without the learners and their parents’ consent.

The department of basic education has to prove that it uses secure means to illegally transmit learner data to third parties. It is necessary that the department shares its agreements with all the partners it shares this data with.

Learners and their parents have a right to know who has access to their data and to what extent this access reaches. These stakeholders also have a right to refuse access to their data from 3rd parties. Moreover, learners should be able to access and delete their data from 3rd party holders of the data.

In the event that a 3rd party makes an error in the publishing and broadcasting of the learner data, the learner should be able to take legal actions to be compensated for the error. Learners should be able to charge 3rd parties for use of their data.

It is a no-brainer for the DoB to halt this exercise as it does not serve anyone besides violating information access and privacy laws.

7 ways the 2018 matrics results can be accessed

According to News24 these are the ways in which a learner can access results. This cannot be legal. It has to be stopped.

1. News24

You can get your results on News24’s Matric Results website and mobisite: matricresults.news24.com.

Register now to receive an SMS the moment the results are released.

2. School 

The Department is encouraging learners to get their results from the schools or centres where they wrote their exams. (Call first to make sure they’re open). This is fun as classmates can gather round and celebrate or commiserate together. The certificate will be printed and posted only weeks later.

3. Newspapers

The results will be published in all major daily newspapers. You’ll need to know your exam number (no names are published). You won’t be able to see subject results, only whether it’s a pass, Bachelors pass, etc.

Also see: What are the matric pass requirements?

4. Send an SMS

For state schools:

The Department of Basic Education and SABC Education have partnered again to offer instant results via SMS.

Register via SMS by sending your identity number followed by your exam number to 35658. After your registration has been successful you will receive a confirmation SMS. SMSs cost R1 (free SMSs don’t apply).

For IEB results:

If you have already provided the IEB with your cell phone number, your results will automatically be sent to that number. If not, you can register by sending an SMS to 35135. Use the following text in the message:

Results Examination Number Birth Date (ccyymmdd). Example: Results 173456789012 19980121

You will receive a message confirming registration has been successful. Please note that the SMS costs R3. For more information, visit the IEB website.

5. Use the USSD service

On the day that the results are released, dial *120*35658#. After answering multiple questions, you are required to enter your ID number. You’ll then receive your results per subject. You will have the option to opt in or out to comply with the Protection of Personal Information Act. USSD rates apply.

6. IEB and DoB websites

• The IEB website will have the results from midnight Wednesday 2 January (Thursday morning).
• The Department of Basic Education’s website will publish the results from 6:00 on the day.

Have your exam number ready, and bear in mind that website traffic will be high, so expect delayed response times.

7. Call the Department

If you have the courage to hold for – potentially – a very, very long time, you could dial 082 152 to receive your matric results.