Our Services

Our Services

September 26, 2024

Summary of Munetsi v Madhuyu and Another: A POPIA Case on Personal Information Disclosure


This article discusses the judgment in the case of Munetsi v Madhuyu and Another handed down by the Western Cape High Court in August 2024.

Introduction to Privacy and POPIA

In today's digital age, protecting personal information is crucial. The Protection of Personal Information Act 4 of 2013 (POPIA) aims to safeguard individuals' personal data by regulating how such information can be processed. One of the key principles under POPIA is that personal information can only be processed with the consent of the data subject, or under specific circumstances defined in the Act. This case highlights the implications of sharing personal information without consent, particularly on social media platforms.

Facts of the Case

In Munetsi v Madhuyu and Another, the applicant, Mr. Munetsi, sought legal action against Mr. Madhuyu and another party after they disclosed his personal information—specifically his mobile number—on social media, along with a video that prompted followers to contact him. This led to an overwhelming number of phone calls directed at Mr. Munetsi, which he deemed intrusive and defamatory.

Mr. Munetsi claimed that the publication of his mobile number constituted a violation of his right to privacy as protected by POPIA. He requested a public apology, the removal of the posts containing his information, and punitive costs against the respondents.

Court’s Findings

The Western Cape High Court examined the case and assessed whether the respondents had violated POPIA. The court emphasized Section 11 of the Act, which states that personal information can only be processed under certain conditions:

Section 11 of POPIA provides that personal information may only be processed if:

• the data subject consents to the processing.

• the processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party.

• the processing complies with an obligation imposed by law on the responsible party.

• the processing protects a legitimate interest of the data subject.

• the processing is necessary for the proper performance of a public law duty by a public body, or

• the processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.

The court found that none of these conditions applied to the case at hand. By publishing Mr. Munetsi’s mobile number without his consent, the respondents breached Section 11 of POPIA.

While the court recognized that some statements in the video were defamatory, it was particularly concerned with the infringement of Mr. Munetsi's right to privacy. The mere fact that the phone number might have been publicly accessible elsewhere did not absolve the respondents from responsibility for sharing it in a manner that violated Mr. Munetsi's privacy.

Order Issued by the Court

The court ruled in favour of Mr. Munetsi and issued the following orders:

  • The respondents were instructed to remove the video and any posts containing Mr. Munetsi's mobile number from all their social media platforms.
  • An interdict was granted, prohibiting the respondents from disclosing Mr. Munetsi’s personal information without his consent in the future.
  • The respondents were ordered to bear the costs of the application.

Conclusion and Summary

The Munetsi v Madhuyu and Another case serves as a critical reminder of the importance of respecting privacy rights under POPIA, particularly in the context of social media. It illustrates the potential legal consequences of disclosing personal information without consent and emphasizes the need for caution when sharing or processing such data.

Advice for Avoiding Breaches of POPIA

To protect yourself and others from potential breaches of POPIA, consider the following guidelines:

  • Obtain Consent: Always seek clear and informed consent before sharing personal information, whether it's your own or someone else's.
  • Review Privacy Settings: Regularly check the privacy settings on social media accounts to manage who can view your information.
  • Think Before You Post: Assess whether the content you are about to share contains sensitive personal information.
  • Organizational Policies: For businesses, it's vital to have clear policies in place regarding data collection, processing, and sharing. Ensure that your privacy policies inform users of their rights and the measures in place to protect their data.
  • Report Breaches: If a data breach occurs, organizations must report it promptly to the Information Regulator and notify affected data subjects.

This case underscores the vulnerability of personal information in the digital landscape and the necessity for compliance with data privacy laws like POPIA.