POPIA Compliance in Legal Defence: Balancing Surveillance Evidence and Privacy Rights in South Africa

 

 #POPIA #PrivacyLaw #SurveillanceEvidence #LegalDefense #DataProtection #SouthAfricanLaw"

The case of De Jager v Netcare Limited (2025) addresses critical questions about privacy rights, surveillance evidence, and corporate accountability under South Africa’s data protection laws. This judgment clarifies how courts balance constitutional privacy rights with legitimate legal interests when personal information is used in litigation. Below is a structured summary of the legal principles, case details, and broader implications.

Legal Principles

South Africa’s Protection of Personal Information Act (POPIA) governs the processing of personal data, including health information and surveillance footage. Key principles include:

• Subsidiarity: Courts require litigants to rely on POPIA (rather than direct constitutional claims) when addressing privacy disputes, as POPIA codifies constitutional rights into actionable law.
• Legitimate Interest: Organizations may process personal data without consent if necessary to defend legal rights, provided the intrusion is proportionate and justified under POPIA.
• Special Personal Information: Health data (classified as “special personal information” under POPIA) can be lawfully processed if required for legal proceedings.

Case Overview

Facts

• Plaintiff: Nicolaas De Jager sued Netcare for R25 million in damages after losing vision in one eye during cataract surgery.
• Defence Strategy: Netcare hired a private investigator to covertly film De Jager’s daily activities, arguing the footage disproved his claimed disabilities.
• Privacy Challenge: De Jager objected to the surveillance evidence, claiming it violated his constitutional right to privacy (s14 of the Constitution).

Key Legal Issues

1. Constitutional vs. Statutory Claims
• The court dismissed De Jager’s reliance on s14 of the Constitution, ruling that POPIA—not direct constitutional claims—must govern privacy disputes.
2. Admissibility Under POPIA
• Legitimate Interest: The court applied a s36 constitutional balancing test, finding Netcare’s need to defend itself outweighed De Jager’s privacy rights. Surveillance in public spaces was deemed minimally intrusive.
• Special Personal Information: Section 27(1)(b) of POPIA permits processing health data if necessary for legal defence. The court accepted Netcare’s surveillance as lawful under this exception.
• Third-Party Data: Footage showing unrelated individuals (including children) was ordered to be redacted to comply with data minimization principles.
3. Notification Requirements
• Section 18(4)(c)(iii) of POPIA exempts organizations from notifying data subjects if disclosure would undermine legal proceedings. The court upheld Netcare’s decision to withhold advance notice.

Court Decision

• Surveillance Evidence Admitted: The High Court ruled the footage was lawfully obtained and critical to Netcare’s defence.
• Redaction Ordered: Non-relevant third-party data (e.g., bystanders) in the footage had to be removed to protect their privacy.
• Costs: De Jager’s application to exclude evidence was dismissed, with costs awarded to Netcare.

Implications for Businesses and Healthcare Providers

• Lawful Surveillance: Organizations may use surveillance evidence in litigation if it is proportionate, public, and directly relevant to defending legal claims.
• POPIA Compliance:
• Update privacy policies to include scenarios where data may be processed for legal defense.
• Conduct Personal Information Impact Assessments before deploying surveillance.
• Third-Party Data: Redact unrelated individuals’ information from evidence to comply with data minimization rules.

Conclusion

The De Jager case reinforces that while privacy is a fundamental right, it is not absolute. Courts will prioritize POPIA’s framework over standalone constitutional claims, emphasizing proportionality and legal necessity. For businesses, this underscores the need to align surveillance practices with POPIA’s requirements, ensuring transparency and minimal intrusion. For individuals, the judgment highlights that privacy protections may yield to compelling legal interests, particularly in adversarial proceedings.