The Information Regulator (InfoReg) has fined the Department of Basic Education (DBE) R5 million for violating data privacy laws after a ransomware attack exposed personal information. The fine stems from the DBE's failure to comply with an enforcement notice regarding the publication of 2024 matriculation results, which must be made available to learners in a POPIA-compliant manner.
In another landmark decision, SA’s data privacy enforcer the Information Regulator (InfoReg) has slapped the Department of Basic Education (DBE) with a R5 million fine. This marks the second time a South African organisation has been fined under the country’s Protection of Personal Information Act ( POPIA )data privacy law, following a ransomware attack on its IT systems that resulted in personal information of data subjects being compromised during the attack.
Yesterday, the information watchdog issued an infringement notice to the DBE, in which it orders the department to pay an administrative fine of R5 million following its failure to comply with the enforcement notice issued by the regulator on November 18, 2024. The regulator says the enforcement notice ordered the DBE to provide an undertaking “that it will not publish the results of the 2024 matriculants in the newspapers” within 31 days from the date on which the order was served. It also ordered that the department “must not publish the results for the 2024 matriculants in newspapers and must make these results available to the learners using methods that are compliant with POPIA”. The regulator indicated that should the DBE fail to abide by the enforcement notice within the stipulated timeframe, “it will be guilty of an offence, in terms of which the regulator may impose an administrative fine in the amount not exceeding R10 million, or liable upon conviction to a fine or to imprisonment of the responsible officials”.“To date, the department has not provided the regulator with an undertaking that it will not publish the results of the 2024 matriculants in the newspapers as ordered in the enforcement notice or any other communication in that regard,” it says. “The DBE had the right to appeal the enforcement notice in terms of section 97(1) of POPIA. POPIA provides amongst others that if an appeal is brought, the enforcement notice need not be complied with pending the determination or withdrawal of the appeal
NEWS DATA PRIVACY POPIA RANSOMWARE ATTACK EDUCATION DEPARTMENT SOUTH AFRICA
South Africa Latest News, South Africa Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
DBE Challenges Regulator's Ban on Publishing Matric ResultsThe Department of Basic Education (DBE) is seeking to overturn an order from the Information Regulator (IR) that prevents the publication of 2024 matric results in the media. The IR issued the order due to the DBE's alleged violation of the Protection of Personal Information Act (POPIA). The DBE plans to engage with the IR to find a solution before the results are released in less than a month.
Read more »
South Africa's Matric Results to Be Published in Newspapers Despite Regulator's ConcernsThe Department of Basic Education (DBE) in South Africa will continue publishing matriculation exam results in newspapers, despite an instruction from the Information Regulator to stop the practice. The regulator cited concerns about the Protection of Personal Information Act (POPIA) infringement, arguing the DBE lacked consent from students or their parents for publishing results. However, the DBE appealed the decision, claiming the regulator can only address past or present breaches, not anticipate future ones.
Read more »
Education department fined R5m over 2024 matric resultsAmid a legal battle, the Department of Basic Education (DBE) has been fined R5 million in relation to the publication of 2024 matric results.
Read more »
South African Education Department Fined for Violating Data Protection LawsThe Department of Basic Education in South Africa has been fined R5 million for disobeying an order from the Information Regulator to stop publishing matriculation (high school graduation) results in national newspapers. The regulator cited violations of the Protection of Personal Information Act (Popia), arguing that publishing results in newspapers without proper consent breaches data privacy. The department was instructed to make results available through secure and compliant methods like direct collection from schools or a confidential SMS service.
Read more »
Education department gives media go-ahead to publish matric resultsThe Department of Basic Education has confirmed that the 2024 matric results will be published in the media, pending a court challenge to the Information Regulator's enforcement notice.
Read more »
South African Education Department Fails to Address Teachers with Criminal RecordsThe Free State education department in South Africa employs 649 teachers with criminal records, raising concerns about the safety of students and staff. The department lacks a clear timeline for removing these individuals from teaching positions.
Read more »