A complaint was lodged against the Gauteng Education Department after personal information of more than 11 000 learners, parents and guardians was allegedly shared in a manner that is not compliant with the POPI legislation. According to the Federation of Governing Bodies of South African Schools (FEDSAS) that lodged the complaint at the Information Regulator, information of learners, parents and guardians from the Tshwane West district was not emailed in a secure manner to recipients of several schools in at least three districts in Gauteng.

“It came to our attention that the information was extracted from the SASAMS system, which is used by the State for school administration and management,” says Dr Jaco Deacon, acting CEO of FEDSAS.

Deacon says FEDSAS has been requesting that provincial education departments and SASAMS comply with the POPI Act for more than a year. “SASAMS is clearly not a secure system and it contains the personal information of millions of school going children and their parents or guardians. The aim of POPI is to give effect to an individual’s constitutional right to privacy by protecting personal information.”

Deacon says it is a concern that such a large database, and one managed by the State, does not comply with the stipulations of the legislation and that officials share the information in such a reckless manner. “Institutions had years to prepare. The Gauteng Education Department should be aware of its obligation, as responsible party, to take the necessary steps to protect information in its possession or under its management, and to train officials.”

In addition the Department is supposed to inform people whose information has been leaked if and when such an act comes to its attention. FEDSAS could not establish whether this was done. “The information includes names, addresses, ID numbers and cellphone numbers.”

Deacon says the interests of children should always be the primary consideration for all role-players in the education sector. “So much is already being done to protect children. If personal information of minor children was distributed in an unauthorised manner it would constitute gross negligence on the part of the Gauteng Education Department.”

FEDSAS made the decision to lodge a complaint against the Department in light of the fact that the organisation has requested repeatedly that departments take the necessary steps to protect information. “The legislation did not come into effect out of the blue. FEDSAS has been training governing bodies for months to ensure that they adhere to the requirements as stipulated in the POPI Act.”