The High Court in Pretoria has ruled that information obtained by a private investigator is lawful in terms of the Protection of Personal Information Act (POPIA) and can be admitted into evidence when it serves the defence of a legal right.
The ruling confirmed that hospital group Netcare can use the investigator’s report in its defence against a multimillion-rand claim brought by a former patient, Nicolaas de Jager.
The background to the case is that in March 2014, De Jager underwent an unsuccessful left eye phacoemulsification cataract extraction at Netcare’s Pretoria East hospital. He contracted toxic anterior segment syndrome, resulting in blindness in his left eye.
De Jager initiated a claim for damages against Netcare. In February 2018, the question of merits was settled in his favour. Netcare made two interim payments totalling R4.5 million.
In January 2019, De Jager amended his particulars of claim, seeking R24 887 600.64, alternatively R25 737 600.64.
As a result, Netcare amended its plea to challenge aspects of De Jager’s lifestyle and capabilities. It pleaded, inter alia, that: “The plaintiff’s participation in daily activities of his life is indicative thereof that he lives a normal life with no impairment in ambulating, no impairment experience when shopping, and drives a motor vehicle without any hesitation.”
In April 2022, Netcare sought to introduce evidence from Dion Pienaar, a forensic investigator, whom it engaged to conduct surveillance on De Jager between 18 August and 1 September 2020.
Pienaar was tasked with determining whether De Jager used modified vehicles or assistive devices as claimed. Pienaar’s report documented observations of De Jager driving vehicles, walking unassisted, shopping, and engaging in outdoor activities without apparent visual impairment or assistive devices.
De Jager refused to admit to any of the observations when questioned about them during a pre-trial conference.
He submitted that the surveillance amounted to the violation of his right to privacy under section 14 of the Constitution.
As a result of De Jager’s raising a constitutional issue, the High Court in May last year issued an order instructing him to comply with Rule 16A of the Uniform Rules of Court. Rule 16A governs the participation of an amicus curiae – a “friend of the court” – in constitutional litigation. In essence, it sets out a framework under which any party with an interest in a constitutional issue may be admitted to make submissions on the matter.
Three experts applied to be admitted, but only two stayed on: Professor Donrich Thaldar from the School of Law at the University of KwaZulu-Natal and Professor Sizwe Snail ka Mtuze from Nelson Mandela University.
POPIA in brief
POPIA is South Africa’s comprehensive data protection law, designed to safeguard individuals’ privacy rights while facilitating the lawful flow of information. It regulates the “processing” of “personal information”, defined broadly as any operation concerning data that can identify an individual, such as collection, storage, use, or dissemination.
POPIA distinguishes between “personal information” and “special personal information”. The latter includes sensitive categories, such as health data, biometric information, and details about a person’s sex life, religion, or ethnicity. Special personal information is subject to stricter protections, with processing generally prohibited unless specific exceptions apply.
Failure to plead POPIA
A pivotal legal principle in this case is subsidiarity. This principle mandates that when legislation has been enacted to give effect to a constitutional right, litigants must rely on that legislation rather than directly invoking the Constitution.
Section 14 of the Constitution guarantees the right to privacy, but POPIA is the statute that operationalises this right in the realm of the processing of personal information.
De Jager framed his objection to the surveillance evidence as a violation of his constitutional right to privacy under section 14, without referencing POPIA. The court found this approach problematic, emphasising that POPIA, as the legislation giving effect to privacy rights, should have been the basis for his challenge.
Judge Mandlenkosi Motha said De Jager’s failure to plead POPIA should be the end of the matter. However, the question of whether POPIA found application in this matter “is much more nuanced and cannot be disposed of that easily”.
Does POPIA apply?
The court addressed whether POPIA applies to the processing of personal information in the context of judicial proceedings.
Section 6(e) of POPIA excludes processing related to the “judicial functions of a court”, invoking section 166 of the Constitution. Netcare’s counsel argued that this exclusion meant POPIA did not apply to the surveillance evidence, because its use pertained to the court’s judicial functions.
However, the court interpreted this exclusion narrowly. It highlighted the Act’s distinction between “personal information” and “special personal information”, noting that the surveillance evidence concerned De Jager’s health – a category of “special personal information” under section 26.
The court reasoned that the exclusion in section 6(e) applies only to “personal information” in the general sense and does not extend to “special personal information”. Consequently, POPIA remained applicable to the processing of the health-related data obtained through surveillance.
Submissions by the experts
Having established POPIA’s applicability, the court evaluated whether the processing of De Jager’s special personal information was lawful.
Section 26 of POPIA prohibits the processing of special personal information unless an exception applies. Section 27(1)(b) permits such processing if it is “necessary for the establishment, exercise, or defence of a right or obligation in law”.
Thaldar argued that the surveillance was lawful under section 27(1)(b). He posited that Netcare’s use of the private investigator was necessary to defend its legal rights against De Jager’s substantial damages claim. The evidence gathered was directly relevant to challenging the plaintiff’s assertions, making the processing a legitimate exercise of Netcare’s right to a fair defence.
In contrast, Mtuze opposed the admission of the evidence. He emphasised POPIA’s requirement of consent for processing special personal information and invoked the “minimality principle”, which mandates that processed data be adequate, relevant, and not excessive.
He also argued that Netcare’s failure to obtain De Jager’s consent – per section 18 of POPIA – rendered the surveillance unlawful, regardless of its purpose.
Exception to the consent requirement
The court found Thaldar’s submission more compelling. It acknowledged that surveillance inherently relies on the element of surprise, and requiring consent would undermine its effectiveness as a tool for gathering evidence.
“Whilst I share the antipathy to special personal information being gathered surreptitiously, I found this submission of the need for consent and, compliance with the eight conditions of section 18, with respect, puzzling. I would have thought that the sting in any surveillance is in the element of surprise and surreptitiousness. If the plaintiff had been warned, he would have organised his affairs accordingly,” Judge Motha said.
Moreover, section 27(1)(b) explicitly provides an exception to the consent requirement when processing is necessary for legal defence – a condition met in this case given the significant financial stakes of De Jager’s lawsuit.
The court concluded that the processing of the health-related surveillance data was lawful under POPIA because it was essential to Netcare’s defence.
At the same time, the court was mindful of broader privacy concerns. The surveillance evidence included personal information about individuals other than De Jager, including children. The court ordered the immediate redaction all information, photos, and videos of individuals who were not the “data subject” (De Jager).
The judgment affirms that evidence obtained through surveillance can be admissible in court, provided it complies with POPIA’s exceptions – particularly when it is necessary for defending a legal right. The decision also underscores the importance of distinguishing between personal and special personal information, because this classification determines the applicability of POPIA’s protections and exclusions.
