Employers' Statutory Vicarious Liability in Terms of the Protection of Personal Information Act

Authors

  • Daleen Millard Professor of Private law, University of Johannesburg https://orcid.org/0000-0002-4668-9320
  • Eugene Gustav Bascerano Legal Advisor, Office of the General Council, University of Johannesburg.

DOI:

https://doi.org/10.17159/1727-3781/2016/v19i0a555

Keywords:

Vicarious liabiliy – Protection of Personal Information Act – defences – comparison with Employment Equity Act, United Kingdom’s Data Protection Act of 1998, the New Zealand’s Privacy Act 28 of 1993, and the Australian Privacy Act 119 of 1988

Abstract

A person whose privacy has been infringed through the unlawful, culpable processing of his or her personal information can sue the infringer’s employer based on vicarious liability or institute action based on the Protection of Personal Information Act 4 of 2013 (POPI). Section 99(1) of POPI provides a person (“data subject”), whose privacy has been infringed, with the right to institute a civil action against the responsible party. POPI defines the responsible party as the person who determines the purpose of and means for processing of personal information of data subjects. Although POPI does not equate a responsible party to an employer, the term “responsible party” is undoubtedly a synonym for “employer” in this context. By holding an employer accountable for its employees’ unlawful processing of a data subject’s personal information, POPI creates a form of statutory vicarious liability.

Since the defences available to an employer at common law, and developed by case law, differs from the statutory defences available to an employer in terms of POPI, it is necessary to compare the impact this new statute has on employers. From a risk perspective, employers must be aware of the serious implications of POPI. The question that arises is whether the Act does not perhaps take matters too far.

This article takes a critical look at the statutory defences available to an employer in vindication of a vicarious liability action brought by a data subject in terms of section 99(1) of POPI. It compares the defences found in section 99(2) of POPI and the common-law defences available to an employer fending off a delictual claim founded on the doctrine of vicarious liability. To support the argument that the statutory vicarious liability created by POPI is is too harsh, the defences contained in section 99(2) of POPI is further analogised with those available to an employer in terms of section 60(4) of the Employment Equity Act 55 of 1998 (EEA) and other comparable foreign data protection statutes. 

 

Google_Scholar_12024.png   ScienceOpen_Log034316.png

Downloads

Download data is not yet available.

Metrics

Metrics Loading ...

Author Biographies

Daleen Millard, Professor of Private law, University of Johannesburg

Department of Private law, professor of Private law

Eugene Gustav Bascerano, Legal Advisor, Office of the General Council, University of Johannesburg.

Legal advisor, UJ

References

Allen (ed) The Oxford Dictionary of English

Allen R E The oncise Oxford Dictionary 8th ed (BCA with Oxford University press 1990)

Calitz 2005 TSAR 215

Calitz K “Vicarious liability of employers: Reconsidering risk as the basis for liability” 2005 TSAR 215-235

Currie and De Waal Bill of Rights Handbook

Currie I and De Waal J Bill of Rights Handbook 6th ed (Juta Cape Town 2013)

De Stadler and Esselaar A guide to the Protection of Personal Information Act

De Stadler E and Esselaar P A guide to the Protection of Personal Information Act 1st ed (Juta Cape Town 2015)

Du Toit et al Labour Relations Law – A comprehensive guide

Du Toit D, Bosch D, Woolfrey D, Godfrey S, Cooper C, Giles G, Bosch C, Rossouw J Labour Relations Law – A comprehensive guide 5th ed (LexisNexis Durban 2006)

Grogan Workplace Law

Grogan J Workplace Law 11th ed (Juta Cape Town 2014)

Hawthorne 2008 SAPR/PL 23

Hawthorne L “The ‘new learning’ and transformation of contract law: reconciling the rule of law with the constitutional imperative to social transformation” 2008 SAPR/PL 23

Lawlor Vicarious and direct liability of an employer for sexual harassment at work

Lawlor R Vicarious and direct liability of an employer for sexual harassment at work (2007 LLM dissertation, Nelson Mandela Metropolitan University, SA).

Le Roux 2004 25 ILJ

Le Roux R “Sexual harassment in the workplace: Reflecting on Grobler v Naspers” 2004 25 ILJ 1897-1900

Le Roux 2003 24 ILJ

Le Roux R “Vicarious liability: Revisiting an old acquaintance” 2003 24 ILJ 1879-1882

Loots Stell LR 2008

Loots BE “Sexual Harassment and vicarious liability: A warning to political parties” Stell LR 2008 143-169.

Loubser et al Deliktereg in Suid-Afrika

Loubser M, Mukheiber A, Perumal D, Midgley R and Niesing L Deliktereg in Suid-Afrika 1st ed (Oxford University Press Southern Africa 2010)

Magolego 2014 De Rebus

Magolego N “Personal data on the internet – can POPI protect you?” December 2014 De Rebus 20-23

McQuoid-Mason 2000 Acta Juridica

McQuoid-Mason D “Invasion of privacy: Common law v constitutional delict – does it make a difference?” 2000 Acta Juridica 227- 261.

Millard and Botha 2012 De Jure

Millard D and Botha MM “The past, present and future of vicarious liability in South Africa” 2012 De Jure 225-253

Mischke and Beukes 2002 Contemporary Labour Law

Mischke C and Beukes V “Vicarious liability: When is the employer liable for the wrongful acts of employees?” 2002 Contemporary Labour Law 11.

Murray The extent of an employer’s vicarious liability when an employee acts within the scope of employment

Murray S The extent of an employer’s vicarious liability when an employee acts within the scope of employment (2012 LLB dissertation, North-West University, SA).

Neethling 2012 Journal of Contemporary Roman-Dutch Law

Neethling J “Features of the Protection of Personal Information Bill, 2009 and the law of delict” 2012 Journal of Contemporary Roman-Dutch Law 241-255

Neethling Law of Personality

Neethling J Law of Personality 5th ed (LexisNexis Durban 2005).

Neethling and Potgieter Neethling, Potgieter and Visser Law of Delict

Neethling J and Potgieter J Neethling, Potgieter and Visser Law of Delict 7th ed (Durban LexisNexis 2015).

Neethling 2005 SALJ

Neethling J “The concept of privacy in South African Law” 2005 SALJ 122.

Neethling 2011 TSAR

Neethling J “Vicarious liability of the state for rape by a police official” 2011 TSAR 186-191.

Simpson and Speake The Oxford Concise Dictionary of Proverbs

Simpson J and Speake J (eds) The Oxford Concise Dictionary of Proverbs 1st ed (Oxford University Press 2003).

Roos 2007 SALJ

Roos A “Data protection: Explaining the international backdrop and evaluating the current South African position” 2007 SALJ 400-433.

Roos 2008 PER

Roos A “Personal data protection in New Zealand: Lessons for South Africa?” 2008 PER 61-109.

Scott 2012 3 TSAR

Scott J “Staatsaanspreeklikheid vir opsetsdelikte van die polisie – die hoogste hof van appèl kry nogmaals bloedneus” 2012 3 TSAR 541-558.

Scott 2000 Acta Juridica

Scott J “Some reflections on vicarious liability and dishonest employees” 2000 Acta Juridica 265.

Scott TSAR 2015

Scott J “Die hoogste hof van appèl smoor heilsame regsontwikkeling – Minister of Safety and Security v F 2011 3 SA 487 (HHA)” 2011 TSAR 773-787.

Scott TSAR 2015

Scott J “Middellike staatsaanspreeklikheid – mistastings oor gevestigde regsbeginsels” 2015TSAR (3) 623-640.

Scott TSAR 2011

Scott J “Middellike aanspreeklikheid van die staat vir misdadige polisie-optrede: Die heilsame ontwikkeling duur voort” 2011 (1) TSAR 135.

Smit and Van der Nest 2004 TSAR

Smit N and Van der Nest D “When sisters are doing it for themselves: Sexual harassment claims in the workplace” 2004 TSAR 520-543.

Titelman Dictionary of America’s Popular Proverbs and Sayings

Titelman G Dictionary of America’s Popular Proverbs and Sayings 2nd ed (Random House 2000).

Van Niekerk et al Law@Work

Van Niekerk A, Smit N (eds), Christianson M, MacGregor M, Smith N and Van Eck S Law@Work 2nd ed (LexisNexis Durban 2015)

Whitcher 2004 25 ILJ

Whitcher B “Two roads to an employer’s vicarious liability for sexual harassment: S Grobler v Naspers Bpk en ‘n ander and Ntsabo v Real Security CC” 2004 25 ILJ 1907-1924.

Woolman and Bishop Constitutional Law of South Africa

Woolman S and Bishop M Constitutional Law of South Africa (Jutastat e-publications 2d ed 2014).

CASE LAW

South Africa

Absa Bank Ltd v Bond Equipment Pretoria (Pty) Ltd 2001 1 SA 372 (SCA).

Barkhuizen v Napier 2007 5 SA 323 (CC).

Bezuidenhout NO v Eskom [2003] 1 All SA 411 (SCA); 2003 3 SA 83 (SCA).

Carter & Co (Pty) Ltd v McDonald 1955 1 SA 202 (A).

Case v Minister of Safety and Security 1996 3 SA 617 (CC); 1996 5 BCLR 609 (CC).

Costa da Oura Restaurant (Pty) Ltd t/a Umdloti Bush Tavern v Reddy (2003) 24 ILJ 1337 (SCA)

Ess Kay Electronics (Pty) Ltd v First National Bank of Southern Africa Ltd [2001] 1 All SA 315 (A); 2001 1 SA 1214 (SCA).

F v Minister of Safety and Security 2012 1 SA 536 (CC).

Feldman (Pty) Ltd v Mall 1945 AD 733.

Gibbins v Williams, Muller, Wright & Mostert Ingelyf [1987] 1 All SA 417 (T); 1987 2 SA 82 (T).

K v Minister of Safety & Security [2005] 3 All SA 519 (SCA); 2005 3 SA 179 (SCA).

K v Minister of Safety & Security 2005 6 SA 419 (CC).

Masuku v Mdlalose [1997] 3 All SA 339 (A); 1998 1 SA 1 (SCA).

Minister of Finance v Gore [2007] 1 All SA 309 (SCA); 2007 1 SA 111 (SCA).

Minister of Finance v Gore 2007 1 SA 111 (HHA).

Minister of Law and Order v Ngobo [1992] 2 All SA 492 (A); 1992 4 SA 822 (A).

Minister of Police v Mbilini [1983] 2 All SA 282 (A); 1983 3 SA 705 (A).

Minister of Police v Rabie 1986 1 SA 117 (A).

Minister of Safety & Security v Jordaan t/a André Jordaan Transport 2000 4 SA 21 (SCA).

Minister van Veiligheid en Sekuriteit v Japmoco 2002 5 SA 649 (SCA).

National Media Ltd v Jooste 1996 3 SA 262 (A).

Ntsabo v Real Security CC (2003) 24 ILJ 2341 (LC).

O’Keeff v Argus Printing and Publishing Co Ltd 1954 3 SA 244 (C).

Piliso v Old Mutual Life Assurance Co (SA) Ltd & others (2007) 28 ILJ 897 (LC).

S Grobler v Naspers Bpk en ‘n ander (2004) 23 ILJ 439 (C); [2004] 2 All SA 160 (C).

SA Railways & Harbours v Marais 1950 4 SA 610 (A).

Smit v Workmen’s Compensation Commissioner 1979 1 SA 51 (A).

Viljoen v Smith 1997 1 SA 309 (SCA).

Universiteit van Pretoria v Tommie Meyer Films (Edms) Bpk 1977 4 SA 376 (T).

New Zealand Privacy Commissioner Case Notes

Case Note: 16005 [2001] NZPrivCmr 17 (1 July 2001).

Foreign case law

Google Spain SL, Google Inc v Agencia Espanola de Proteccion de Datos (AEP) Mario Costeja Gonzales (case no C-131/12, 13-5-2014).

LEGISLATION

South Africa

Basic Conditions of Employment Act 75 of 1997 (as amended).

Constitution of the Republic of South Africa, 1996.

Employment Equity Act 55 of 1998.

Occupational Health and Safety Act 85 of 1993 (as amended).

Protection of Personal Information Act 4 of 2013.

Commonwealth

Australian Privacy Act 119 of 1988 (as amended).

New Zealand’s Privacy Act 28 of 1993.

United Kingdom’s Data Protection Act 1998.

International Conventions

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

Published

17-05-2017

How to Cite

Millard, D., & Bascerano, E. G. (2017). Employers’ Statutory Vicarious Liability in Terms of the Protection of Personal Information Act. Potchefstroom Electronic Law Journal, 19, 1–38. https://doi.org/10.17159/1727-3781/2016/v19i0a555

Issue

Section

Articles