The media, press, or journalists process large amounts of personal information when they gather, report on, and publish the news. They have a responsibility to protect it. For example, a journalist might know information relating to the education or the medical, financial, criminal or employment history of a person. They might also know the HIV status of a person. Often, this personal information is private and not publicly known. Sometimes personal information is used to get to the bottom of a story, only for the story itself to be published without the personal information.

South Africa has freedom of the press and other media.

What does the law require from the media?

Journalists need to have access to personal information to do their jobs. But what are their responsibilities when it comes to that personal information? The main responsibility is to ensure that the personal information does not fall into the wrong hands and is not used to cause harm to the data subject. The Press Code published by the Press Council is very important in this regard. Many publications (like the Business Day and the Daily Maverick) subscribe to it. It requires their journalists to strive to avoid unnecessary harm at all times.

With the emergence of the Protection of Personal Information Act (the POPI Act), however, a new twist was added to the tale. The focus shifted to whether journalists must comply with both POPIA or just the Press Code. In fact, the discussion did not end there. Another question that lawyers and journalists alike began asking was: If both apply, what happens if there is a conflict between them?

The journalistic exclusions in the POPI Act

POPIA enables (rather than prevents) the press or media from processing personal information for journalistic purposes.

A person can lawfully process personal information for journalistic purposes without complying with POPIA if it is in the public interest or they are subject to a code of ethics (like the Press Code). POPIA does not apply when someone processes personal information solely for the purpose of journalistic, literary or artistic expression (section 7(1)). But this is not an automatic blanket exclusion – there are limits on it. If you intend to rely on this exclusion, you must be careful. You need to balance the right to privacy and the right to freedom of expression (as set out in section 16 of the Constitution). The public interest is important. It means that the information must be of legitimate interest or importance to citizens.

There is also another exclusion (section 7(2)). POPIA does not apply when someone processes personal information:

  1. for exclusively journalistic purposes, and
  2. is bound by a code of ethics that adequately protects personal information.

In this case, the code of ethics applies to the exclusion of POPIA, and POPIA is not relevant.

Questions that arise?

  1. What is the difference between the two exclusions?
  2. Is there a difference between the “purpose of journalistic expression” and “journalistic purposes”?
  3. Is the Press Code a code of ethics that adequately protects personal information? Is it a code of conduct as envisaged by POPIA?
  4. What does the Press Code require a media house to do to protect personal information?
  5. When does a media house process for a purpose other than journalism? For example, employing their employees, marketing their publications and sending newsletters.
  6. What does POPIA require a media house to do to protect personal information when its activity is for a purpose other than journalism?
  7. Who is someone? Does it include citizen bloggers or non-media organisations?

How we can help?

  • Find answers to these questions by asking Michalsons to give you their opinion or interpretation.
  • Define your understanding of public interest with the protection of personal information in mind by asking Michalsons to workshop it with you.
  • Comply with privacy and data protection laws by joining a programme.
  • Train journalists and other writers on what the law, codes, and policies require them to do by asking Michalsons to run private workshops for you.
  • Have up-to-date policies by asking Michalsons to review or draft them for you.
  • Map your activities so you know whether POPIA or the Press Code applies by asking Michalsons to do it for you?
  • Ensure the Press Code adequately protects personal information by asking Michalsons to review it.