SAHRC sounds alarm over misuse of personal information in digital age

The South African Human Rights Commission (SAHRC) has warned that data breaches and the misuse of personal information should not be viewed merely as cybersecurity problems, saying they can have serious consequences for people’s privacy, dignity, equality and security.

The warning came during a webinar hosted by the commission on Tuesday, titled “The True Meaning of Privacy as a Right: A Discussion on the Rights, Duties and Responsibilities of Data Subjects”.

The discussion brought together SAHRC commissioner Nomahlubi Kunana, information regulator commissioner Lebogang Stroom and Dr Ivy Kinyoko from the Centre for Human Rights at the University of Pretoria, who leads work on information rights, freedom of expression, access to information and digital rights.

Kunana said privacy was a constitutional right under section 14 and had practical consequences for individuals and society.

She said vulnerable groups, including children, older people and people with disabilities, could face greater risks when their personal information was exposed.

Data breaches and cybercrime can have a greater impact on vulnerable communities because they may have fewer resources, limited digital literacy and weaker access to remedies, Kunana said.

Children, in particular, may not understand the permanence of information shared online. Kunana said breaches involving schools, social media platforms, health-care services or government databases could expose names, addresses, photographs, school information, health records, biometric information and family details.

Such exposure could also leave children vulnerable to cyberbullying, grooming, sexual exploitation, identity theft, extortion and manipulation.

Older people were often targeted through financial cybercrime, identity theft and scams, while people with disabilities could be disproportionately affected because many rely on digital platforms and assistive technologies to access education, employment, health care, banking and government services.

Kunana said the consequences could extend beyond financial losses.

For people relying on social grants, mobile money, banking services or digital government platforms, losing even a relatively small amount of money could affect their ability to buy food, access health care or meet educational and transport needs.

She also highlighted risks facing women, migrants, refugees and undocumented people, saying the exposure of personal information could increase the risk of discrimination, exploitation, intimidation and violence.

“Cybercrime should therefore not be viewed only as technology or cybersecurity problem,” she said, explaining that breaches could affect a range of constitutional rights, including privacy, dignity, equality, access to health care and education, social security and access to justice.

Stroom said privacy extended beyond simply preventing information from being made public.

She explained that personal information included names, photographs, contact details, location information, online identifiers and messages, and that privacy applied throughout the information lifecycle, from collection and storage to use, sharing and eventual deletion.

People whose personal information had been compromised could exercise several rights, including requesting access to, correction or deletion of their information, objecting to certain processing and lodging complaints with the information regulator.

Stroom said the regulator receives complaints involving the processing of personal information without consent, direct marketing, data breaches and requests for the deletion or correction of information.

However, she said the regulator currently does not have the capability to test external systems before they are launched to determine whether they comply with privacy requirements.

Instead, compliance assessments can be conducted on request or on the regulator’s own initiative, including checking whether organisations have appropriate technical and organisational safeguards in place.

The regulator is also looking at changes to the Protection of Personal Information Act (Popia) to address emerging technologies.

Stroom said work was under way with the justice department to amend Popia to include artificial intelligence and align the law with the digital era, including the concept of “privacy by design” to help prevent harmful systems from affecting children and other users.

Kinyoko placed the discussion within a broader human rights framework, warning that weak privacy protections could have implications for democracy itself.

She said people who were uncertain about whether their communications were protected could begin censoring themselves, potentially limiting conversations that were necessary in a democratic society.

The webinar also highlighted the responsibility of individuals and organisations when collecting, storing and sharing personal information.

The speakers stressed that privacy did not mean people or organisations could never access information about others. Instead, the central question was whether information was being collected and used lawfully, fairly, proportionately and for a justifiable purpose.

The SAHRC said the discussion would contribute to a public advisory, “Think Before You Post: Respecting Privacy, Dignity and Personal Information Online”, aimed at encouraging responsible digital behaviour and reducing harm caused by the misuse of personal information.

TimesLIVE