Employers' Statutory Vicarious Liability in Terms of the Protection of Personal Information Act
DOI:
https://doi.org/10.17159/1727-3781/2016/v19i0a555Keywords:
Vicarious liabiliy – Protection of Personal Information Act – defences – comparison with Employment Equity Act, United Kingdom’s Data Protection Act of 1998, the New Zealand’s Privacy Act 28 of 1993, and the Australian Privacy Act 119 of 1988Abstract
A person whose privacy has been infringed through the unlawful, culpable processing of his or her personal information can sue the infringer’s employer based on vicarious liability or institute action based on the Protection of Personal Information Act 4 of 2013 (POPI). Section 99(1) of POPI provides a person (“data subject”), whose privacy has been infringed, with the right to institute a civil action against the responsible party. POPI defines the responsible party as the person who determines the purpose of and means for processing of personal information of data subjects. Although POPI does not equate a responsible party to an employer, the term “responsible party” is undoubtedly a synonym for “employer” in this context. By holding an employer accountable for its employees’ unlawful processing of a data subject’s personal information, POPI creates a form of statutory vicarious liability.
Since the defences available to an employer at common law, and developed by case law, differs from the statutory defences available to an employer in terms of POPI, it is necessary to compare the impact this new statute has on employers. From a risk perspective, employers must be aware of the serious implications of POPI. The question that arises is whether the Act does not perhaps take matters too far.
This article takes a critical look at the statutory defences available to an employer in vindication of a vicarious liability action brought by a data subject in terms of section 99(1) of POPI. It compares the defences found in section 99(2) of POPI and the common-law defences available to an employer fending off a delictual claim founded on the doctrine of vicarious liability. To support the argument that the statutory vicarious liability created by POPI is is too harsh, the defences contained in section 99(2) of POPI is further analogised with those available to an employer in terms of section 60(4) of the Employment Equity Act 55 of 1998 (EEA) and other comparable foreign data protection statutes.
Downloads
References
Allen (ed) The Oxford Dictionary of English
Allen R E The oncise Oxford Dictionary 8th ed (BCA with Oxford University press 1990)
Calitz 2005 TSAR 215
Calitz K “Vicarious liability of employers: Reconsidering risk as the basis for liability” 2005 TSAR 215-235
Currie and De Waal Bill of Rights Handbook
Currie I and De Waal J Bill of Rights Handbook 6th ed (Juta Cape Town 2013)
De Stadler and Esselaar A guide to the Protection of Personal Information Act
De Stadler E and Esselaar P A guide to the Protection of Personal Information Act 1st ed (Juta Cape Town 2015)
Du Toit et al Labour Relations Law – A comprehensive guide
Du Toit D, Bosch D, Woolfrey D, Godfrey S, Cooper C, Giles G, Bosch C, Rossouw J Labour Relations Law – A comprehensive guide 5th ed (LexisNexis Durban 2006)
Grogan Workplace Law
Grogan J Workplace Law 11th ed (Juta Cape Town 2014)
Hawthorne 2008 SAPR/PL 23
Hawthorne L “The ‘new learning’ and transformation of contract law: reconciling the rule of law with the constitutional imperative to social transformation” 2008 SAPR/PL 23
Lawlor Vicarious and direct liability of an employer for sexual harassment at work
Lawlor R Vicarious and direct liability of an employer for sexual harassment at work (2007 LLM dissertation, Nelson Mandela Metropolitan University, SA).
Le Roux 2004 25 ILJ
Le Roux R “Sexual harassment in the workplace: Reflecting on Grobler v Naspers” 2004 25 ILJ 1897-1900
Le Roux 2003 24 ILJ
Le Roux R “Vicarious liability: Revisiting an old acquaintance” 2003 24 ILJ 1879-1882
Loots Stell LR 2008
Loots BE “Sexual Harassment and vicarious liability: A warning to political parties” Stell LR 2008 143-169.
Loubser et al Deliktereg in Suid-Afrika
Loubser M, Mukheiber A, Perumal D, Midgley R and Niesing L Deliktereg in Suid-Afrika 1st ed (Oxford University Press Southern Africa 2010)
Magolego 2014 De Rebus
Magolego N “Personal data on the internet – can POPI protect you?” December 2014 De Rebus 20-23
McQuoid-Mason 2000 Acta Juridica
McQuoid-Mason D “Invasion of privacy: Common law v constitutional delict – does it make a difference?” 2000 Acta Juridica 227- 261.
Millard and Botha 2012 De Jure
Millard D and Botha MM “The past, present and future of vicarious liability in South Africa” 2012 De Jure 225-253
Mischke and Beukes 2002 Contemporary Labour Law
Mischke C and Beukes V “Vicarious liability: When is the employer liable for the wrongful acts of employees?” 2002 Contemporary Labour Law 11.
Murray The extent of an employer’s vicarious liability when an employee acts within the scope of employment
Murray S The extent of an employer’s vicarious liability when an employee acts within the scope of employment (2012 LLB dissertation, North-West University, SA).
Neethling 2012 Journal of Contemporary Roman-Dutch Law
Neethling J “Features of the Protection of Personal Information Bill, 2009 and the law of delict” 2012 Journal of Contemporary Roman-Dutch Law 241-255
Neethling Law of Personality
Neethling J Law of Personality 5th ed (LexisNexis Durban 2005).
Neethling and Potgieter Neethling, Potgieter and Visser Law of Delict
Neethling J and Potgieter J Neethling, Potgieter and Visser Law of Delict 7th ed (Durban LexisNexis 2015).
Neethling 2005 SALJ
Neethling J “The concept of privacy in South African Law” 2005 SALJ 122.
Neethling 2011 TSAR
Neethling J “Vicarious liability of the state for rape by a police official” 2011 TSAR 186-191.
Simpson and Speake The Oxford Concise Dictionary of Proverbs
Simpson J and Speake J (eds) The Oxford Concise Dictionary of Proverbs 1st ed (Oxford University Press 2003).
Roos 2007 SALJ
Roos A “Data protection: Explaining the international backdrop and evaluating the current South African position” 2007 SALJ 400-433.
Roos 2008 PER
Roos A “Personal data protection in New Zealand: Lessons for South Africa?” 2008 PER 61-109.
Scott 2012 3 TSAR
Scott J “Staatsaanspreeklikheid vir opsetsdelikte van die polisie – die hoogste hof van appèl kry nogmaals bloedneus” 2012 3 TSAR 541-558.
Scott 2000 Acta Juridica
Scott J “Some reflections on vicarious liability and dishonest employees” 2000 Acta Juridica 265.
Scott TSAR 2015
Scott J “Die hoogste hof van appèl smoor heilsame regsontwikkeling – Minister of Safety and Security v F 2011 3 SA 487 (HHA)” 2011 TSAR 773-787.
Scott TSAR 2015
Scott J “Middellike staatsaanspreeklikheid – mistastings oor gevestigde regsbeginsels” 2015TSAR (3) 623-640.
Scott TSAR 2011
Scott J “Middellike aanspreeklikheid van die staat vir misdadige polisie-optrede: Die heilsame ontwikkeling duur voort” 2011 (1) TSAR 135.
Smit and Van der Nest 2004 TSAR
Smit N and Van der Nest D “When sisters are doing it for themselves: Sexual harassment claims in the workplace” 2004 TSAR 520-543.
Titelman Dictionary of America’s Popular Proverbs and Sayings
Titelman G Dictionary of America’s Popular Proverbs and Sayings 2nd ed (Random House 2000).
Van Niekerk et al Law@Work
Van Niekerk A, Smit N (eds), Christianson M, MacGregor M, Smith N and Van Eck S Law@Work 2nd ed (LexisNexis Durban 2015)
Whitcher 2004 25 ILJ
Whitcher B “Two roads to an employer’s vicarious liability for sexual harassment: S Grobler v Naspers Bpk en ‘n ander and Ntsabo v Real Security CC” 2004 25 ILJ 1907-1924.
Woolman and Bishop Constitutional Law of South Africa
Woolman S and Bishop M Constitutional Law of South Africa (Jutastat e-publications 2d ed 2014).
CASE LAW
South Africa
Absa Bank Ltd v Bond Equipment Pretoria (Pty) Ltd 2001 1 SA 372 (SCA).
Barkhuizen v Napier 2007 5 SA 323 (CC).
Bezuidenhout NO v Eskom [2003] 1 All SA 411 (SCA); 2003 3 SA 83 (SCA).
Carter & Co (Pty) Ltd v McDonald 1955 1 SA 202 (A).
Case v Minister of Safety and Security 1996 3 SA 617 (CC); 1996 5 BCLR 609 (CC).
Costa da Oura Restaurant (Pty) Ltd t/a Umdloti Bush Tavern v Reddy (2003) 24 ILJ 1337 (SCA)
Ess Kay Electronics (Pty) Ltd v First National Bank of Southern Africa Ltd [2001] 1 All SA 315 (A); 2001 1 SA 1214 (SCA).
F v Minister of Safety and Security 2012 1 SA 536 (CC).
Feldman (Pty) Ltd v Mall 1945 AD 733.
Gibbins v Williams, Muller, Wright & Mostert Ingelyf [1987] 1 All SA 417 (T); 1987 2 SA 82 (T).
K v Minister of Safety & Security [2005] 3 All SA 519 (SCA); 2005 3 SA 179 (SCA).
K v Minister of Safety & Security 2005 6 SA 419 (CC).
Masuku v Mdlalose [1997] 3 All SA 339 (A); 1998 1 SA 1 (SCA).
Minister of Finance v Gore [2007] 1 All SA 309 (SCA); 2007 1 SA 111 (SCA).
Minister of Finance v Gore 2007 1 SA 111 (HHA).
Minister of Law and Order v Ngobo [1992] 2 All SA 492 (A); 1992 4 SA 822 (A).
Minister of Police v Mbilini [1983] 2 All SA 282 (A); 1983 3 SA 705 (A).
Minister of Police v Rabie 1986 1 SA 117 (A).
Minister of Safety & Security v Jordaan t/a André Jordaan Transport 2000 4 SA 21 (SCA).
Minister van Veiligheid en Sekuriteit v Japmoco 2002 5 SA 649 (SCA).
National Media Ltd v Jooste 1996 3 SA 262 (A).
Ntsabo v Real Security CC (2003) 24 ILJ 2341 (LC).
O’Keeff v Argus Printing and Publishing Co Ltd 1954 3 SA 244 (C).
Piliso v Old Mutual Life Assurance Co (SA) Ltd & others (2007) 28 ILJ 897 (LC).
S Grobler v Naspers Bpk en ‘n ander (2004) 23 ILJ 439 (C); [2004] 2 All SA 160 (C).
SA Railways & Harbours v Marais 1950 4 SA 610 (A).
Smit v Workmen’s Compensation Commissioner 1979 1 SA 51 (A).
Viljoen v Smith 1997 1 SA 309 (SCA).
Universiteit van Pretoria v Tommie Meyer Films (Edms) Bpk 1977 4 SA 376 (T).
New Zealand Privacy Commissioner Case Notes
Case Note: 16005 [2001] NZPrivCmr 17 (1 July 2001).
Foreign case law
Google Spain SL, Google Inc v Agencia Espanola de Proteccion de Datos (AEP) Mario Costeja Gonzales (case no C-131/12, 13-5-2014).
LEGISLATION
South Africa
Basic Conditions of Employment Act 75 of 1997 (as amended).
Constitution of the Republic of South Africa, 1996.
Employment Equity Act 55 of 1998.
Occupational Health and Safety Act 85 of 1993 (as amended).
Protection of Personal Information Act 4 of 2013.
Commonwealth
Australian Privacy Act 119 of 1988 (as amended).
New Zealand’s Privacy Act 28 of 1993.
United Kingdom’s Data Protection Act 1998.
International Conventions
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
Published
Issue
Section
License
Copyright (c) 2016 Daleen Millard, Eugene Gustav Bascerano
This work is licensed under a Creative Commons Attribution 4.0 International License.
.png){kind=spacer}