‘I have discouraged my children from conducting business with government or with any state-owned entity. I have told them that if I become aware of any illegality of corruption in their business activities, I will be the first to report them to the authorities.’

– President Ramaphosa in Parliament in November 2018, answering a question from the Leader of the Opposition.

The High Court recently granted President Cyril Ramaphosa an interim interdict to stay the public protector’s proposed remedial action stemming from her investigation into a donation to his presidential campaign by Gavin Watson of Bosasa.

The evidence relied on by the public protector in her investigation of the President will remain sealed for the moment meaning public access is prohibited.

Certain prominent persons were among the donors who contributed an extraordinary, but disputed, amount of “billions of rand” towards his “CR17 campaign” ahead of the ANC’s national elective conference held in 2017.

From her investigations into allegations of an improper relationship between the President and Bosasa, now African Global Operations, the public protector said she found evidence that indicated that some of the money collected through the CR17 campaign was paid to the Cyril Ramaphosa Foundation and other beneficiaries. The public protector detailed how the donation by Watson made its way into the CR17 trust account, noting that it went through a number of intermediaries before landing in the President’s campaign fund.

The remaining documents which the public protector relied on in compiling her report and deciding on remedial action will now be scrutinised by the President’s legal team. They have until August 26 to raise objections to other documents being made part of the public record. The President is seeking a judicial review of the public protector’s report which he has described as “fundamentally and irretrievably flawed”.

The report and records were handed to the Court in terms of Rule 53 of the Uniform Court Rules which stipulates processes to be followed in judicial review cases.

Certain bank statements in the public protector’s report contained confidential information belonging to third parties. She cited leaked emails containing details on the President’s campaign for leadership, which have since been widely circulated in social and other media, as the source of her information. The leaked emails purport to show that the President consulted with his campaign managers about which backers to approach for funding and how much was donated to his campaign, despite his claims, on oath, to the contrary.

The burning question is whether divulging of information by the public protector in the present case would be regarded as protected information, the public disclosure of which is prohibited.

The public protector has the most general mandate of all Chapter 9 Institutions. Her work includes policing the requirements of the Executive Members’ Ethics Act, the Executive Ethics Code of Conduct (the Code) and she must operate in terms of the Public Protector Act.

The public protector’s reports are open to the public unless exceptional circumstances require that they be kept confidential and be dealt with as confidential documents in terms of the rules of Parliament.

“Exceptional circumstances” would exist if the publication of the report concerned is likely to endanger the security of the state or the citizens of the Republic.

The code requires that financial interests be recorded in a register that contains a confidential part and a public part. Certain financial interests must be recorded in the confidential part of the register. No person who has access to entries to the confidential part of the register may disclose particulars of any entry in that part, except when a court or the public protector so orders.

The code also requires the declaration of the source and description of direct financial sponsorship or assistance from non-party sources and the value of same.

Treasury regulations require members of the Cabinet to disclose financial interests when assuming office, acquired after their assumption of office including gifts and other benefits of a material nature. It can be argued that donations to a party-political leadership contest are not personal but part of the normal functions of a party. This would mean that private donations don’t fall under the public protector’s statutory remit of dealing with matters of “public affairs” and “public money”.

The President maintains that he was kept at arms-length from fundraising in the campaign. The public protector says all good and well, but he had a duty to disclose who the donors were to the campaign. The duty to disclose does not necessarily mean that the information must reach the public domain.

In her report, she found that pledges towards the CR17 campaign were a form of sponsorship and therefore benefits of a material nature received by the President which benefited him in his personal capacity.

The fact that private donations are not regulated remains a lacuna in the Political Party Funding Act. There is nothing in the law as it stands that requires political parties to disclose how much money was generated from private donors in their own internal party contests.

The President is the first citizen of the country. He is the head of the Executive and the head of our armed forces. All executive actions are taken in his name and all treaties and international agreements are carried out in his name and all diplomatic relations are maintained in his name.

As first citizen, he embodies a civil and representative role while he enacts his executive duties in an official capacity. Despite his high standing, the President is afforded the right to privacy in the same manner as an ordinary citizen.

The claim to privacy is based on the content of the information that the President is forced to disclose, not on his desire not to disclose it, which desire is irrelevant. It is noted with concern that highly sensitive and personal information about the President has or is at the risk of compromise and as such, there is a compelling privacy interest in safeguarding his and other parties’ information from falling into the public domain.

The protection of privacy raises in every individual the pressing expectation that their rights will not be violated and the person’s right to privacy, guaranteed to all in the Bill of Rights, is not compromised.

It seems the President can show that he enjoys protection under data privacy laws in his personal capacity. It appears that he may also be able to demonstrate that his (as well as involved collateral parties’) right to privacy has been violated by the very office of an official that is supposed to be upholding the law.

The publication of the President’s personal information would constitute a wrongful publication and a breach of his right to privacy.

When handling personal information, the public protector is required to keep the information received during her investigation confidential as outlined in Section 7 of the Public Protector Act. In this way, the privacy of the subjects of her investigation will remain protected. Non-disclosure agreements should routinely be required by the public protector to be signed prior to limited release of information that may require confidential treatment.

The Protection of Personal Information Act (Popia) involves three parties (whether natural or juristic persons) –

• The Data Subject: the person to whom the information relates. In casu, the President;
• The Responsible (Accountable) Party: the person who determines to process, ie corporates, governments, state agencies. Called controllers in other jurisdictions. In casu, the banks; and
• The Operator: a person who processes personal information on behalf of the responsible party. For example, a technology company. Called processors in other jurisdictions. In casu, service providers/the banks.

The gist of the matter is that the President is not excluded from protection under South Africa’s data protection law. In terms of Popia, personal information is defined to include information relating to an identifiable, living, natural person and where applicable, a juristic person.

The dissemination of the financial information of the President and private donors to the public falls within the definition of “processing” in terms of the Popia.

Accordingly, any sharing of information by the public protector would be regulated by Popia, and the party receiving the information must comply with the safeguards built into Popia. This is to ensure that no third-party data subject’s rights are infringed.

The recipient of such personal information would similarly be required to show that it complies with the provisions of Popia. On the other hand, if information is on the public record, it will not be wrong to obtain or process it.

Any leak of personal information must be reported to the Information Regulator and the data subject in a way that allows the data subject to protect him/herself against possible negative consequences. Once Popia is fully effective, requests of requestors for access to their personal information will be made in terms of Popia, and the Information Regulator is empowered to take certain actions which may ultimately result in a fine, imprisonment and/or civil liability for the breaching party.

It is important to note the difference between leaking and whistleblowing because the leaker is an anonymous source who discloses sensitive information without approval.

Whistle-blowers on the other hand release information that shows wrongdoing designed to withdraw authority from both the source and the information. The motivation for disclosures made by a whistle-blower must in all instances be the fact their disclosures were made to serve the public interest rather than fuel political gossip.

Although whistle-blowers are legally protected when they speak out in the public interest, whistle-blower confidentiality does not generally override the data subject’s right to privacy.

It is an offence to knowingly transmit false information. Someone who deliberately or recklessly discloses false information does not qualify as a whistle-blower (except under section 5 of the Public Disclosures Act in its present form) and might also be guilty of defamation, crimen injuria or fraud.

To make frivolous or vexatious claims is an abuse of the rights granted by the law for purposes others than those that it seeks to achieve.

Turning to the President’s case then, there is the element of knowledge that someone already holds the records. This could potentially be envisioned as an abuse of the law and potentially at the risk of losing any statutory protection if they commit an offence when making the disclosure.

There is no doubt that the President can effectively rely on the protection from disclosure afforded by data privacy laws inter alia:

The right to erase

Individuals are entitled to request that their personal information be erased. These include the grounds that the usage of the personal data is no longer relevant for the purpose for which it was initially collected or processed.

The right to object

Individuals have the right to object to the processing of their personal information if such information has been processed with the consent of the individual and they wish to withdraw such consent.

The right to access

Individuals have the right to be informed whenever an organisation processes their information, to receive a copy of such information, to be informed of the sources of this information.

In terms of the Promotion of Access to Information Act (Paia), a request for access to personal information can be refused on one of the grounds set out in the Act. These include the protection of third-party confidential information. Interesting to note is that Paia does not apply to an individual member of Parliament or of a provincial legislature in that capacity. The President is not a member of Parliament – he is a member of the Cabinet.

Data protection provides for the legal protection of a person in instances where personal information is collected, stored, used or processed.

The information protection principles intended to regulate privacy in South Africa are encapsulated in Popia as conditions for the lawful processing of personal information. The EU General Data Protection Regulation sets an added yardstick by which to measure their own privacy laws and African organisations an international standard to adopt, and thereby maintain the trust of the international community.

Privacy is further protected in terms of both our common law and the Constitution. The recognition and protection of the right to privacy as a fundamental human right in the Constitution provides an indication of its importance.

Due to the public role of members of the Executive, the provisions of their Code of Conduct override laws of more general application. A clash is looming regarding the nature of campaign payments, the duty to declare receipt of sponsorships and donations as well as the obligation to protect such information from public disclosure. DM

Reneé Caprari is an advocate. This article was drafted at the request of Accountability Now.