There are consequences for careless use of personal information: The Information Regulator, the independent body tasked with protecting how our personal data is treated, has taken TransUnion to task, by issuing an enforcement notice against the credit reporting agency for failing to secure personal information leaked during 2022’s data breach. It has also initiated its own probe into the Companies and Intellectual Property Commission (CIPC) after its systems were compromised.

An enforcement notice has the same weight as a court order;  failure to comply with it is an offence, which can carry a penalty of imprisonment or a fine of up to R10 million in the case of POPIA offences.

In the TransUnion matter, the bureau has been given until 28 May to prove to the regulator that it has complied with the enforcement notice’s remedial measures.

It also provided an update on investigations it has conducted into violations of the Promotion of Access to Information Act (Paia) and Protection of Personal Information Act (Popia) over the past year — which include two probes linked to former president Jacob Zuma: one relating to a request for access to Zuma’s tax records, another linking the Sekunjalo and Independent Media owner, Iqbal Survé, and his backers in China to the State Security Agency (SSA) and sunshine reportage about the then president.

The complaint against the SSA relates to a failure to respond to a Promotion of Access to Information request for access to the agency’s expenditure information from the 2015/2016 to 2018/2019 financial years, for services rendered to the agency by the African News Agency (ANA) — which Survé’s Independent Media established after the demise of the South African Press Association. The partially Chinese state-funded service was launched in 2015 by Sekunjalo Investments and Survé.

The plan for ANA was to syndicate stories across the continent, with puffed-up ambitions to open offices in major centres in Africa. 

ANA was allegedly paid R20-million by the SSA to publish articles favourable to Zuma.

The regulator said its investigation into this matter had been completed and was under consideration by members.

Candidate lists

The report on the recent leaking of candidate lists at the Electoral Commission (IEC), in breach of Popia, was at an advanced stage.

The regulator has closed matters relating to Dis-Chem, which also suffered a security breach in 2023, because the retail pharmacy group had satisfied the regulator’s compliance requirements.

It has also closed matters relating to a complaint about the SA Police Service (SAPS), for releasing information about the victims of sexual assault in Krugersdorp. The regulator issued an enforcement notice against the SAPS last year for the distribution of the victims’ personal information and ordered the police to investigate how this information had been made public.

Earlier this month, the regulator received two notifications from the IEC about a security breach in which the candidate lists for the ANC and the uMkhonto Wesizwe (MK) party were compromised. 

It has called out political parties for a general failure to comply with Paia, including not updating their manuals and not keeping a list of donors. This report is expected to be finalised before the 29 May general elections.

Of the 13 political parties represented in Parliament, 54% were generally found to be non-compliant with Paia, while 46% had some level of compliance but needed to improve in certain areas.

As such, none of the political parties represented in Parliament is compliant with Paia.

A new Paia request for access to the tax records of former president Jacob Zuma has also been filed, after the Constitutional Court previously referred the matter back to the SARS commissioner for reconsideration. 

SARS refuses to reveal Zuma’s tax records, despite the court’s ruling that a blanket ruling is unconstitutional. The requesting party has now resubmitted the complaint to the regulator, which it accepted.

AmaBhungane and the Financial Mail submitted the original Paia request to SARS in February 2019. DM