The rise of social media and related platforms means that parents are able to make information about their children available worldwide, to anyone, instantly, in a practice that has come to be known as “sharenting”.

This raises two concerns. First, children, like all of us, have a constitutionally guaranteed right to privacy. Second, the Protection of Personal Information Act 4 of 2013 (POPI) has been enacted to protect our personal information, and how our personal information is used by others.

An illustrative example:

Adult A is a well-known blogger who earns substantial revenues from advertising on her blog, which relates to her life as a working mother. Many of her posts are of her three children. She also has an open Instagram account, with thousands of followers, which she uses to promote her blog.

What POPI says:

POPI provides that you may not process personal information of another person without their consent, or in the case of children, without the consent of a parent (for present purposes we use the term parent to include legal guardians). A child is defined as a person under 18.

Crucially, the act of processing personal information as defined in POPI is wide enough to cover the instance where a parent posts photographs of their child on social media. Fortunately, however, POPI does not apply to the processing of personal information that happens purely in the course of household activity. This means that you can carry on updating your phone book with all the numbers and addresses of your friends, without worrying about being POPI compliant.

Unfortunately, however, POPI does not define household activity, which raises the question: Will the household exception apply to parents who post photographs of their children online? More specifically, will POPI not apply to Adult A in the above scenario?

The household exception

The General Data Protection Regulation (the GDPR), which regulates data protection in European countries, views personal or household activities as having no connection to professional or commercial activity. Let’s assume, until POPI comes into force and our courts rule otherwise, that the household exception in POPI similarly applies to activities that do not have a connection to professional or commercial activity. European decisions also indicate that one should have regard to whether or not a social media network is accessible beyond self-selected contacts, or whether it is limited to a finite number of people.

Returning to our illustrative example, since Adult A earns substantial advertising revenue from her blog and since her Instagram account is unrestricted, there is a case to be made that the household exception will not apply to Adult A, and that she will be required to be POPI compliant.

What does POPI compliance mean for parents?

First, being POPI compliant will require Parent A to get parental consent to post pictures of her children on her blog, which is not a problem. She can, on behalf of her children, give herself the necessary consent.

Second, she would be required to process personal information in a manner that does not unreasonably infringe on the privacy of her children, and in a manner which is not excessive. At what point the photographs of Adult A’s two-year-old eating ice-cream become excessive is open for debate.

Third, Adult A will have to comply with a number of provisions relating to the storage and disposal of personal information and will be required to remove personal information about her children from her blog once the information is no longer relevant. This raises the question of whether any of it was ever relevant.

Clearly Adult A means well and loves her children. So what is the worst that could happen?

Her eldest child, who recently moved as far away from home as possible and started his first job, may institute a civil action for damages in a court having jurisdiction against his mother for breach of a provision of POPI. Or her teenage son, angry at being grounded for bunking school, could lodge a complaint with the Regulator against Adult A.

But let us not assume the worst.

Adult A does everything in her power to be POPI compliant and her children happily enjoy the benefits of being minor internet celebrities. But is this good enough? I argue that the law should do more to protect the children of parents who, unlike Adult A, are less reasonable and whose children prefer not to grow up in public.

The Digital Age of Majority

One way of achieving this would be to lower the age at which children are no longer regarded as minors, for purposes of POPI. A child is defined in POPI as being a person under the age of 18, which is higher than in European jurisdictions. In terms of French data protection legislation, for example, the digital age of majority has been set at 15. Where a child in France is under the age of 15, joint consent of both the child and an authorised person (such as a parent) is required for the processing of personal data of the child.

While at first glance the higher age threshold in terms of POPI might offer children greater protection, this is arguably not the case. Whereas in France a parent of a child over 15 can no longer legally post pictures of their children on social media without their child’s consent, South African children can fall victim to “sharenting” until the age of 18.

The Constitutional Court has recognised that children merit special protection through legislation to guard and enforce their rights and liberties. The approach has been to start from the premise that children enjoy each of the fundamental rights in the Constitution that are granted to everyone. So why is it then that Adult A would need the permission of her husband and her friends to use their photographs on her blog, yet she does not need the consent of her son, who is 17 years and 11 months old?

Perhaps South African children should be able to make up their own minds about their social media presence before they turn 18. While the rights of children to privacy have to be weighed against their parents’ right to freedom of expression, the scales should perhaps tip in favour of children at some stage before they turn 18.

Conclusion

It will be interesting to see how our courts balance a child’s right to privacy specifically against their parent’s right to freedom of expression, if the matter ever comes before court. For now, it may be best to err on the side of caution and to think twice before posting pictures of children on social media, and if you do, make sure that your social media account is set to private. DM

This article is adapted from one originally published in 2019 in the Journal for Contemporary Roman Dutch Law: ‘The Protection Of Personal Information Act: The Parental Consent Requirement And The Failure Of The Act To Protect The Rights Of Children To Privacy’.

Paula Gabriel is a practising advocate specialising in commercial litigation, with a particular interest in data protection regulation and social media law. She is a member of the Cape Bar where she holds chambers and spends hours researching the foreseen and unforeseen consequences of the law.