Pseudonymisation is not anonymisation — but context matters

Traditionally, regulators have taken an absolute approach: if data can be re-identified by anyone, somewhere, then it remains personal data everywhere. From the perspective,  pseudonymised data is always personal data, because a key exists that could, in theory, restore identity.

That assumption has been seriously challenged by the Single Resolution Board v European Data Protection Supervisor (SRB v EDPS) litigation. In that case, the EU banking resolution authority shared pseudonymised submissions with Deloitte for valuation analysis. Deloitte received only coded data and had no legal or practical access to the re-identification key.

The General Court held that the regulator erred by failing to assess identifiability from the recipient’s perspective. The Court emphasised that the correct test is context-specific: whether the recipient has reasonably likely, lawful means to re-identify the data subjects. In Deloitte’s hands, the data was therefore not personal data at all.

While the matter was successfully appealed, the core principle survived: pseudonymised data is not automatically personal data in every context. Identifiability must be assessed relatively, not abstractly, and regulators must conduct a risk-based analysis, not rely on labels alone  .

The South African echo: substance over assumption

A strikingly similar theme emerges from the recent South African High Court judgment involving the Department of Basic Education and the Information Regulator. In that case, the Information Regulator issued an enforcement notice on the assumption that the publication of matric results using examination numbers necessarily involved the processing of personal information.

The Court was critical of this categorical reasoning. It emphasised that whether information is “personal information” under POPIA depends on identifiability in fact, not on abstract possibility or regulatory assertion. Where learners could not reasonably be identified from the published information, the regulator could not simply presume a POPIA breach. The judgment underscores that regulators must analyse how identification actually occurs, rather than treating all coded or indirect references as inherently personal.

Although the case did not turn expressly on pseudonymisation doctrine, its reasoning aligns closely with SRB v EDPS: identifiability is contextual, evidentiary, and practical, not hypothetical.

The combined effect of these developments is significant:

• Pseudonymisation can, in the right context, break the link to personal information — particularly for downstream recipients who lack access to re-identification keys.
• Regulators must perform a risk-based, context-specific assessment of identifiability, rather than assuming that any theoretical re-identification keeps data within scope.
• Responsible parties must distinguish between data in their own hands and data in the hands of recipients, especially auditors, researchers, and analysts.

This does not mean that pseudonymised data is “safe” in all circumstances. Poorly designed pseudonymisation, unlawful access to keys, or realistic re-identification techniques may still render data personal, but it does mean that the nature of personal information is no longer fixed at the moment of collection; it can change depending on who holds the data and what they can realistically do with it.

A quieter shift with big consequences

Both SRB v EDPS and the South African judgment signal a judicial move away from formalist assumptions toward functional analysis. For organisations, this creates space for more nuanced data-sharing models. For regulators, it raises the bar: assertion is no substitute for analysis.

That said, the news media does not have a stellar record in correctly interpreting the decisions of South African courts and so it seemed wise to give the Supreme Court of Appeal the benefit of the doubt and actually read its decision and the reasons behind its decision, rather than rely on the interpretation of the decision by commentators. The remainder of this article will attempt to contextualise the judgment and provide some commentary on the decision.

Before even considering this case, it is useful to consider the case of Hotz v University of Cape Town. Note that the Constitutional Court declined to hear the merits of the matter as it considered the Supreme Court of Appeal’s decision to be “unassailable” and so the Supreme Court of Appeal’s decision (as confirmed by the Constitutional Court) is the judgment being considered. While there were several issues in this matter, the relevant issue was the wearing of a T-Shirt with the slogan “KILL ALL WHITES”. While there had been an attempt to place a small “s” before the word “KILL” to modify the word to “sKILL”, the Supreme Court of Appeal found that this to be hate speech and prohibited. It is worth quoting the relevant passage of the Supreme Court of Appeal judgment:

“Whether it in fact bore a tiny letter ‘s’ before the word ‘KILL’ is neither here nor there. The vast majority of people who saw it would not have ventured closer to ascertain whether, imperceptibly to normal eyesight, the message was something other than it appeared to be. They would have taken it at face value as a message being conveyed by the wearer that all white people should be killed. There was no context that would have served to ameliorate that message. It was advocacy of hatred based on race alone and it constituted incitement to harm whites. It was not speech protected by s 16(1) of the Constitution.”

At a fundamental level this judgment should provide some comfort to commentators in the present matter as it demonstrates that the highest South African court does not apply hate speech in a unidirectional manner. Put differently, it is possible for black South Africans to be racist and to be guilty of hate speech.

What was particularly interesting about this judgment was that it asserted that there was “no context that that would have served to ameliorate that message”. This sentence can be construed in two ways, either:

• There could never be any context which would make the statement “kill all whites” acceptable, or
• In this particular matter there was no context that was supplied to the court that would allow the statement “kill all whites” to be acceptable.

It would seem clear that the court intended to mean the second interpretation. This conclusion is borne out by the example of this article. In this article, the phrase “kill all whites” has been repeated several times. If no consideration of the context of this article is considered, then on the face of it the author should be found guilty of hate speech. However, when the context is applied – that this article is a commentary on statements made by other people and on legal decisions and conclusions reached – then it is clear that the author of this article is not, in context, advocating for the killing of white people. The point that is being made here is that while it is tempting to extirpate the context from the speech, to do so would inevitably result in manifest injustice. Put simply, not only does context matter, but context must be considered.

This brings us back to the case of AfriForum v Economic Freedom Fighters and Others. There should be little doubt that if a person were to stand up in public and state “kill the boers” that this action would be legally indistinguishable from wearing a T-shirt which stated, “kill all whites”. How then, did the Supreme Court of Appeal come to the conclusion that this was acceptable? In the Supreme Court of Appeal’s view the answer is all about context.

While the judgment of that court goes into several issues, at its core it centres around a central conclusion which is that a “reasonably well-informed person would appreciate that Mr Malema was not actually calling for farmers or white South Africans of Afrikaans descent to be shot”. Put differently, the context of the statement resulted in a conclusion that the plain language of the words should not be relied upon, and that the song was in fact a political statement to advance the EFF’s political agenda and could not be interpreted literally.

It is worth unpacking this concept a little. Firstly, it is interesting that the Supreme Court of Appeal considered it necessary for the conclusion to be reached by a “reasonably well-informed person”. What about persons who are not well-informed, such as those individuals who were born after the fall of apartheid and did not have the context of the “struggle”? Would they also be expected to understand that the words were not meant to be taken literally? How about a foreigner watching a video presentation of Julius Malema chanting this in the oval office? On the other hand, if speech must be restricted so as to be clear to all audiences of every level of education and intelligence – including those who would be clinically diagnosed as having a severe intellectual disability – then it would undoubtedly result in the chilling of freedom of expression. This is an important concept as society functions better when it can voice its disagreements rather than forcing members of society to bottle up their opinions and nurture their resentments. The point here is that a balance needs to be struck, and the Supreme Court of Appeal seems to believe that the majority of people would understand that the song does not advocate for the literal killing of Afrikaans farmers.

Secondly, the contextual factors that influenced the court’s decision were:

• It was a song/chant
• Chanted at political events
• Often accompanied by a physical action of shooting a gun
• Chants such as these were used to voice opinions on political events
• Which have a long history in African political forums
• And typically voice a form of protest and a quest for change

The point here is that the court found that the context of the chant changed the nature of the words from their literal meaning to a figurative meaning of wanting political change.

A third point relates to the nature of the evidence placed before the court. Since this entire court case turned on the question of “context” and how a reasonably well-informed person could interpret the words, it is unfortunate that Afriforum did not see this as an opportunity to challenge exactly that contention by conducting a survey of the EFF rallies in order to determine what the attendees understood by these statements. Instead of obtaining evidence from an “reasonable well-informed” EFF supporter who attended the rallies as to what the context of the words meant, five elite judges at the Supreme Court of Appeal were left to determine (and by “determine” I mean “guess”) how a reasonably well-informed person would interpret the chant. For example, if a survey of 1000 EFF supporters had concluded that 900 believed that the song meant that they should literally kill Afrikaans farmers, that evidence would surely have been a devastating blow to the EFF’s case. The only way to challenge this evidence would be to challenge the methodology of the survey by alleging bias such as:

• The sample group was too small
• The questions were leading / not objective
• The selection of the sample was not random
• The sample group misunderstood the questions

And so forth.

Certainly, one of the main pillars of the Afriforum case – that the chant was connected to attacks on farmers (note that a connection to violence is not a legal requirement for hate speech to exist) – would have been significantly bolstered had the results of such a survey been available to the court. Instead of this, the court was only provided with the expert testimony of Professor Gunner who testified that the ordinary EFF supporter would not interpret the song as meaning that all Afrikaans farmers should be killed but rather view it as a political statement or comment and this testimony was accepted by the Supreme Court of Appeal.

Unsurprisingly, there have been several commentators who are particularly unhappy with the decision by the Supreme Court of Appeal to dismiss the matter, as there is no doubt that that decision does violence to the ordinary meaning of language.

A last point that needs to be made is the frankly jaw-dropping decision of the Constitutional Court not to hear the matter. Admittedly there have been a large number of cases on free speech in our recent past, such as the Qwelane case, but the fact that the lower courts came to different conclusions in the same matter would suggest that the matter was sufficiently unclear to require some direction from South Africa’s highest court. Certainly, it was not clear to a large number of South Africans that the matter “did not bear any reasonable prospect of success” and while this refusal by the Constitutional Court to hear to the matter finalises the case from a legal perspective, it clearly continues to fester in the form of public opinion.

At a fundamental level it is incredibly difficult to reconcile the Hotz judgment with the Afriforum judgment, particularly as they emanate from the same court. While we certainly need to remain cautious about restraining free speech in South Africa, there should also be considerable reluctance on the part of our courts to assume that a statement which was clearly made seriously in a massive political rally should not be taken at face value, particularly when it could be interpreted that way by a large number of people. The fact that one needs to be “reasonably well informed” before the non-violent interpretation of “kill the boer” is understood is hugely problematic, particularly as the message is so widely distributed. If 10% of South Africa’s population were to interpret the words literally and so – by the Supreme Court of Appeal’s reasoning, are not “reasonably well informed”, and potentially act upon the statement – then it would seem that this is a reasonable cost for free speech according to our highest courts.

Ultimately it is difficult to avoid the conclusion that both the Supreme Court of Appeal and the Constitutional Court have done a huge disservice to South Africa, essentially encouraging the use of violent language in political events. The South African Constitution enjoins us to “heal the divisions of the past and establish a society based on democratic values, social justice and fundamental human rights”. Can the highest courts honestly claim that they have furthered this aspiration?

As part of REWS efforts to combat this challenge, a group came together and, over several months, developed a lexicon to help health researchers to communicate effectively with each other, particularly in the area of data visiting and federated data learning. The culmination of this work is a journal paper which was published by Human Genomics, is freely available and can be found here.

This paper defines and explains the following terms:

• Data sharing
• Data visiting
• Federated data analysis
• Remote data interrogation
• Cross-border data transfer
• Data localisation

Hopefully this paper and the standardisation of these terms will be a step in the right direction to assist researchers with their challenges to use genomic data for the benefit of humanity.

Please feel free to contact us should have any comments.

Earlier this year she contacted a photographer and asked the photographer to take some photographs of her, her husband and their two small children. They agreed by means of Whatsapp on a price and a place and time and the photoshoot duly took place. On leaving the photoshoot she mentioned that mentioned that she did not want photographs of her children to be put on social media and the photographer looked surprised by this request but made no reply.

The photographs were duly sent to our client and she paid the fee to the photographer and thought no more of the matter.

However, some weeks later she happened to look at the social media page of the photographer and found out that the photographer had – contrary to her express wishes – posted the photographs of her and her family on the photographer’s social media page. She was incensed and contacted the photographer who told her: “I took the photographs and so I own the copyright and I can do what I want with the photographs.”

As a result of this she contacted us in order to find out if there were any remedies in law to force the photographer to remove the photographs from the social media page?

Somewhat to her surprise there were actually four different angles from which our client could approach the problem and they were:

• Copyright
• Data Protection
• Take-down notice
• Social Media complaint

Each of these will be dealt with below.

Copyright

In general, the person who took the photograph (the photographer) is considered to be the “author” of the photograph in terms of s1 of the Copyright Act no. 98 of 1978 and as such is also the first “owner” of the photograph. Even though ownership of the photographs can be transferred (for example by means of a written contract) the photographer will remain the “author” of the photograph. However, there is an exception to this rule which can be found in clause 21(1)(c) which reads:

“Where a person commissions the taking of a photograph… and pays or agrees to pay for it in money or money’s worth, and the work is made in pursuance of that commission, such person shall …. be the owner of any copyright subsisting therein by virtue of section 3 or 4.”

From this section you can see that the owner of the copyright in this case is in actual fact not the photographer, but rather our client.

However the issue of copyright does not end there. Section 27 of the Copyright Act makes it a criminal offence to “by way of trade exhibits to the public”, or “distributes for the purposes of trade” or “distributes for any other purpose to such an extent that the owner of the copyright is prejudicially affected” the photographs without the authority of the owner of the copyright. Bearing in mind that the photographer is posting the photograph on their social media page which is – presumably – used to attract new customers there is a good argument that not only a civil claim (infringement of copyright) has occurred, but also a criminal offence has occurred which can be reported to the police station.

Data Protection

Approaching the problem from an entirely different angle, most South Africans know that there is an Act called the Protection of Personal Information Act no.4 of 2013 (POPIA) which aims to protect the personal information of data subjects. While photographs of the family are obviously personal information as the photographs can be associated with a particular person, a more interesting question is whether the photographs can be considered to be “special” personal information and also whether they could be considered to be “special personal information about children”. Section 26 of POPIA lists the categories of “special personal information” as including “biometric information” and “biometrics” in turn is defined as “a technique of personal identification that is based on physical, physiological or behavioural characterisation including blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition”. Bearing in mind that most of our mobile phones now have facial recognition and that the act of recognising a face is used as a security measure to prevent unauthorised access to our mobile phones, there is a good argument that a reasonable quality photograph could be considered to be “biometric information”.

The complications do not end there as the photographs of the children and so subject to section 34 which provides that “a responsible party may, subject to section 35, not process personal information concerning a child”. Section 35 thereafter sets out various situations where personal information of a child may be processed – such as where the parent or “competent person” – consented to such processing.

Bearing the above in mind and bearing in mind that the photographer was doing this for the purpose of their business (rather than for personal or household use) there is an excellent chance that a complaint to the Information Regulator over the publication of the photographs of the children would be upheld, even if the photographer was the owner of the copyright.

The final point relating to data protection is that a breach of POPIA can also give rise to a civil claim by our client against the photographer.

Take-Down Notice

In addition to the above, there is a very effective mechanism to remove content from a local website which is called a “take-down notice” and this right was created by section 77 of the Electronic Transaction and Communications Act no. 25 of 2002. This mechanism is facilitated by the Internet Service Providers Association of South Africa (ISPA) and action is normally taken within days, making it the fastest mechanism to obtain relief in South Africa. All that needs to occur is for the complainant to set out what right has been infringed (in the above case the complainant would probably allege the infringement of both copyright as well as data protection rights) and this take-down notice is then communicated not only the photographer but also to the internet service provider that hosts the content.

However, take-down notices have one large problem and it is that they only work against South African Internet Service Providers. If the social media page is hosted overseas then ISPA will refuse to deal with the matter as they have no jurisdiction, and this leads us neatly into the final forum to consider.

Complaint mechanism of the social media provider

Almost all social media platforms have a set of terms and conditions where they set out how a complainant can bring a dispute relating to content on their platform, even if the complainant, the alleged infringer and the social media company are all located in different countries. While each social media platform will deal with complaints based on their own terms and conditions, this can the easiest (and most cost effective) manner in which to deal with the dispute.

Conclusion

From the above it is clear that our client had many more avenues for redress than she expected and certainly was well advised to contact us first, particularly as she had accepted the photographer’s assertion that she owned the copyright, when this allegation was not accurate. Unsurprisingly there are further complications when it comes to the drafting of:

• a civil claim for copyright infringement,
• a criminal complaint for copyright infringement,
• a complaint to the Information Regulator,
• a civil claim for damages based on a breach of POPIA,
• a Take-Down Notice, or
• a complaint to the social media company.

and it is probably wise to contact an attorney to assist with this. Should you have any questions please contact us at paul@ea.law.za .

https://www.linkedin.com/posts/privacy-hub-africa_healthcaredataprivacy-africahealthcare-webinaralert-activity-7199738207888965632-b4uT/?utm_source=share&utm_medium=member_ios

20230626_PAIA_Manual_Esselaar Attorneys_PGE

Paul was admitted as an attorney of the High Court in 2001 whereafter he returned to the University of Cape Town and completed his LLM in Electronic Law and Commercial Law in 2003. Paul’s broad background in Electronic Law is ably assisted by a stint at an Online Dispute Resolution company called TrustEnforce as well as his experience as the webmaster for the Trade Law Centre (tralac) and as an Electronic Law specialist for the Electronic Law Consultancy.

Paul was employed as the Electronic Law Manager for Korbitec (Pty) Ltd – a software company that specialises in producing software for the legal market – from 2005 to 2007. He was responsible for the documentation relating to debt collection and various other aspects of practice management such as FICA compliance within existing software products. He also advised Korbitec and attorneys on the impact of the National Credit Act and attended law commission and parliamentary hearings on this and several other laws.

Paul joined Dingley Attorneys (now Dingley Marshal Lewin) in 2008 until early 2011 when he set up his own law firm, Esselaar Attorneys. Paul is a Wireless Application Service Providers Association (WASPA) appeal adjudicator, an Internet Services Providers Association (ISPA) appeal adjudicator, has been admitted as a Notary of the High Court and he also has the right of appearance in the High Court.

In 2013 Paul and Elizabeth de Stadler set up a legal compliance company called Novation Consulting (Pty) Ltd which provides specialist consumer law advice to companies. Along with Elizabeth he has produced an online training course for companies to comply with the requirements of the Protection of Personal Information Act (POPIA) and co-authored ‘Understanding the Protection of Personal Information Act’ which was published by Juta in 2015 and its successor ‘Overthinking the Protection of Personal Information Act’ published in 2021. Paul has been part of the POPIA project team to implement changes to several blue chip companies and has presented on POPIA to various audiences for several years. In 2020 he attended the eCommerce summit in Dakar, Senegal for the African Union and was a co-author of ‘A Situational Analysis Of Digital Trade And Digital Economy In Africa’ which analysed consumer-related laws for the African Union. More recently he co-authored the Model Law on Health Data Governance which was commissioned by Transform Health.

In his effort to retain an eclectic and wide-ranging knowledge of law, Paul has also been part of:

• several high-value commercial transactions in the Eastern Cape relating to property development, investor funding and shareholder relations,
• urgent insolvency proceedings for foreign shareholders in the Gauteng High Court
• removal of children from the parental home due to neglect
• extended and highly emotional parental plan negotiations for the care of minor children

He currently practices as an attorney and notary at Esselaar Attorneys in Cape Town and is an Honorary Research Fellow at the University of KwaZulu Natal (UKZN).

Esselaar Attorneys
Proprietor and Information Officer: P Esselaar
Address: Spaces, Dock Road Junction, V & A Waterfront, Cape Town, 8001
Tel: +27 (0)21 403 6584

Esselaar Attorneys
Proprietor: P Esselaar
Address: Spaces, Dock Road Junction, V & A Waterfront, Cape Town, 8001
Tel: +27 (0)21 403 6584