Pseudonymisation is not anonymisation — but context matters

Traditionally, regulators have taken an absolute approach: if data can be re-identified by anyone, somewhere, then it remains personal data everywhere. From the perspective,  pseudonymised data is always personal data, because a key exists that could, in theory, restore identity.

That assumption has been seriously challenged by the Single Resolution Board v European Data Protection Supervisor (SRB v EDPS) litigation. In that case, the EU banking resolution authority shared pseudonymised submissions with Deloitte for valuation analysis. Deloitte received only coded data and had no legal or practical access to the re-identification key.

The General Court held that the regulator erred by failing to assess identifiability from the recipient’s perspective. The Court emphasised that the correct test is context-specific: whether the recipient has reasonably likely, lawful means to re-identify the data subjects. In Deloitte’s hands, the data was therefore not personal data at all.

While the matter was successfully appealed, the core principle survived: pseudonymised data is not automatically personal data in every context. Identifiability must be assessed relatively, not abstractly, and regulators must conduct a risk-based analysis, not rely on labels alone  .

The South African echo: substance over assumption

A strikingly similar theme emerges from the recent South African High Court judgment involving the Department of Basic Education and the Information Regulator. In that case, the Information Regulator issued an enforcement notice on the assumption that the publication of matric results using examination numbers necessarily involved the processing of personal information.

The Court was critical of this categorical reasoning. It emphasised that whether information is “personal information” under POPIA depends on identifiability in fact, not on abstract possibility or regulatory assertion. Where learners could not reasonably be identified from the published information, the regulator could not simply presume a POPIA breach. The judgment underscores that regulators must analyse how identification actually occurs, rather than treating all coded or indirect references as inherently personal.

Although the case did not turn expressly on pseudonymisation doctrine, its reasoning aligns closely with SRB v EDPS: identifiability is contextual, evidentiary, and practical, not hypothetical.

The combined effect of these developments is significant:

• Pseudonymisation can, in the right context, break the link to personal information — particularly for downstream recipients who lack access to re-identification keys.
• Regulators must perform a risk-based, context-specific assessment of identifiability, rather than assuming that any theoretical re-identification keeps data within scope.
• Responsible parties must distinguish between data in their own hands and data in the hands of recipients, especially auditors, researchers, and analysts.

This does not mean that pseudonymised data is “safe” in all circumstances. Poorly designed pseudonymisation, unlawful access to keys, or realistic re-identification techniques may still render data personal, but it does mean that the nature of personal information is no longer fixed at the moment of collection; it can change depending on who holds the data and what they can realistically do with it.

A quieter shift with big consequences

Both SRB v EDPS and the South African judgment signal a judicial move away from formalist assumptions toward functional analysis. For organisations, this creates space for more nuanced data-sharing models. For regulators, it raises the bar: assertion is no substitute for analysis.

That said, the news media does not have a stellar record in correctly interpreting the decisions of South African courts and so it seemed wise to give the Supreme Court of Appeal the benefit of the doubt and actually read its decision and the reasons behind its decision, rather than rely on the interpretation of the decision by commentators. The remainder of this article will attempt to contextualise the judgment and provide some commentary on the decision.

Before even considering this case, it is useful to consider the case of Hotz v University of Cape Town. Note that the Constitutional Court declined to hear the merits of the matter as it considered the Supreme Court of Appeal’s decision to be “unassailable” and so the Supreme Court of Appeal’s decision (as confirmed by the Constitutional Court) is the judgment being considered. While there were several issues in this matter, the relevant issue was the wearing of a T-Shirt with the slogan “KILL ALL WHITES”. While there had been an attempt to place a small “s” before the word “KILL” to modify the word to “sKILL”, the Supreme Court of Appeal found that this to be hate speech and prohibited. It is worth quoting the relevant passage of the Supreme Court of Appeal judgment:

“Whether it in fact bore a tiny letter ‘s’ before the word ‘KILL’ is neither here nor there. The vast majority of people who saw it would not have ventured closer to ascertain whether, imperceptibly to normal eyesight, the message was something other than it appeared to be. They would have taken it at face value as a message being conveyed by the wearer that all white people should be killed. There was no context that would have served to ameliorate that message. It was advocacy of hatred based on race alone and it constituted incitement to harm whites. It was not speech protected by s 16(1) of the Constitution.”

At a fundamental level this judgment should provide some comfort to commentators in the present matter as it demonstrates that the highest South African court does not apply hate speech in a unidirectional manner. Put differently, it is possible for black South Africans to be racist and to be guilty of hate speech.

What was particularly interesting about this judgment was that it asserted that there was “no context that that would have served to ameliorate that message”. This sentence can be construed in two ways, either:

• There could never be any context which would make the statement “kill all whites” acceptable, or
• In this particular matter there was no context that was supplied to the court that would allow the statement “kill all whites” to be acceptable.

It would seem clear that the court intended to mean the second interpretation. This conclusion is borne out by the example of this article. In this article, the phrase “kill all whites” has been repeated several times. If no consideration of the context of this article is considered, then on the face of it the author should be found guilty of hate speech. However, when the context is applied – that this article is a commentary on statements made by other people and on legal decisions and conclusions reached – then it is clear that the author of this article is not, in context, advocating for the killing of white people. The point that is being made here is that while it is tempting to extirpate the context from the speech, to do so would inevitably result in manifest injustice. Put simply, not only does context matter, but context must be considered.

This brings us back to the case of AfriForum v Economic Freedom Fighters and Others. There should be little doubt that if a person were to stand up in public and state “kill the boers” that this action would be legally indistinguishable from wearing a T-shirt which stated, “kill all whites”. How then, did the Supreme Court of Appeal come to the conclusion that this was acceptable? In the Supreme Court of Appeal’s view the answer is all about context.

While the judgment of that court goes into several issues, at its core it centres around a central conclusion which is that a “reasonably well-informed person would appreciate that Mr Malema was not actually calling for farmers or white South Africans of Afrikaans descent to be shot”. Put differently, the context of the statement resulted in a conclusion that the plain language of the words should not be relied upon, and that the song was in fact a political statement to advance the EFF’s political agenda and could not be interpreted literally.

It is worth unpacking this concept a little. Firstly, it is interesting that the Supreme Court of Appeal considered it necessary for the conclusion to be reached by a “reasonably well-informed person”. What about persons who are not well-informed, such as those individuals who were born after the fall of apartheid and did not have the context of the “struggle”? Would they also be expected to understand that the words were not meant to be taken literally? How about a foreigner watching a video presentation of Julius Malema chanting this in the oval office? On the other hand, if speech must be restricted so as to be clear to all audiences of every level of education and intelligence – including those who would be clinically diagnosed as having a severe intellectual disability – then it would undoubtedly result in the chilling of freedom of expression. This is an important concept as society functions better when it can voice its disagreements rather than forcing members of society to bottle up their opinions and nurture their resentments. The point here is that a balance needs to be struck, and the Supreme Court of Appeal seems to believe that the majority of people would understand that the song does not advocate for the literal killing of Afrikaans farmers.

Secondly, the contextual factors that influenced the court’s decision were:

• It was a song/chant
• Chanted at political events
• Often accompanied by a physical action of shooting a gun
• Chants such as these were used to voice opinions on political events
• Which have a long history in African political forums
• And typically voice a form of protest and a quest for change

The point here is that the court found that the context of the chant changed the nature of the words from their literal meaning to a figurative meaning of wanting political change.

A third point relates to the nature of the evidence placed before the court. Since this entire court case turned on the question of “context” and how a reasonably well-informed person could interpret the words, it is unfortunate that Afriforum did not see this as an opportunity to challenge exactly that contention by conducting a survey of the EFF rallies in order to determine what the attendees understood by these statements. Instead of obtaining evidence from an “reasonable well-informed” EFF supporter who attended the rallies as to what the context of the words meant, five elite judges at the Supreme Court of Appeal were left to determine (and by “determine” I mean “guess”) how a reasonably well-informed person would interpret the chant. For example, if a survey of 1000 EFF supporters had concluded that 900 believed that the song meant that they should literally kill Afrikaans farmers, that evidence would surely have been a devastating blow to the EFF’s case. The only way to challenge this evidence would be to challenge the methodology of the survey by alleging bias such as:

• The sample group was too small
• The questions were leading / not objective
• The selection of the sample was not random
• The sample group misunderstood the questions

And so forth.

Certainly, one of the main pillars of the Afriforum case – that the chant was connected to attacks on farmers (note that a connection to violence is not a legal requirement for hate speech to exist) – would have been significantly bolstered had the results of such a survey been available to the court. Instead of this, the court was only provided with the expert testimony of Professor Gunner who testified that the ordinary EFF supporter would not interpret the song as meaning that all Afrikaans farmers should be killed but rather view it as a political statement or comment and this testimony was accepted by the Supreme Court of Appeal.

Unsurprisingly, there have been several commentators who are particularly unhappy with the decision by the Supreme Court of Appeal to dismiss the matter, as there is no doubt that that decision does violence to the ordinary meaning of language.

A last point that needs to be made is the frankly jaw-dropping decision of the Constitutional Court not to hear the matter. Admittedly there have been a large number of cases on free speech in our recent past, such as the Qwelane case, but the fact that the lower courts came to different conclusions in the same matter would suggest that the matter was sufficiently unclear to require some direction from South Africa’s highest court. Certainly, it was not clear to a large number of South Africans that the matter “did not bear any reasonable prospect of success” and while this refusal by the Constitutional Court to hear to the matter finalises the case from a legal perspective, it clearly continues to fester in the form of public opinion.

At a fundamental level it is incredibly difficult to reconcile the Hotz judgment with the Afriforum judgment, particularly as they emanate from the same court. While we certainly need to remain cautious about restraining free speech in South Africa, there should also be considerable reluctance on the part of our courts to assume that a statement which was clearly made seriously in a massive political rally should not be taken at face value, particularly when it could be interpreted that way by a large number of people. The fact that one needs to be “reasonably well informed” before the non-violent interpretation of “kill the boer” is understood is hugely problematic, particularly as the message is so widely distributed. If 10% of South Africa’s population were to interpret the words literally and so – by the Supreme Court of Appeal’s reasoning, are not “reasonably well informed”, and potentially act upon the statement – then it would seem that this is a reasonable cost for free speech according to our highest courts.

Ultimately it is difficult to avoid the conclusion that both the Supreme Court of Appeal and the Constitutional Court have done a huge disservice to South Africa, essentially encouraging the use of violent language in political events. The South African Constitution enjoins us to “heal the divisions of the past and establish a society based on democratic values, social justice and fundamental human rights”. Can the highest courts honestly claim that they have furthered this aspiration?

As part of REWS efforts to combat this challenge, a group came together and, over several months, developed a lexicon to help health researchers to communicate effectively with each other, particularly in the area of data visiting and federated data learning. The culmination of this work is a journal paper which was published by Human Genomics, is freely available and can be found here.

This paper defines and explains the following terms:

• Data sharing
• Data visiting
• Federated data analysis
• Remote data interrogation
• Cross-border data transfer
• Data localisation

Hopefully this paper and the standardisation of these terms will be a step in the right direction to assist researchers with their challenges to use genomic data for the benefit of humanity.

Please feel free to contact us should have any comments.

Earlier this year she contacted a photographer and asked the photographer to take some photographs of her, her husband and their two small children. They agreed by means of Whatsapp on a price and a place and time and the photoshoot duly took place. On leaving the photoshoot she mentioned that mentioned that she did not want photographs of her children to be put on social media and the photographer looked surprised by this request but made no reply.

The photographs were duly sent to our client and she paid the fee to the photographer and thought no more of the matter.

However, some weeks later she happened to look at the social media page of the photographer and found out that the photographer had – contrary to her express wishes – posted the photographs of her and her family on the photographer’s social media page. She was incensed and contacted the photographer who told her: “I took the photographs and so I own the copyright and I can do what I want with the photographs.”

As a result of this she contacted us in order to find out if there were any remedies in law to force the photographer to remove the photographs from the social media page?

Somewhat to her surprise there were actually four different angles from which our client could approach the problem and they were:

• Copyright
• Data Protection
• Take-down notice
• Social Media complaint

Each of these will be dealt with below.

Copyright

In general, the person who took the photograph (the photographer) is considered to be the “author” of the photograph in terms of s1 of the Copyright Act no. 98 of 1978 and as such is also the first “owner” of the photograph. Even though ownership of the photographs can be transferred (for example by means of a written contract) the photographer will remain the “author” of the photograph. However, there is an exception to this rule which can be found in clause 21(1)(c) which reads:

“Where a person commissions the taking of a photograph… and pays or agrees to pay for it in money or money’s worth, and the work is made in pursuance of that commission, such person shall …. be the owner of any copyright subsisting therein by virtue of section 3 or 4.”

From this section you can see that the owner of the copyright in this case is in actual fact not the photographer, but rather our client.

However the issue of copyright does not end there. Section 27 of the Copyright Act makes it a criminal offence to “by way of trade exhibits to the public”, or “distributes for the purposes of trade” or “distributes for any other purpose to such an extent that the owner of the copyright is prejudicially affected” the photographs without the authority of the owner of the copyright. Bearing in mind that the photographer is posting the photograph on their social media page which is – presumably – used to attract new customers there is a good argument that not only a civil claim (infringement of copyright) has occurred, but also a criminal offence has occurred which can be reported to the police station.

Data Protection

Approaching the problem from an entirely different angle, most South Africans know that there is an Act called the Protection of Personal Information Act no.4 of 2013 (POPIA) which aims to protect the personal information of data subjects. While photographs of the family are obviously personal information as the photographs can be associated with a particular person, a more interesting question is whether the photographs can be considered to be “special” personal information and also whether they could be considered to be “special personal information about children”. Section 26 of POPIA lists the categories of “special personal information” as including “biometric information” and “biometrics” in turn is defined as “a technique of personal identification that is based on physical, physiological or behavioural characterisation including blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition”. Bearing in mind that most of our mobile phones now have facial recognition and that the act of recognising a face is used as a security measure to prevent unauthorised access to our mobile phones, there is a good argument that a reasonable quality photograph could be considered to be “biometric information”.

The complications do not end there as the photographs of the children and so subject to section 34 which provides that “a responsible party may, subject to section 35, not process personal information concerning a child”. Section 35 thereafter sets out various situations where personal information of a child may be processed – such as where the parent or “competent person” – consented to such processing.

Bearing the above in mind and bearing in mind that the photographer was doing this for the purpose of their business (rather than for personal or household use) there is an excellent chance that a complaint to the Information Regulator over the publication of the photographs of the children would be upheld, even if the photographer was the owner of the copyright.

The final point relating to data protection is that a breach of POPIA can also give rise to a civil claim by our client against the photographer.

Take-Down Notice

In addition to the above, there is a very effective mechanism to remove content from a local website which is called a “take-down notice” and this right was created by section 77 of the Electronic Transaction and Communications Act no. 25 of 2002. This mechanism is facilitated by the Internet Service Providers Association of South Africa (ISPA) and action is normally taken within days, making it the fastest mechanism to obtain relief in South Africa. All that needs to occur is for the complainant to set out what right has been infringed (in the above case the complainant would probably allege the infringement of both copyright as well as data protection rights) and this take-down notice is then communicated not only the photographer but also to the internet service provider that hosts the content.

However, take-down notices have one large problem and it is that they only work against South African Internet Service Providers. If the social media page is hosted overseas then ISPA will refuse to deal with the matter as they have no jurisdiction, and this leads us neatly into the final forum to consider.

Complaint mechanism of the social media provider

Almost all social media platforms have a set of terms and conditions where they set out how a complainant can bring a dispute relating to content on their platform, even if the complainant, the alleged infringer and the social media company are all located in different countries. While each social media platform will deal with complaints based on their own terms and conditions, this can the easiest (and most cost effective) manner in which to deal with the dispute.

Conclusion

From the above it is clear that our client had many more avenues for redress than she expected and certainly was well advised to contact us first, particularly as she had accepted the photographer’s assertion that she owned the copyright, when this allegation was not accurate. Unsurprisingly there are further complications when it comes to the drafting of:

• a civil claim for copyright infringement,
• a criminal complaint for copyright infringement,
• a complaint to the Information Regulator,
• a civil claim for damages based on a breach of POPIA,
• a Take-Down Notice, or
• a complaint to the social media company.

and it is probably wise to contact an attorney to assist with this. Should you have any questions please contact us at paul@ea.law.za .

In short, ‘the Bill, which was released for public comment in March, addresses urgent issues in eleven financial sector laws, including legislative gaps that were highlighted after the 2008 financial crisis and to align these laws with the new Companies Act, 2008, and other legislation.’

The Consumer Protection Act is one of the other pieces of legislation referred to here. Warren Radloff wrote an article (Treating Customers Fairly or CPA?) when we were making submissions to Treasury earlier this year on the gaps which would be left if the Bill was enacted as it was. To take the wordplay further, gaps through which consumers would fall. In short, the Bill excludes Banks and Insurers from the scope of the CPA without suggesting an existing alternative with the same wide protections. We don’t suggest that it is a bad idea that the Banks and Insurers should have their own consumer protection regime. Far from it. But consumer should not be left out in the cold in the process.

I have not had a chance to look at the new version of the Bill and Treasury’s response to the submissions made. I will do so in time for the October edition of Consumer Law Review.

Against this background we have the introduction of Regulation 6 of the Protection of Personal Information Act, which in turn requires companies to follow the format of form 4 when asking for direct marketing consent. Form 4 requires that the following text be used when asking for direct marketing consent:

I, (full names of data subject) hereby: 

¤ Give my consent. 

To receive direct marketing of goods or services to be marketed by means of electronic communication.

You can hardly imagine a less enticing way to ask for direct marketing consent. Direct marketers may still be willing to ask for consent from the consumer, but not with that wording. And before you think this is a small matter, just consider that the change in wording can be the difference between 50 000 consumers agreeing to receive direct marketing messages and 100 000 consumers agreeing to direct marketing (i.e. this is a BIG DEAL). 

But all is not lost as Regulation 6 as read with the definition of ‘form’ allows a direct marketer to request for direct marketing consent in ‘any form which is substantially similar’ to that form. (Our emphasis)

And herein lies the rub: No-one knows what is ‘substantially similar’ to form 4 and – inevitably – everyone is going to have a different interpretation of what is ‘substantially similar’. This will lead to – equally inevitably – the Information Regulator disagreeing with a direct marketing company as to what is ‘substantially similar’ as the IR will be inclined to require the direct marketing consent to be almost identical to Form 4, while direct marketers motivated to adapt the direct marketing consent as much as possible to be as attractive as possible to consumers. 

Ironically this issue is even bigger than it at first appears and that is due to the problem of legacy direct marketing consents. Let me explain. 

If you as a direct marketer go ahead and develop your direct marketing consent in a way that you consider to be ‘substantially similar’ you run the very large financial risk that your direct marketing ‘consents’ will be declared invalid at some point in the future. Declaring a couple of direct marketing consents to be invalid is obviously no problem, but if you have been using that same template for the last 6 months then you are suddenly in a situation where your ‘asset’ (500 000 direct marketing consents) is now worthless. That is an even BIGGER DEAL.

What to do? 

In my view the most practical way for companies to deal with this conundrum is for them to develop some direct marketing consents and send them to the Information Regulator for approval. Provided the IR responds and is reasonable in its response this is probably the easiest way for all the parties to avoid litigation and arrive at a general understanding of what ‘substantially similar’ is. The alternatives are complying with the exact wording of Form 4 or playing a game of direct marketing Russian Roulette… 

On reading (and re-reading) the judgment it seemed possible that the reason this judgment has not created big flashing red lights for consumer journalists is due to a lack of clarity as penned by acting Judge M V Phatshoane?

The purpose of this article is to provide our interpretation of what this judgment means in practice, how this has changed our view of the National Credit Act no.34 of 2005 and what the implications of the judgment are. 

Up until November 2021 it was the collective opinion of most attorneys as well as Judge AJ Hack of the Western Cape High Court that a credit provider was only entitled to recover double the amount of capital that it had loaned as at the date of default. This is best illustrated by an example: 

1. Credit provider A loans Joe Soap R10 000. 
2. Joe Soap repays R5000 of the capital amount but then loses his job and defaults on the loan repayments. Thus, at date of default the remaining capital amount due was R5000. 
3. Credit provider A now wants to recover the loan from Joe Soap and sues out a summons claiming the R5000 plus:
   1. a service fee (s101(1)(b)), 
   2. interest (s101(1)(c)),
   3. credit insurance (s101(1)(d)),
   4. default administration charges s (s101(1)(e)), and
   5. collection costs (s101(1)(f)).
4. In terms of section 103(5) all the fees, charges and interest mentioned above cannot exceed R5000. This meant that – in practice – the credit provider would know that it would never be able to recover more than R10 000 from Joe Soap as all its fees would be capped at an amount equal to the default capital amount (i.e. R5000 capital outstanding + R5000 in interest, fees, charges and legal fees). 

Micro lenders would be well aware that trying to recover a debt from a consumer often would not be cost effective as it is easy for legal costs to exceed the default amount (in our example R5000) which in turn would mean that even if the credit provider was completely successful it could end up paying more to the attorneys than it recovered from the debtor. This also meant that consumers with small debts could never face massive litigation costs where they need to pay for attorneys and advocates’ fees as – even if they lost – the ‘recoverable amount’ would only ever be double the capital amount due at the time of default. In short it dissuaded credit providers from starting litigation for small debts as it was commercially illogical. 

All this changed with the Supreme Court of Appeal judgment on 4 November 2021. In the appeal the five appeal court judges were tasked with deciding whether Judge Hack of the Western Cape High Court was correct in his interpretation of section 103(5) of the National Credit Act? They unanimously agreed that Judge Hack had erred. 

More specifically they found that all litigation costs (legal costs to recover the debt as well as interest and costs of execution after judgment) do not form part of the rule created by section 103(5) of the National Credit Act (see paragraph 19 of the judgment). 

Once again this is best illustrated by returning to our previous example but applying the law as set out by the Supreme Court of Appeal: 

1. Credit provider A loans Joe Soap R10 000. 
2. Joe Soap repays R5000 of the capital amount but then loses his job and defaults on the loan repayments. Thus, at date of default the remaining capital amount due was R5000. 
3. Credit provider A now wants to recover the loan from Joe Soap and sues out a summons claiming the R5000 plus:
   1. a service fee (s101(1)(b)), 
   2. interest (s101(1)(c)),
   3. credit insurance (s101(1)(d)),
   4. default administration charges s (s101(1)(e)), and
   5. collection costs (s101(1)(f)), 
   6. litigation costs 
4. Credit provider A succeeds and gets a judgment for R10 000 plus: 
   1. Interest at 7% per annum (current prescribed rate of interest) up until date of payment, 
   2. Litigation costs (probably on an attorney client scale) up until judgment
   3. Execution costs to recover the debt after judgment.

In theory the debtor could now face a claim for R50 000 if litigation costs and execution costs (such as sheriff’s fees) and interest after the date of judgment amount to R40 000. (Note that legal costs of R40 000 are perfectly possible if the matter went to trial). 

Hopefully it will now be clear why this judgment is a BIG DEAL as small loans now have the possibility of costing the debtor far in excess of the amount that was loaned (in our example the debtor ends up paying an amount that is 500% greater than the loan he received from credit provider A)! 

Here is a list of the winners and the losers: 

WINNERS

• Credit providers who can now go back to their debtors’ book and hand over a significant percentage of the debtors’ book to attorneys to collect, 
• Attorneys who would have a significant increase in the number of matters being referred to them by credit providers

LOSERS

• Debtors who have defaulted on their loans

There is also a possibility of a silver lining as the credit market might react by being more willing to provide micro-loans now. 

The last question on this judgment is whether it will be appealed by the Stellenbosch Legal Aid clinic to the Constitutional Court. Certainly, the judgment has a massive effect on consumers and the credit industry and so it would be surprising if this judgment is not appealed. 

In the meantime consumers wanting loans should be far more careful now than before as defaulting on even a small loan could have devastating consequences…

The recent riots in Kwazulu-Natal and Gauteng bring the question of capacity in SAPS into stark relief. In general, the prosecution of Cybercrimes would require police officers who would have a tertiary qualification – preferably in computer science or forensics. Anecdotal evidence suggests that new SAPS recruits into the commercial crime / cybercrime section do not need any tertiary qualification. This is dramatically different from the type of qualifications you find in the private sector where digital forensic specialists often have multiple qualifications and considerable experience in the field. Put simply it is difficult to imagine how the commercial crime / cybercrime section of the SAPS will succeed without strong assistance from the private sector – the cybercrimes problem is just too complex. Unfortunately, it is not as easy as the private sector being willing to provide the help – it is also up to the SAPS to accept the help and facilitate appropriate interaction with the private sector. 

The question of capacity not just a local South African problem, but also a problem for African countries. Many African countries are also in the process of implementing their own cybercrimes legislation (for example, consider the metrics that we used to evaluate Cybercrime legislation for the African Union eCommerce project on page 4 of this presentation) and struggling to increase their cybercrime capacity. 

While there are many strategies to increase cybercrime capacity, there is one that I would like to propose which would be along the lines of the Digital Security Challenge hosted by Interpol every year. This has a host of benefits including strengthening of public / private interaction and identifying upcoming talent which can be nurtured and mentored. This could be particularly valuable in that the talent comes to the SAPS rather than the SAPS having to find it. This model could also be enlarged so that African Union countries, rather than just South Africa, would be able to participate. 

Cybercrime prevention is not just about having the legislation to prosecute it: that is just the first building block. Our Cybercrime Act will not properly get off the ground if the SAPS does not come up with innovative ways to make its cybercrime division an employer of choice and work together with the private sector to vastly ramp up its capacity.