Abstract
A person whose privacy has been infringed through the unlawful processing of his or her personal information has two remedies. The first is to sue the infringer’s employer based on vicarious liability (provided that there was a delict) and the second is an action based on the Protection of Personal Information Act 4 of 2013 (POPI). Section 99(1) of POPI provides a person (the so-called data subject), whose privacy has been infringed, with the right to institute a civil action against the responsible party. POPI defines the responsible party as the person who determines the purpose of and means for processing of personal information of data subjects. Although POPI does not equate a responsible party to an employer, the term “responsible party” is undoubtedly a synonym for “employer” in this context. By holding an employer accountable for its employees’ unlawful processing of a data subject’s personal information, POPI creates a form of statutory vicarious liability. Since the defences available to an employer at common law, and developed by case law, differs from the statutory defences available to an employer in terms of POPI, it is necessary to compare the impact this new statute has on employers. From a risk perspective, employers need to be aware of the serious implications of POPI and the question that arises is whether the Act does not perhaps take matters too far. This dissertation therefore takes a critical look at the statutory defences available to an employer in vindication of a vicarious liability action brought by a data subject in terms of section 99(1) of POPI. A comparative analysis is made between the defences found in section 99(2) of POPI and the common-law defences available to an employer fending off a delictual claim founded on the doctrine of vicarious liability. To support the argument that the statutory vicarious liability created by POPI is patently insufficient, grossly inadequate, and too harsh, the defences contained in section 99(2) of POPI is further analogised with the defences available to an employer in terms of section 60(4) of the Employment Equity Act 55 of 1998 (EEA) and other comparable foreign data protection statutes.
LL.M. (Commercial Law)