Abstract
In the digital age, personal information has emerged as both an asset of immense economic value and a critical element of personal autonomy. Yet South African law remains unsettled on whether personal information can be “owned” in the legal sense. This dissertation examines whether personal information, as defined and regulated by the Protection of Personal Information Act 4 of 2013 (POPIA), qualifies as property capable of ownership or whether data subjects are merely granted control over its use, collection, and dissemination. Adopting a doctrinal approach, the study engages in a conceptual analysis of property law and data protection and information privacy law.
It assesses whether the attributes of ownership under traditional property law can meaningfully apply to personal information. This research evaluates key case laws, including Black Sash Trust v Minister of Social Development and Discovery Ltd v Liberty Group, to analyse how courts have interpreted the rights vested in data subjects. A comparative analysis of foreign frameworks, such as the European Union’s General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA), reveals a global trend: individuals are afforded significant control over personal information but not legal ownership. This approach is echoed in South African jurisprudence.
The dissertation concludes that personal information, while valuable, is more accurately understood within a control-based approach framework rather than through traditional concepts of ownership. This legal stance, however, leaves potential gaps in protection, especially where control rights alone prove inadequate against misuse or exploitation. The findings underscore the need for a nuanced regulatory model that balances personal autonomy, commercial interests, and data sovereignty. By clarifying the conceptual and legal status of personal information, this study contributes to evolving debates on data protection and information privacy law in South Africa. This research highlights practical implications for South African policy and law reform, offering guidance on closing regulatory gaps and aligning local data protection with emerging international best practices.