sassa v minister of social development 2023-2024

The Constitutional Court agreed with the Information Regulator in Black Sash Trust v. Minister of Social Development that data subjects own their personal information and that a responsible party cannot transfer the data subject’s personal information to another party. The South African Social Security Agency (SASSA) was ordered by the court to limit the usage of personal data to processing recipients’ monthly social grant payments. The Court mandated that safeguards for the privacy of grant beneficiaries be included in the contract between SASSA and Cash Paymaster Services (CPS).

Who should be concerned with this verdict and why?

Those in authority, whether in the public or private sphere, are required to use personal information responsibly and solely for the intended purpose.
Because you can only process for a specified reason and with authorization from a responsible party, operators process on that party’s behalf.
SASSA on the grounds that they should only manage monthly friendly award installments using the recipients’ own information.
Due to the judge’s determination of what must be contained in a DPA between a controller and a responsible party, anyone engaging into a data processing agreement (DPA).
Social grant recipients need to understand that they are the owners of their personal information and that others have a responsibility to protect it from misuse.

What could you be able to do?

For additional details on the information regulator, read this post by Michalsons.
To get the whole story, read the decision in its entirety.
The judgement is summarized in the Constitutional Court’s explanation.
You will have access to all judgments relating to data protection after enrolling in a Michalsons program.

sassa v minister of social development 2023-2024

Our opinions on the decision

The security of the personal data of recipients of social subsidies is the regulator’s top concern in this case. Only one portion of Black Sash’s application was the subject of the regulator’s objections, which were detailed in the Notice of Motion. Black Sash requested that the court determine that the disclosure of award beneficiaries’ personal information to SASSA infringed on POPIA’s principles in paragraphs 5(b) and 11. (b). The application documents made it plain that the Court had adopted the regulator’s definitions of “personal information” and “data subject” even though POPIA has not yet begun.
The controller and the court both concluded that Dark Band’s request to declare the personal information of prize recipients SASSA property was invalid. The idea that people own their personal information and that a responsible party cannot transmit it to another party is supported by the fact that the paragraphs were eliminated from Black Sash’s final application documents.
The Court supported the regulator’s strategic objective of lowering obstacles to information access and data protection. Additionally, it creates the framework for anyone who contribute data to challenge any company that breaches their privacy agreement.
They are only permitted to use personal information for that one reason when they process it. When processing personal information, they must stay in their lane. Also, they are not permitted to grant anyone else access to any of their personal data.

Digest

The main goal of this judgment is to allow SASSA to pay grant recipients across the nation legally. SASSA hired CPS to manage the monthly social grant payment procedure.
In the public’s best interest, Black Sash petitioned the Constitutional Court to rule that any agreement between SASSA and CPS must specify that SASSA shall own the grant beneficiaries’ personal information.
The Regulator refused Black Sash’s request, claiming that there was no legal justification for giving SASSA ownership of the personal data of recipients of social grants. Hence, the Court determined that social grant recipients possess their personal information.

sassa v minister of social development 2023-2024

Order

The Court directed SASSA to make certain that the CPS agreement:

Contains the necessary safeguards to ensure that personal data received during the payment process remains private. It also outlines steps to ensure that CPS will only use personal information to make grant payments.
It is also forbidden to ask beneficiaries to “opt-in” to disclosing their private information in order to promote goods and services.

Information on Black Sash Trust v. Minister of Social Development

Citation all-purpose: [2018] ZACC 36
In addition, it was mentioned in 2017 (3) SA 335 (CC) and 2018 (12) BCLR 1472 (CC)
Black Sash Trust v. Ministry of Social Development and Others, in its entirety (Freedom Under Law Intervening)

Note: Although this judgement addresses a number of constitutional problems, our study concentrates on how the Court handled privacy and data protection issues. Hopefully this is not too much bother. The summary of this ruling is not meant for public readers and has been created particularly for Michalsons Data Protection program participants.

sassa v minister of social development 2023-2024

SOCIAL GRANTS