Article Sidebar
Article Details
This work is licensed under a Creative Commons Attribution 4.0 International License.
Copyright in all material published in PER/PELJ vests in the author, provided that authors grant, by submission of their contributions, permission that their contributions may be shared and adapted without restriction. An author furthermore agrees that the same contribution may not be published elsewhere without the written permission of the editor.
Anyone gaining access, electronically or otherwise, to a contribution to PER, may quote from such contribution, use the intellectual content thereof, share and adapt it, but subject to the following conditions:
you must give appropriate credit, provide a link and indicate if changes were made; and
the copyright of the author(s) may not be infringed in any way.
Main Article Content
Employers' statutory vicarious liability in terms of the Protection of Personal Information Act
Abstract
A person whose privacy has been infringed upon through the unlawful, culpable processing of his or her personal information can sue the infringer's employer based on vicarious liability or institute action based on the Protection of Personal Information Act 4 of 2013 (POPI). Section 99(1) of POPI provides a person (a "data subject") whose privacy has been infringed upon with the right to institute a civil action against the responsible party. POPI defines the responsible party as the person who determines the purpose of and means for the processing of the personal information of data subjects. Although POPI does not equate a responsible party to an employer, the term "responsible party" is undoubtedly a synonym for "employer" in this context. By holding an employer accountable for its employees' unlawful processing of a data subject's personal information, POPI creates a form of statutory vicarious liability.
Since the defences available to an employer at common law and developed by case law differ from the statutory defences available to an employer in terms of POPI, it is necessary to compare the impact this new statute has on employers. From a risk perspective, employers must be aware of the serious implications of POPI. The question that arises is whether the Act perhaps takes matters too far.
This article takes a critical look at the statutory defences available to an employer in vindication of a vicarious liability action brought by a data subject in terms of section 99(1) of POPI. It compares the defences found in section 99(2) of POPI and the common-law defences available to an employer fending off a delictual claim founded on the doctrine of vicarious liability. To support the argument that the statutory vicarious liability created by POPI is too harsh, the defences contained in section 99(2) of POPI are further analogised with those available to an employer in terms of section 60(4) of the Employment Equity Act 55 of 1998 (EEA) and other comparable foreign data protection statutes.
Keywords: Vicarious liability; Protection of Personal Information Act; defences; comparison with Employment Equity Act; United Kingdom's Data Protection Act of 1998; New Zealand's Privacy Act 28 of 1993; Australian Privacy Act 119 of 1988
