Technology Back to blog

\>Can the Information Regulator compel private bodies to submit a PAIA report?_

By Mari Louw and Dérick Swart on June 26, 2024

If you have read a legal newsletter or scrolled through LinkedIn recently, you would likely have come across a number of warnings directed at public and private bodies alike to submit their "PAIA reports" or "Annual Reports" to the Information Regulator by 30 June 2024.

This blogpost considers if the Information Regulator can compel private bodies (such as sole proprietors, partnerships, private companies, and political parties) to do so, or whether it is acting ultra vires (i.e. outside of its powers).



What does PAIA say?

The Information Regulator ("Regulator") is the independent body which enforces compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and the Promotion of Access to Information Act 2 of 2000 ("PAIA").

Section 84 of PAIA broadly provides that the Regulator must include, in its annual report to the National Assembly, the following:

  • any recommendations it may wish to make for the development, modernisation etc. of PAIA or other laws having a bearing on access to information, and the procedures in terms of which public and private bodies make information electronically available; and
  • in relation to each public body, information such as the number of access requests received, granted, and refused by that public body (which public bodies must report annually to the Regulator in terms of section 32 of PAIA).
Section 83(4) of PAIA provides that "[f]or the purpose of the annual report referred to in section 84 and if so requested by the Information Regulator, the head of a private body may furnish to that Commission information about requests for access to records of the body."

The regulations promulgated in terms of PAIA ("Regulations") do not further elaborate the aforesaid duties and specifically do not prescribe the manner in which the Regulator must request such information from private bodies.

Section 83(3)(i) of PAIA does empower the Regulator to "generally, inquire into any matter, including any legislation, the common law and any practice and procedure, connected with the objects of this Act", but as the Regulator has not placed reliance on this provision, nor do we think it will assist at face value, it falls outside the scope of this blogpost.

Notices published by the Information Regulator

The Regulator first published a notice on its website and LinkedIn page last year urging public and private bodies to submit annual reports detailing the requests for access to records of the body by the then-deadline of 30 June 2023.

In relation to private bodies, the Regulator posted, on LinkedIn, an image with the following text "Are private bodies required to submit PAIA annual reports? YES! The Regulator has decided to request private bodies, in accordance with section 83(4) of PAIA, to submit their reports about requests for access to records."

An extension notice for the submission of the aforementioned annual reports, published by the Regulator on 30 June 2023, conveys a somewhat contradictory message, and states that "[a]lthough section 83(4) of PAIA provides that the head of a private body may submit its annual report to the Regulator upon request, the heads of private bodies are encouraged to submit their Annual Report because this is good practice," [our emphasis added].

It can safely be concluded that, aside from the mixed messages, the Regulator has in fact made a request to private bodies in terms of section 83(4) of PAIA.

Our interpretation of section 83(4)

The court in Natal Joint Municipal Pension Fund v Endumeni Municipality 2012 4 SA 593 (SCA) ("NJMPF v Endumeni"), a seminal case on the topic of statutory interpretation, held, at paragraph 18, that "[w]hatever the nature of the document, consideration must be given to the language used in light of the ordinary rules of grammar and syntax; the context in which the provision appears; the apparent purpose to which it is directed and the material known to those responsible for its production."  The court further elaborated at paragraph 26 that "[a]n interpretation will not be given that leads to impractical, unbusinesslike or oppressive consequences or that will stultify the broader operation of the legislation or contract under consideration."

The language used

The language of section 83(4), in light of the ordinary rules of grammar and syntax, is clearly permissive ("may furnish") – especially compared to the language of section 32 which applies to public bodies and provides that they "must annually submit" a report to the Regulator setting out the specific information listed in that section. 

Contextual or purposive reading

In correspondence with the Regulator, they have cautioned that "…[a]s per different case laws on interpretation of statute, the word “may” in a written instrument is generally construed as permissive, but it can be interpreted as mandatory depending on the context in which it is used.

Indeed, as indicated by the court in NJMPF v Endumeni, the language alone is not decisive.  The court in African Christian Democratic Party v Electoral Commission and Others 2006 5 BCLR 579 (CC) has similarly cautioned against a "narrowly textual and legalistic approach" to statutory interpretation, instead favouring a more substantive approach which considers the language used together with the purpose of the provision in question, thereby signalling a shift away from the categorical distinction between permissive and directory provisions.  

On a contextual or purposive reading of section 84(3) the following is relevant:

  • Unlike annual reports which must be submitted by public bodies in terms of section 32 of PAIA, the submission of information by private bodies in terms of section 83(4) is not required for the Regulator to comply with any of its own obligations.  It may use such information to inform any recommendations it may wish to include in its annual report to the National Assembly.
  • PAIA contains no direct sanction for non-compliance with section 83(4). 

Conclusion

Taking the aforegoing into account, and considering the broad and far-reaching consequences of a peremptory reading of section 83(4), we must conclude that on a proper interpretation the "request" is just that. 

This is a sensible reading, as the report to be submitted by the Regulator must broadly cover (1) general recommendations, having had the benefit of input from public and private bodies (if the latter was so requested) and (2) the specific items mentioned in PAIA in relation to public bodies only. 

If our reading is correct, it follows that if the Regulator asserts that private bodies must submit a PAIA report, it would be acting outside of the remit of its legislative mandate and therefore ultra vires.


Back to blog
Please note that our blog posts are informal commentaries on developments in the law as at the time of publication and not legal advice. You should place no reliance on our blog posts; we look forward to discussing your particular matter with you.