The Information Regulator (IR) suffered a sharp defeat in the High Court in Pretoria today (12 December) when a Full Bench dismissed its claim that matric learners are identifiable from their examination numbers.
Judge Omphemetse Mooki was unsparing, calling the Regulator’s position “fanciful” and “akin to a poorly constructed thought experiment”.
“No empirical evidence supports the position. The Regulator’s stance does not reflect events in the real world,” he said.
The ruling clears the way for matric results to continue being published on public platforms using exam numbers only. The Court rejected the theory that learners would memorise each other’s seating positions or sequential numbers to identify classmates’ marks. Publishing numbers-only results, the judges found, does not disclose personal information under the Protection of Personal Information Act (POPIA) and provides sufficient privacy protection.
How the dispute began
The judgment caps years of conflict between the Department of Basic Education (DBE) and the IR.
On 6 November 2024, the IR issued an Enforcement Notice accusing the DBE of unlawfully publishing National Senior Certificate (NSC) results in newspapers without consent. It ordered the department to stop immediately and provide undertakings within 31 days.
The IR also laid down sweeping conditions for the 2025 cohort, including a requirement that the DBE obtain consent from all matriculants – or their guardians – before publishing any results. It demanded proof of a new consent-collection system within 90 days and required an overhaul of examination numbering to prevent classmates from identifying one another.
The DBE refused to comply. On 27 November, it announced it would continue publishing as usual, relying on the 2022 court ruling in which AfriForum, Maroela Media, and a matriculant forced publication of the 2021 results.
The Regulator responded with an Infringement Notice, a R5-million fine, and urgent court proceedings to stop publication.
On 8 January, Judge Ronel Tolmay struck the matter from the roll for lack of urgency, and the 2024 results were published on 14 January.
The IR then challenged the validity of the DBE’s appeal, arguing it was filed six days late. While the DBE uploaded the papers to Court Online on 13 December, it only served them on the Regulator on 9 January. The DBE sought condonation, and in late January escalated matters further by launching a review application to set aside the Enforcement Notice entirely.
Delay in the appeal not fatal
Judge Mooki rejected the IR’s attempt to strike the appeal, holding that the six-day delay was neither excessive nor prejudicial. He noted that the State Attorney had offered a credible explanation, including skeleton staffing over the holiday period.
He dismissed the Regulator’s criticism that the department “should have done more”, calling its stance contradictory. In the Regulator’s interpretation, he said, “the sword fell once the 30 days elapsed”, meaning condonation would never be possible. That approach, Mooki held, “will be a perversion of justice”.
He found the DBE had demonstrated prospects of success – particularly its argument that matriculants cannot be identified from examination numbers alone – and formally condoned the late filing.
What the Information Regulator argued
The Regulator maintained it acted lawfully in launching an own-initiative assessment –without a complaint – to determine whether publishing matric results breached POPIA. It said the assessment showed the DBE was processing learners’ personal information unlawfully because classmates could identify one another from sequentially issued examination numbers.
According to the IR, exam numbers are allocated sequentially per school, and learners sit in the same order during examinations. This, it argued, makes it possible for matriculants to identify peers “by simply looking at the sequence of examination numbers published in the local newspapers”. The Regulator insisted that this “identification of learners” infringes section 14 of the Constitution and POPIA’s core privacy protections.
It argued that publication in newspapers does not protect learners’ legitimate interests, particularly because those who are not near their schools can access results through the DBE’s secure SMS platform. It dismissed any appeal to public interest or tradition, saying such considerations “cannot… override the Constitution and the Act enacted to protect the right to privacy”.
The IR rejected arguments that earlier litigation in 2022 had permanently settled the issue, saying the order was limited to the 2021 results and obtained by agreement.
It maintained that the DBE had failed to meet POPIA’s section 11 processing requirements because “learners are identifiable”, and no referral to the Enforcement Committee was required before issuing its notice.
What the department argued
The DBE appealed on four grounds:
- The Regulator cannot issue an Enforcement Notice to prevent hypothetical future breaches;
- A 2022 High Court order had already settled the lawful method of publication;
- Exam numbers do not make learners identifiable; and
- The department complies fully with POPIA’s processing limitations.
The DBE said the publication method – releasing only examination numbers and the corresponding results – was introduced specifically to protect privacy, replacing the old practice of publishing names, schools, and marks. It argued that the published information does not enable identification “by direct or indirect linkages”, and no reasonable person could identify a learner from the data.
The department emphasised that it had never received a complaint of harm or prejudice arising from the publication of results.
It said the data it publishes is not “personal information” under POPIA because the information is not related to an identifiable person, and therefore publication does not constitute “processing”.
Although acknowledging that an exam number is a unique identifier, it argued that POPIA’s definition of personal information does not turn on the presence of such an identifier.
The DBE also leaned heavily on the 18 January 2022 order, which required publication in anonymised form – a process the Regulator agreed to and never challenged. It said this history made the matter res judicata or subject to issue estoppel.
On identifiability, the DBE dismissed the Regulator’s argument that learners could recall sequential seating positions or understand how numbering works, calling the theory “so far-fetched and implausible that it can be disregarded as insignificant”.
The department further argued that enforcement notices can only address past or current violations – not speculative future conduct.
Judge’s analysis: argument collapses
Judge Mooki reduced the entire dispute to one pivotal question: does publishing an exam number alongside a matric result amount to publishing “personally identifiable information”? If not, he said, “cadit quaestio [literally: ‘the question falls’], and the appeal must succeed”.
He recorded that the DBE insisted no learner could be identified “solely by the examination number of that learner”. The Regulator’s theory relied instead on sequential numbering supposedly allowing classmates to identify each other.
But the judge noted that the IR’s own assessment report did not explain this mechanism; the detailed theory emerged only later in court papers. Even then, he found the assumptions deeply unrealistic. Under POPIA, he said, information is personally identifiable only if, “without any particular diligence”, a person can identify another individual.
The Regulator’s theory required an elaborate chain of recall and inference: a learner must remember exam seating weeks later, understand the numbering system, track sequential numbers in a newspaper and then match these to individuals. Judge Mooki rejected this as improbable.
“I agree with the department that the Regulator’s contention is fanciful,” he wrote. “Its approach is akin to a poorly constructed thought experiment. No empirical evidence supports the position. The Regulator’s stance does not reflect events in the real world.”
He added that it would be “very unusual” for any learner – after preparing for examinations, writing multiple papers and waiting weeks for results – to reconstruct seating arrangements with such precision.
Because the publication method does not amount to processing personally identifiable information, the Court found no infringement of privacy rights. That conclusion rendered every remaining issue incidental or irrelevant.
“The appeal must succeed,” Judge Mooki said.
As a result, the Enforcement Notice, the Infringement Notice, and the Regulator’s related review proceedings fell away entirely.
