The well-established principle of subsidiarity provides that, where legislation has been enacted to give effect to a right, litigants must rely on that legislation to enforce the right or, alternatively, challenge the legislation for inconsistencies with the Constitution. In De Jager v Netcare Limited and Others [2025] JDR 0793 (GP), the Protection of Personal Information Act 4 of 2013 (POPIA) was particularly relevant as it is the piece of legislation which codifies privacy law. 

The central legal issues in this case were whether the evidence in question – which comprised an expert’s investigation and findings into the activities of the plaintiff (De Jager), who was claiming damages in excess of R25 million against the defendant (Netcare) – amounted to an infringement of the plaintiff’s right to privacy and a breach of the provisions of POPIA, as this could significantly impact the admissibility of such evidence.

Facts of the case

This case centres upon a dispute between the parties regarding the admissibility of evidence comprising photographs and videos obtained through surveillance of the plaintiff by a private investigator at the defendant’s request. The plaintiff, who underwent unsuccessful eye surgery at the defendant’s Pretoria East hospital, claimed damages for loss of vision in one eye and loss of income and the need for assistive devices. However, surveillance footage tended to contradict these claims, as it demonstrated the plaintiff performing daily activities, such as going shopping for goods and parking a vehicle in a public parking lot without the need for such aids, thereby undermining the alleged impact of the failed surgery on his vision and ability to go about his normal way of life. The plaintiff objected to the admission of the surveillance evidence, arguing that it violated his right to privacy in terms of section 14 of the Constitution. The plaintiff, however, did not challenge the constitutionality of POPIA, nor did he reference POPIA in relation to the provisions that govern the lawful processing of special personal information. The defendant, on the other hand, argued that the evidence was necessary to discover the truth about the plaintiff’s health, which was the central dispute in this matter.

In an attempt to balance the apparent conflict between protecting the right to privacy and the public interest to discover the truth, two amicus curiae were admitted by the court and, ultimately, both were ad idem that POPIA finds application in this matter.

Court’s findings

The purpose of POPIA is to give effect to the constitutional right to privacy by safeguarding personal information. However, this right of protection is subject to justifiable and reasonable limitations, aimed at balancing the right to privacy with the right to access information where, in terms of section 27(1)(b) of POPIA, the information is necessary for the establishment, exercise or defence of a right or obligation in law.

The first amicus curiae submitted that the processing of such personal information was lawful under section 11(1)(f) of POPIA, as it was necessary in pursuing a legitimate interest of the defendant.

The second amicus curiae argued that the evidence should not have been admitted due to a lack of consent obtained from the plaintiff, and he considered its admission to be a gross invasion of privacy. The court conducted an analysis with regard to the factors in the limitation provisions contained in section 36 of the Constitution to determine whether the infringement of the plaintiff’s privacy was reasonable and justifiable given the circumstances. The court considered the nature of the right to privacy, the purpose of the limitation (the defendant’s need to obtain evidence regarding the state of the plaintiff’s health) and the extent of the infringement, which was deemed minimal due to the surveillance occurring in a public space. The court examined the relationship between the taking of the photographs and the need for the admission of evidence that exposed the truth about the plaintiff’s health. It ultimately found that no less restrictive means were available to obtain this information. The surveillance was thus considered necessary, proportionate and justified by a legitimate legal interest.

The court made refence to Smuts and Another v Botha [2022] JOL 51863 (SCA) and distinguished that the surveillance evidence was obtained through footage in a public setting and noted that, had the footage been captured in a private setting, its admissibility may well have been excessive. This draws from the “minimality principle” contained in section 10 of POPIA. As established in the Botha case, where evidence is already in the public domain, there is no longer a legitimate expectation of privacy. The Botha case references the “minimality principle”, which ensures that the processing of personal information is adequate, relevant and not excessive.

Ultimately, the court found that the surveillance evidence to be admitted in De Jager was obtained in a manner consistent with POPIA, particularly section 11(1)(f), as it served a legitimate purpose in investigating the plaintiff’s health and that this was in the interests of justice.

Key findings

• The principle of subsidiarity: Where legislation such as POPIA has been enacted to give effect to a right, such as the right to privacy, litigants should rely on that legislation to give effect to the right and not directly invoke a constitutional right.
• Admissibility of special personal information as evidence: Although section 26 of POPIA prohibits the processing of special personal information, such as medical information, this right is subject to limitations of justifiability and reasonableness. A legitimate interest must be assessed by conducting a section 36 constitutional analysis. Section 27(1)(b) of POPIA allows for the processing of such information when it is necessary for the establishment, exercise or defence of a legal right or obligation.
• The principle of minimality: When evidence is in the public domain, the expectation of privacy is diminished, and such evidence may be admissible as evidence. However, it must comply with section 10 of POPIA, which requires the evidence to be relevant and not excessive. Footage involving other individuals, especially children, would be inadmissible.
• Consent and health data: The processing of special personal information, particularly relating to a person’s health, does not always require the explicit consent of (or notification to) the person concerned, especially if it serves a legitimate interest, as outlined in section 11(1)(f) of POPIA. The processing of special personal information (such as health data) is justified under section 27(1)(b) of POPIA when it is necessary to defend a legal right.