Picture the scene. A shop owner posts a CCTV still to a neighbourhood Facebook group: “This woman stole from us. Share!” Within the hour, someone has named her. Someone else adds the complex she lives in. A third posts a screenshot of a private WhatsApp message she once sent a friend.
By evening, it has been shared hundreds of times. Even if every word is true, was any of it lawful?
In Part Three we looked at when a post becomes a crime: threats, incitement and the non consensual sharing of intimate images under the Cybercrimes Act 19 of 2020, and the alternatives when the criminal law is not the answer.
This time the question is quieter but far more common: not whether a post is criminal, but whether its contents were ever yours to share.
1. Privacy Is a Right, Not a Setting
Section 14 of the Constitution of the Republic of South Africa, 1996 guarantees everyone the right to privacy, expressly including the right not to have the privacy of their communications infringed. Section 10 protects human dignity, and the two are closely linked.
As Part Three noted, freedom of expression under section 16 is broad but not unlimited. Privacy is one of its principal limits. Neither automatically outranks the other; the courts weigh them on the facts.
Privacy settings matter (Part Two showed that a wide-open profile carries little expectation of privacy), but they do not decide the question. What counts is whether the person reasonably expected the information to stay where they put it.
2. True Is Not the Same as Lawful
At common law, an invasion of privacy is actionable under the actio iniuriarum, the remedy for wrongful infringements of personality rights. It takes two broad forms: intrusion (reading someone’s messages, filming inside their home) and the disclosure of private facts.
Where there was a reasonable expectation of privacy, disclosure without consent is prima facie wrongful. Consent is a defence, as is disclosure genuinely in the public interest. But the courts distinguish firmly between what is in the public interest and what merely interests the public. Curiosity, however widespread, is not a justification.
The disclosure need not reach the public at large. In Jansen van Vuuren and Another NNO v Kruger 1993 (4) SA 842 (A), a doctor who disclosed a patient’s HIV status to two colleagues was held liable. If two people are enough, so is a WhatsApp group of twelve.
Nor is truth a defence. In defamation, a true statement published for the public benefit may be justified. A privacy claim assumes the information is true and asks whether it was private. In NM and Others v Smith and Others [2007] ZACC 6; 2007 (5) SA 250 (CC), the Constitutional Court held the author, the politician whose biography it was, and the publisher liable for naming three women living with HIV, although the information was accurate and had already appeared in a report circulated to a limited group. Pseudonyms, the Court observed, would have told the story just as well.
“Everyone in the complex already knows” is not the same as “it’s public”. 3. Where POPIA Fits In The Protection of Personal Information Act 4 of 2013 (POPIA) regulates the processing of personal information, which includes publishing it. As Part One noted, it is no shield for someone who publishes defamatory material. But nor does it reach every post.
Section 6(1)(a) excludes processing “in the course of a purely personal or household activity”. A family group chat plainly falls within it. Whether the exclusion survives a public post that goes viral is unsettled, as no South African court has decided the point. In Lindqvist (Case C-101/01, 2003), the Court of Justice of the European Union held that publishing personal information on a website accessible to an indefinite number of people is not a purely personal activity. It is persuasive authority only, but its reasoning is likely to carry weight here.
Section 7 excludes processing solely for journalistic, literary or artistic expression, but only to the extent needed to reconcile privacy with freedom of expression in the public interest. Calling an account an “exposé page” does not, by itself, bring it within the exclusion.
4. “Name and Shame” Is Not a Business Tool
POPIA applies with full force when a business, school or body corporate posts about the people it deals with. Each is a “responsible party”, and the household exclusion does not help it.
Information about a person’s alleged criminal behaviour is special personal information under section 26, which may be processed only where an authorisation in section 27 (such as consent) or section 33 applies. Section 33 is aimed mainly at bodies charged by law with applying the criminal law, and any processing must still be adequate, relevant and not excessive. Whether a public post to a community group can meet that standard is untested, and doubtful.
The safer course is plain: give the footage to the police, not to the internet.
5. Screenshots, Voice Notes and Recorded Calls
Section 4 of the Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002 generally permits a person who is a party to a communication to record it, unless the purpose is to commit an offence.
But recording is not publishing. That Act governs keeping a record, not broadcasting it. A message sent to one person carries an obvious expectation that it will not reach hundreds, and publication turns on the privacy analysis above.
Forwarding a threatening voice note to the police is one thing. Posting a friend’s confidences to Instagram because the two of you fell out is another.
6. Photos, “Exposés” and Doxxing
Being seen in public generally carries no reasonable expectation of privacy, and filming in public is not itself unlawful. That changes when footage is used to humiliate someone or reveal something private (a clinic visit, for example), or is captured where privacy is expected.
The law also protects a person’s identity, including their name and image, against unauthorised use that misrepresents or exploits them.
Doxxing (posting someone’s home address, ID number or workplace to expose them to others) is where privacy most often turns into danger. No genuine public interest requires a private person’s ID number or street address to be posted online. Where doxxing is used to intimidate, it may also support a protection order under the Protection from Harassment Act 17 of 2011, discussed in Part Three.
7. Children Are Different
Section 34 of POPIA prohibits a responsible party from processing a child’s personal information unless one of the exceptions in section 35 applies, most commonly the consent of a competent person such as a parent or guardian. A school posting learners’ photographs therefore needs that consent.
Parents posting their own children, and bystanders filming other people’s children, are likely to fall within the household exclusion. That does not make it wise, and the common law and the paramountcy of a child’s best interests still apply.
In criminal matters the rules are stricter. Section 154(3) of the Criminal Procedure Act 51 of 1977 prohibits publishing, in any manner whatever, information that reveals or may reveal the identity of an accused or a witness under the age of 18. In Centre for Child Law and Others v Media 24 Limited and Others [2019] ZACC 46, the Constitutional Court extended that protection to child victims, and held that it does not fall away when the child turns 18. Contravention is a criminal offence.
Sharing a news report about a child victim is one thing. Adding the child’s name in the comments is another.
8. What You Can Do About It
Part Three covered preserving evidence, intimate images under section 16 of the Cybercrimes Act and protection orders. Beyond those, the main options are:
• Ask for removal. A calm written request is often the quickest fix, and puts the poster on notice.
• Platform reporting tools. Most platforms accept privacy and harassment reports.
• A take-down notification under section 77 of the Electronic Communications and Transactions Act 25 of 2002. A provider that ignores a valid notice risks losing its statutory protection from liability, but that protection applies only to members of a recognised industry representative body, which limits its reach against international platforms.
• POPIA remedies against a responsible party: a request to delete the information under section 24 (free of charge and, under the Regulations as amended on 17 April 2025, to be answered within 30 days), a complaint to the Information Regulator under section 74, and a civil claim for damages under section 99, which does not require proof of intent or negligence.
• An urgent interdict in the High Court, ordering removal and restraining further publication.
• A claim for damages under the common law for the invasion of privacy and the impairment of dignity.
The Bottom Line
Social media has blurred the line between private and public, but the law has not abandoned it. Was the information private? Did the person consent? Is there a genuine public interest, or only curiosity?
A post can be true, lawfully obtained and still unlawful to publish.
Across this series, one idea has held throughout: the law treats a post as seriously as anything said in print. Part One showed that a post can become a lawsuit, Part Two that it can cost a job, Part Three that it can become a crime, and this instalment that it can found a claim for sharing what was never yours to share.
Before you post, think about who else is in it.
.jpg)
