INTRODUCTION

When taking pictures of people in public, or your own selfie, have you ever stopped before pressing a shutter button and asked yourself the following important questions:

• Am I allowed to capture someone else’s personal image on camera without their permission?
• Am I allowed to am I allowed to share another person’s image on social media without their permission?
• Could I, by my actions, be infringing the rights of the person who appears in the picture without their consent?
• If I put an image of myself on social media, does this mean that I am allowing other people to share this image in future, without my consent?
• If I put my own image on social media, does this allow other people to edit my image and use it in future without my consent?

Perhaps you intend to install CCTV cameras at your home, but you are burdened by concerns of a similar nature. This article considers the legal question of whether images of persons are protected under POPI (Protection of Personal Information Act)¹ and if they are, in which circumstances.

PERSONAL INFORMATION

POPI aims to protect personal information. As such, to determine if Images are considered personal information under the act, we must look at section 1 which includes several key definitions that will aid us in answering the question of if (and/or how) images of persons are protected under POPI. Section 1 of POPI defines personal information as information relating to an identifiable, living, natural person and includes amongst others information about gender, race, health, marital status, biometrics and symbol.² Notably the definitions section does not specifically include a person’s image within the definition of “personal information”.

Section 1, however, does not close the scope to other inclusions. This is because it specifically states that the scope is not limited to what was specifically noted by the section. We thus are required to turn to the law of interpretation in order to interpret the definition.

DO PERSONAL IMAGES COUNT AS “BIOMETRICS”?

In a case where a person’s image is utilized to access any database or information (such as in the case where a person has registered their face on their mobile phone and the phone scans the person’s face to unlock access to the phone), a person’s image is most certainly “personal information” within the meaning of POPI because it is a unquestionably a type of biometric information contemplated in the definition of “personal information”.

In cases where a person’s image is not registered as a biometric method of accessing information, however, the answer to our question is a little less clear.

THE LAW OF INTERPRETATION

In South Africa we have a body of law known as “the law of interpretation” to assist in interpreting ambiguous or otherwise unclear laws in a uniform fashion, and in a way that tends to promote and protect the advancement of rights (as opposed to detracting from them).³ In terms of this body of law, there are a series of principles to apply in a certain order to determine the most appropriate interpretation of any particular word or phrase. The law on topic is well settled and expounded upon in the well known case of Joint Natal Municipal Pension Fund v Endumeni Municipality⁴. In summary:

1. Text and Context: Interpretation is a unitary exercise where both the language of the provision and its context must be considered. The meaning of words is derived from their context, including the purpose of the provision and the broader legislative framework.
2. Purpose: The purpose of the legislation is paramount. The court must ascertain the purpose of the provision and interpret the text in a manner that best gives effect to that purpose.
3. Sensible Construction: The interpretation should avoid absurd or unreasonable results. The court should adopt a sensible construction that aligns with the purpose and context of the legislation.

Without going into an in-depth exploration, it appears fairly likely to the authors that a person’s image would fall within the definition of “personal information” where a purposive interpretation is applied, because the broadly stated purpose of POPI is to protect information of human beings such that personal information is not used to cause people harm (such as in cases of identify fraud, or derogatory comments of a person’s image on Facebook), or to enable others to benefit commercially or otherwise from the use of that information without the consent of the owner of that information (such as where a person’s contact information is sold to a marketing company for the purpose of cold-calling telemarking sales without that person’s permission of where a person’s biometrics are used to access a person’s bank account without their permission).

Consider the following example. Even where a person’s face is not registered as a piece of biometric data (for instance, where the image of a person’s face has been captured in a passport photograph) that image can be used without that person’s permission by other people to harm the owner of that information. A person’s passport photograph could be reproduced without consent, in order to commit identity fraud. It could also be used for a variety of other unlawful reasons, such as to gain unlawful access to a person’s pension or SASSA benefits, insurance benefits, medical aid benefits, or otherwise to commit identify fraud in various other ways. If POPI did not protect a person’s image as “personal information”, then the use of this type of information by criminals would not constitute an offence under POPI (although it might still constitute a criminal offence – namely fraud – under common law).

If we apply common sense to the question, it seems obvious that a person’s image (particularly of their face, or of any of their features from which they could be uniquely identified, such as tattoo, birthmark, or any other uniquely identifiable characteristic perhaps including even an accent, bald patch, disfigurement, or scar) could be used to harm people if utilized without their permission for the wrong reasons.

RIGHTS TO DIGNITY

Approaching the question from a different perspective, one can ask whether a person’s image is protected by their right to dignity (or rather, whether the fact that a person’s image can be utilized to positively or negatively impact on their dignity) has any bearing on the interpretation exercise we are attempting to do above.

Applying common sense to the question, it feels intuitive that the answer must be “yes”, because a person’s image is something that has the ability to impact significantly on their personal sense of dignity, depending on how that image is displayed. If it displayed in a positive manner, together with words or where the setting of the image is positive, this might positively impact a person’s dignity. The opposite would apply if a person’s image were depicted with derogatory words or in a derogatory setting – this might diminish a person’s sense of self-worth and dignity. The right to dignity is protected in section 10 of the Constitution.

RIGHTS TO PRIVACY

The right to privacy is guaranteed in the Constitution.⁵ It therefore comes without question that many people would expect that the same is protected under POPI. Right to privacy is often referred to as the right to be left alone. The capturing or use of someone’s photographs without their consent is directly infringing upon this right.

CASE LAW

Perhaps to our surprise, the question of images protection under POPI has never been the subject of a court’s determination (at least as far as the authors could determine through reported cases and publicly available case reports). Before POPI, however, our courts protected a person’s image through the rights to dignity and privacy in the Constitution.

LE ROUX V DEY [2011] ZACC 4

In this landmark case, the Constitutional Court addressed the issue of dignity in the context of a manipulated image. The case involved a digitally altered photograph of a school principal and deputy principal, which was circulated among students. The court held that the image violated the dignity of the individuals depicted, emphasizing that the right to dignity includes protection against defamatory or degrading images.

EXCEPTIONS TO THE RULE – WHEN WILL A PERSONS’ PERSONAL INFORMATION NOT BE PROTECTED BY POPI

In the recent case of Botha V Smuts, Mr Botha had a farm, and he used traps in order to hunt, capture and/or kill the baboons, porcupines, and other vermin. Mr Smuts,⁶ a wildlife conservationist and activist, received the pictures of dead caged animals (baboon and porcupine) from Mr Botha and he was offended by them. He confronted Mr Botha who noted in his defence that he had a valid hunting permit. Mr Smuts then posted the picture of dead animals and the farm on a Facebook page together with the picture of Mr Botha holding his six-months-old daughter.

Additionally, he posted a Google search location of Mr Botha’s business and his home. Unhappy about the post and its publicity, Mr Botha instituted an urgent application in the High Court of the Eastern Cape Division interdicting Mr Smuts from further posts of the same/a similar nature and for the deletion of the photographs and other information he regarded as offensive. The picture of Mr Botha and his daughter was removed just before the matter was heard, but the pictures of the farm and dead animals remained posted online.

The court held in this case that the information of Mr Botha’s farm’s location (and including the pictures of his farm associating it with dead animals) constituted information which had already been made public by him. The court held that the information pertaining to the farm’s cadastral (registered) information and its location was already in the public realm, having been put there by Mr Botha himself on the internet

From this case, we can see that the court used POPI for interpretation in applying limitation in terms of section 12 (2) that states that there is no protection in an event that the information was already made public record.⁷

ANALYSIS AND CONCLUSION

It appears to the authors that a person’s image (particularly a person’s face or any part of their image that has unique characteristics that they can be identified from) are, or at least ought to be, considered “personal information” within the meaning of the definition in section 1 of POPI.

Whether you can use POPI as a defense for protection against the unlawful use and/or dissemination of someone else’s image, however, is a different question entirely. Taking into consideration the widespread use of social media, and the fact that almost everyone has voluntarily uploaded or permitted their pictures to be uploaded online somewhere for the public to see, it is unlikely that a person will be able to protect their image against the use or dissemination thereof without their consent where they have uploaded it themselves or allowed it to be uploaded publicly by others. Such information will already be in the public realm and therefore not protected under the definition of “personal information” in terms of POPI.

This does not necessary mean, however, that the unlawful use of a person’s image without their consent will not constitute an offence in terms of other laws (in particular where their image is used to perpetrate identity fraud). Identify fraud remains punishable under common law.