Information Regulator acts on alleged matric results data breach

The Information Regulator (IR) said it has written to the Department of Basic Education (DBE) to request information regarding the alleged leak of the 2024 matric results.

Johannesburg-based company Edumarks allegedly enticed matric learners over the weekend to pay R100 to get their results early.

Edumarks results of at least one learner differed from the matric results released by the DBE.

The DBE on Monday confirmed the possible breach, but assured South Africans that it would not affect the “integrity of the results”.

Concerned

The regulator said it became aware of social media posts alleging that matric results were being made available to the public, ahead of the official release of the results.

“The regulator is concerned that the personal information of data subjects may have been unlawfully accessed and compromised. Therefore, the regulator wrote to the Department of Basic Education to request confirmation of the incident and provide it with more information by the end of business on Tuesday 14 January 2025.”

“The Regulator cannot yet address the specifics of the recent allegations of a security compromise on personal information of learners held by the DBE until the DBE has fulfilled its obligations under Section 22 of the Protection of Personal Information Act 4 of 2013 (Popia),” it said.

ALSO READ: WATCH: Basic education ropes in Hawks, State Security to probe matric results ‘breach’

Popia Act

Section 22 of Popia states that when a responsible party has suffered a security compromise, the public or private body must notify the regulator within a reasonable time.

It is also required that the responsible party, such as the DBE, notify the Information Regulator and affected data subjects of any security compromise it has experienced.

“The Regulator has not yet received such a notification from the DBE.”

Investigation

DBE Minister Siviwe Gwarube said the State Security Agency and the Hawks will join the department in investigating the leak.

Gwarube said the possible breach of the matric results is “extremely serious.”

“If there has been a breach in our system, there are two processes we need to follow. We need to determine as the DBE — are our systems secure and airtight enough? As you recall, once we compile the results, we have to share our results with certain stakeholders so that they can start getting ready with their processes. So there is a real possibility there may have been a breach in that process,” Gwarube said.

Gwarube said the matric results have been “absolutely insulated” from any manipulation, adding that they are confident that the law enforcement agencies are moving at pace to make sure that an arrest is made.

Regulator vs DBE

Last week, the regulator lost an interdict bid to have the matric results published in newspapers.

The regulator wanted to block the release of the National Senior Certificate (NSC) examination results in newspapers, citing concerns about a violation of students’ right to privacy.

The DBE opposed the application, which was heard on Tuesday.

The regulator dragged the DBE to court over the department’s alleged defiance against an enforcement notice issued in November last year.

The department faced a R5 million fine for breaching the Popia Act.

ALSO READ: WATCH: Matric results for just R100? Outcry over ‘leak’ of marks