South Africa's Information Regulator has spent nearly two years trying to stop newspapers from publishing matric results next to learners' examination numbers. On July 6, 2026, having lost twice in the Gauteng High Court, it applied directly to the Supreme Court of Appeal (SCA) for leave to press the fight a third time. The case is now a live test of how far South Africa's young data protection regime should reach into a decades-old, low-harm publication practice.
A fight born from a fine
The dispute began on November 6, 2024, when the Regulator issued an Enforcement Notice ordering the Department of Basic Education (DBE) to stop publishing National Senior Certificate results in newspapers unless it first obtained every matriculant's consent. When the department declined, the Regulator followed with an Infringement Notice carrying a R5-million fine and launched urgent court proceedings to block publication of the 2025 results altogether.
The DBE and intervening parties, including the civil-rights lobby group AfriForum, argued that publishing results by exam number — a practice going back decades — lets learners check their own marks without exposing anyone else's, since an exam number reveals nothing about who a person is unless matched against a separate, non-public class list.
Two High Court defeats
A full bench of the Gauteng High Court in Pretoria sided with the department on December 12, 2025, setting aside both the Enforcement Notice and the Infringement Notice. Judge Omphemetse Mooki held that an examination number, standing alone, does not make a learner identifiable and therefore is not "personal information" as POPIA defines it. He was unsparing about the Regulator's argument that results could be re-identified through cross-referencing, calling it "fanciful" and "akin to a poorly constructed thought experiment," and noting the Regulator had produced no empirical evidence that this actually happens.
The Regulator sought leave to appeal that ruling to the SCA. On June 3, 2026, the same panel refused, finding no "compelling reasons" and no reasonable prospect that an appeal would succeed. AfriForum's Alana Bailey called it "a victory for the disclosure of information that is in the public interest." Undeterred, the Regulator used the one route still open to it — petitioning the SCA directly for leave, bypassing the High Court's refusal.
The regulator's case, steelmanned
The Regulator's underlying concern is not frivolous. POPIA, like the EU's GDPR, was written to prevent organisations from sidestepping data protection duties by simply stripping out names while leaving a data subject practically identifiable through other means. As Werksmans Attorneys noted in a June 9, 2026 analysis of the ruling, pseudonymised data remains personal data under both the GDPR and UK GDPR precisely because coded identifiers can often be reversed by someone holding the right key — in this case, a class list, a school register, or simply a learner's own knowledge of their exam number. If South African courts read "identifiable" too narrowly, the same logic could let any body swap names for reference numbers and claim exemption from POPIA entirely, hollowing out the statute's core protection. That is a real institutional risk, not a made-up one, and it is why the Information Regulator exists.
Why the courts have the better argument
But the High Court did not adopt a blanket reading — it applied a specific, evidence-based test: whether a person could identify a learner "without any particular diligence" and "without more." On the facts before it, the Regulator offered no proof that this practice had ever led to an actual privacy harm in the many years newspapers have run matric results this way. Proportionate regulation should track demonstrated risk, not hypothetical worst cases, and a fine of R5 million against a public department — money that comes out of the education budget — for continuing a transparency practice the Regulator itself could not show had hurt anyone is a poor use of enforcement power. Matric results also serve a genuine public interest: they let communities, schools and researchers track educational outcomes, and losing that visibility has real social cost.
The Regulator would do more for South Africans' privacy by directing its limited litigation budget at higher-risk practices — unconsented biometric collection, opaque AI-driven profiling, or unlawful cross-border data transfers — where the identifiability question is not remotely close. Pursuing a third bite at the same argument, after two full-bench losses, also risks the opposite of its goal: an SCA loss would harden precedent on the narrow-identifiability test the Regulator is trying to overturn, potentially making it harder to win genuinely borderline cases later.
What's at stake
If the SCA grants leave, the case will become South Africa's clearest appellate statement yet on what "identifiable" means under POPIA — with direct relevance to every organisation that publishes coded, de-identified, or pseudonymised data. Until then, the 2025 and future NSC results keep publishing by exam number, and the Regulator's credibility rests on whether the country's second-highest court finds enough in this record to even hear the case.