Authored By: Keamogetswe Motshabi
- Introduction: Constitutional Imperatives and the Core Thesis
The right to privacy is guaranteed by Section 14 of the Constitution of the Republic of South Africa Act 108 of 1996. This right protects individuals from the unauthorised collection, storage and broadcasting of their personal data.[1] Freedom of expression, which is protected by Section 16 of the Constitution, brings a balance against the constitutional right to privacy.[2][3] In addition, the Protection of Personal Information Act 4 of 2013 (POPIA) codifies and gives operational effect to this constitutional guarantee by regulating how personal identifiable information (PII) is processed.[4]
The accessibility of online communication has created new tensions in this context. By default, WhatsApp displays a user’s cellphone number and profile picture to all members of a group chat. Group administrators effectively determine the purpose and means of processing within the group and have the technical ability to remove harmful content at any time. As a result, wilful blindness to the unauthorised exposure of personal information or to defamatory posts may amount to an actionable omission, and administrators may incur liability under POPIA and the common law of delict.
- Constitutional Balancing and Mechanics of POPIA
South Africa’s data privacy framework is anchored firmly in the Bill of Rights. Section 14 of the Constitution guarantees everyone the right to privacy, while Section 16 protects the right to freedom of expression.[5] Any limitation on digital data privacy and freedom of expression is governed by Section 36 of the Constitution.[6] A limitation of either right is only constitutional if it is reasonable and justifiable in an open and democratic society based on human dignity, equality and freedom.[7] POPIA is the framework used to find balance by setting out the constitutional parameters for when information processing becomes an unjustified invasion of privacy.[8]
The purpose of POPIA is to give effect to the constitutional right to privacy by safeguarding personal information, while balancing the right against competing interests like the free flow of information and economic development.[9][10]
Chapter 3, section 11 of the Act provides eight conditions for lawful processing. Namely,[11]
- Accountability: the admin must ensure that all POPIA conditions are met.
- Processing limitations: data must be processed lawfully and minimally.[12]
- Purpose specification: data must be collected for an explicitly defined purpose.[13]
- Further processing limitation: the admin cannot repurpose the group’s contact list for something else.[14]
- Information quality: the processed data must be accurate and up to date.
- Openness: the admin must maintain transparency, ensuring everyone knows the purpose of the group.
- Security safeguards: the admin must take reasonable measures to secure the group against data breaches.[15]
- Data subject participation: members retain the right to request access to their data or demand that their information be deleted from the system.
- Exemptions and key questions
WhatsApp users’ main defence is the Section 6(1)(a) safe harbour, which grants an absolute exemption for processing that is done during a purely personal or household activity.[16][17] This means that family chats, private social groups and casual friend networks need not concern themselves with POPIA compliance.
This exemption raises the fundamental legal issue around which this entire article revolves: What is the limit of the “purely personal” and, at what point does a community, civic, or commercial interest turn a regular group admin into a largely responsible party?
The moment a group chat serves a civic duty, the household exemption shatters and the administrator assumes full legal liability under POPIA.
3.1 Case Law and practical application
Traditionally, online liability needed an omni-positive act or some actual publication of PII. South African case law has moved towards liability by omission.
Isparata v Richter and Another 2013 (6) SA 529 (GNP), the case was heard in the North Gauteng High Court and considered whether a social media user can be liable for defamatory comments if the comments were published by a third party. The High Court held that if a user is aware of the unlawful nature of the post, is identified in the post, and could technically disassociate themselves from the post but does not do so, they can be held liable. Thus, in failing to act, the party by omission effectively ratifies and adopts the statement and is part of the “chain of publication”.[18]
Most importantly, Meta granted group admins the unilateral ability to “Delete for Everyone” any messages posted by any member within the group, and to remove non-compliant members.[19] As a result, this inaction means the admin fails their common law duty of care, and, thus, makes them liable under POPIA and civil liability under delict.[20][21]
3.2 Application in Community spaces
The real-world implications of this passive liability are often observed in community management settings, such as the neighbourhood watch. This phenomenon echoes the broader trends of digital governance observed in administrative domains, where informal communication platforms are expected to adhere strictly to legal privacy protection once they leave their domicile. The admin becomes an active participant in the illegal processing of the data the moment he/she leaves unauthorised personal financial disclosure active in the group.
- The flaws of the regulatory framework
The primary systemic issue within this regulatory framework is the unfair burden it places on ordinary individuals, who cannot afford to hire dedicated Information Officers, employ legal counsel and build secure databases.
The law creates an excessive mismatch by applying these rules to an ordinary citizen who’s just trying to manage a WhatsApp group. The layman is not literate enough to determine if a member’s post goes beyond the Section 16-protected expression of opinion and into the POPIA actionable data breach. Therefore, admins may opt to disband important community groups rather than assume the legal risks of running them.
From a technical point of view, treating a WhatsApp group administrator as a “Responsible Party” disregards the functionality of the application. In many cases, even if the admin has used the “Delete for Everyone” option, complete data protection is practically impossible because of the modifications that can be made by anyone. For instance, WhatsApp GB does not execute the “Delete for Everyone” option, leaving deleted text and media permanently on a user’s device. Moreover, group members can instantly take screenshots and forward them to other members before the admin can have the opportunity to delete the defamatory text.
Because of the app’s design, an administrator cannot be certain that a message has been permanently deleted or prevent its further disclosure. It is therefore difficult to justify holding an administrator legally responsible for the entire “chain of publication”.
4.1 Household Exemption Interpretations
Section 6(1)(a) of POPIA excludes processing carried out during a purely personal or household activity.[22][23] The Information Regulator does not give clear guidance on the limitations.[24] For example, when a group of friends uses the group chat to plan a weekend away, the group would clearly be exempted. On the other hand, where the same group of friends use the same group chat to collect security funds for their area, the group is instantly not exempted.
Undoubtedly, the regulator’s thinking is based on a binary approach to communication. It makes no allowance for the realities of hybrid digital spaces where personal, social and semi-professional conversations can coexist.
4.2 Reality of Enforcement
The current enforcement regime under POPIA is one of regulatory illusion. The Information Regulator does not have the budget or technology to monitor the millions of informal WhatsApp groups. Enforcement is therefore complaint-driven. The law imposes unscalable legal liabilities on ordinary people without providing a practical, scalable means of protecting real data privacy online.
- Conclusion and Recommendations: The Future of Digital Governance
The incorporation of the Protection of Personal Information Act into the common law of delict has fundamentally changed the legal liabilities of the average internet user. As this article has shown, WhatsApp group administrators can no longer regard themselves as mere group hosts. The transformation in technology and the judicial precedent in Isparata has changed group administrators into statutory “Responsible Parties” who owe a positive duty of care to their group members.[25] The admin becomes personally liable for data leaks and defamatory statements without active chat moderation.
Consequently, the law must evolve to bridge the gap between strict statutory rules and practical communication. “The Information Regulator must move away from a corporate-centric approach and issue a formal, practical Code of Conduct specifically tailored for digital communication platforms.” [26]
It should be noted that, for as long as the regulators have not provided clear, realistic rules, considering hybrid social networks and app limitations, admins should protect themselves by taking an overly cautious approach to moderation and management. They can do so by posting a join invite link, letting those who want to join exercise their right to join on their own terms; setting boundaries and closely monitoring the group chat and using “Delete for Everyone” to eradicate any unauthorised personal information or slander.
In conclusion, digital privacy cannot rely solely on the state or big tech platforms. By taking on the role, ordinary citizens can safeguard their digital spaces from serious legal and financial consequences.
Bibliography
Legislation
Constitution of the Republic of South Africa, 1996.
Protection of Personal Information Act 4 of 2013.
Cases
Isparta v Richter and Another (22452/12) [2013] ZAGPPHC 243, 2013 (6) SA 529 (GNP).
Secondary Sources
Information Regulator (South Africa), ‘Enforcement Notices and Settlement Framework’ (2024) https://inforegulator.org.za accessed 3 August 2026
Newcastle Municipality, ‘What you need to know about POPIA and WhatsApp groups’ (2021) https://newcastle.gov.org.za accessed 3 August 2026.
Roos A and Slabbert M, ‘Defamation on Facebook: Isparta v Richter 2013 6 SA 529 (GP)’ (2014) 17 Potchefstroom Electronic Law Journal 2845.
[1] Constitution of the Republic of South Africa, 1996 s 14.
[2] Constitution of the Republic of South Africa, 1996 s 16.
[3] Section 16 and 14 of the Constitution of the Republic of South Africa, 1996.
[4] Protection of Personal Information Act 4 of 2013.
[5] The protection against the unauthorised collection, storage and dissemination of personal communication and data; the right to receive and impart information.
[6] Section 36 of the Constitution of the Republic of South Africa, 1996 – the Limitation clause.
[7] Constitution of the Republic of South Africa, 1996 s 36.
[8] POPIA, Section 2.
[9] Protection of Personal Information Act 4 of 2013 s 2.
[10] POPIA, Section 2.
[11] Protection of Personal Information Act 4 of 2013 ch 3.
[12] Section 11(1)(a) requires the explicit, voluntary and informed consent of the user.
[13] POPIA, Section 13.
[14] POPIA, Section 15.
[15] POPIA, Section 19.
[16] Protection of Personal Information Act 4 of 2013 s 6(1)(a).
[17] POPIA, Section 6(1)(a).
[18] Isparta v Richter and Another (22452/12) [2013] ZAGPPHC 243, 2013 (6) SA 529 (GNP).
[19] POPIA Chapter 3, Section 11.
[20] Isparta v Richter and Another (22452/12) [2013] ZAGPPHC 243, 2013 (6) SA 529 (GNP).
[21] Isparata v Richter and Another 2013 (6) SA 529 (GNP), 17.
[22] Protection of Personal Information Act 4 of 2013 s 6(1)(a).
[23] POPIA Chapter 3, Section 6(1)(a).
[24] Information Regulator of South Africa, ‘Enforcement Notices and Settlement Frameworks’ (2014) https://inforefulator.org.za .
[25] A Roos and M Slabbert, ‘Defamation on Facebook: Isparta v Richter 2013 6 SA 529 (GP)’ (2014) 17 Potchefstroom Electronic Law Journal 2845.
[26] Newcastle Municipality, ‘What you need to know about POPIA and WhatsApp groups’ (2021) https://newcastle.gov.za .
