Authored By: Khanyisile Simnikiwe Mguda
University of South Africa (UNISA)
Introduction
Recent SA commentary has described a scenario now familiar to many shoppers: entering a mall in Durban, Cape Town or Johannesburg where a person’s face is scanned, logged, and analysed without their knowledge or consent, while gated residential estates quietly collect the biometric details which include but not limited to residents, workers and visitors with no transparency about who controls that data or how long it is retained.[1] The same commentary draws a deliberately provocative parallel between biometric surveillance and apartheid-era pass laws.[2] Whatever view one takes of that historical analogy, the underlying legal claim is considerably narrower and easier to test: the facial images constitute “special PI” under the Protection of Personal Information Act,[3] the processing of which is prohibited save in narrow circumstances, yet private and public actors alike are processing this data at scale without consent, disclosure, or, in the case of policing, any governing legislation at all.[4]
This article argues that POPIA’s special PI regime is textually adequate but practically unenforced, that the disproportionate effort exception in s 27 is operating as an informal substitute for consent, and that SA’s only reported instance of judicial engagement with facial-recognition-adjacent surveillance left the underlying privacy question expressly undecided.[5] It proceeds by outlining the statutory framework, presenting documentary, judicial, and empirical evidence of the resulting compliance gap, and proposing an existing regulatory mechanism capable of closing it.
The Legal Framework
The statutory protections governing data privacy in SA are fundamentally anchored in section 14 of the Constitution[6] which guarantees everyone the right to privacy. POPIA gives legislative effect to the constitutional mandate to safeguard personal data and protect fundamental rights.[7] Within this framework, it classifies biometric information including facial recognition data as special PI generally prohibited from processing.[8] Section 27 permits processing only in narrow circumstances: where the data subject has consented, where processing is necessary to establish or defend a right, or where obtaining consent is impossible or would not involve a disproportionate effort, provided sufficient guarantees exist that the processing will not unduly harm the data subject’s privacy.[9] Section 10 imposes a further, independent constraint: PI may be collected only to the extent that it is adequate, relevant, and not excessive for the purpose pursued.
A continuous, real-time scan of every face entering a shopping centre, estate, or public street sits uneasily with this minimality requirement.[10] By comparison, the GDPR prohibits processing of biometric data used to uniquely identify a person as a general rule, subject to similarly narrow exceptions, but goes further than POPIA in one crucial respect: it requires a data controller to carry out a data protection impact assessment, and where relevant to consult the supervisory authority, before deploying any technology likely to pose a high risk to individuals’ rights, a category that expressly capture facial recognition.[11] POPIA imposes no equivalent express duty.[12] Tellingly, the DHA’s own draft Official Identity Management Policy acknowledged that its information systems security framework is misaligned with POPIA and that POPIA is not fully enforceable.[13] It went further to recommend the establishment of independent oversight with binding legal powers to secure compliance, an admission from the very department tasked with building SA’s central biometric database that this structural gap is not merely theoretical.[14]
III. The Compliance Gap in Practice, and the Case for Regulatory Guidance
The absence of enforcement extends beyond the private sector into policing itself.[15] Despite the SA Police Service’s longstanding push for direct access to biometric records in the DHA’s Automated Biometric Information System, a parallel expansion of facial recognition infrastructure has been underway.[16] By February 2024, a provincial partnership had already equipped nearly 7,000 surveillance cameras across Gauteng with facial recognition capability, evidence of a substantial and accelerating surveillance architecture.[17] SA has no legislation specifically regulating police use of facial recognition technology.[18] When asked how it would regulate facial recognition searches, the police service’s own answer referred only to a general statutory power to run comparative searches against government-held databases, with no reference to any facial-recognition-specific safeguard.[19]
SA courts have had only one reported opportunity to engage with the underlying privacy questions. In Vumacam (Pty) Ltd v Johannesburg Roads Agency,[20] a municipal roads agency attempted to block the rollout of a private surveillance camera network on the ground that it amounted to commercialised mass surveillance of members of the public.[21] The High Court found for the camera operator, but only because the roads agency’s statutory mandate extended to protecting road infrastructure, not adjudicating human rights.[22] The court expressly declined to rule on the underlying privacy argument, leaving it open for a properly constituted future challenge.[23] Four years on, no such challenge has been brought, and no legislation has filled the gap.[24] The same pattern recurs at institutional scale even where accountability structures are considerably stronger: a 2025 survey of 106 students at a private SA higher education institution found a strong correlation between concern about privacy and dissatisfaction with the information the institution provided about how facial recognition data was collected, stored and used.[25]
If a university struggles to satisfy POPIA’s Openness condition, and if a court has already signalled that the underlying privacy question remains live but untested, the case for proactive regulatory intervention is considerably stronger than for reactive litigation.[26] Comparative legal scholarship examining United States state-level biometric statutes alongside the GDPR and the EU Artificial Intelligence Act[27] proposes a workable model: mandatory licensing of facial recognition operators, tiered consent requirements, periodic compliance audits, and scaled to the severity of the violation.[28] Chapter 7 of the POPIA already empowers the Information Regulator to issue and approve codes of conducts for defined categories of responsible party, whether public or private.[29] A binding code covering retail, residential estate, campus, and municipal-partnership deployments of facial recognition requiring signage, a mandatory privacy impact assessment before deployment, published retention limits, and a narrowly supervised reading of the disproportionate-effort exception would close the gap the DHA has itself identified, without waiting for the test case the Vumacam litigation left unresolved.[30]
Conclusion
The challenge for SA is not the adequacy of POPIA’s statutory text but the absence of an enforcement mechanism capable of constraining biometric surveillance before deployment. POPIA’s special PI regime already prohibits processing in principle and requires openness and minimality, yet these safeguards remain largely theoretical without a framework to operationalise them. Comparative experience under the GDPR demonstrates the value of mandatory pre-deployment impact assessments and supervisory oversight. SA does not need to amend POPIA to achieve this effect, Chapter 7 empowers the Information Regulator to approve binding codes of conduct, and such a code could embed a licensing, audit, and impact assessment regime tailored to facial recognition. The gap, therefore, is one of enforcement architecture rather than legislative design. Unless the Regulator intervenes decisively, biometric infrastructure will continue to expand more rapidly than the law intended to restrain it.
Bibliography
Academic Textbooks
DP van der Merwe and others, Information and Communications Technology Law (3rd edn, LexisNexis 2021)
Case Law
Vumacam (Pty) Ltd v Johannesburg Roads Agency (14867/20) [2020] ZAGPJHC 186 (20 August 2020)
Journal Articles
Nozipho Nhlapho and Brian Maodza, ‘Privacy Concerns in Facial Recognition Technology at a Higher Private Education Institution in South Africa’ (2025) SPCSJ 10
Saeed Al Ali and others, ‘Facial Recognition Technology: Protecting Biometric Privacy in the Digital Age’ (2026) 18 J. Leg. Aff. Dispute Resolut. Eng. Constr. 31
Legislation
The Constitution of the Republic of South Africa, 1996
Protection of Personal Information Act 4 of 2013
Online material
Cliffe Dekker Hofmeyer, ‘Administrative bodies: Stay in your lane!’ (CDH, 20 October 2020) <https://www.cliffedekkerhofmeyr.com/en/news/publications/2020/dispute/Dispute-Resolution-Alert-20-October-2020-Administrative-bodies-Stay-in-your-lane-.html> accessed 8 July 2026’
Sõzarn Bardy, ‘South Africa Is Sleepwalking into Becoming a Surveillance State’ (Mail & Guardian, 20 August 2025) <https://mg.co.za/thought-leader/2025-08-20-south-africa-is-sleepwalking-into-becoming-a-surveillance-state/> accessed 08 July 2026
Sadia Rizvi, ‘Digital Innovation and Its Impact on Privacy Law’ (July 2020) < https://www.ppmattorneys.co.za/digital-innovation-and-its-impact-on-privacy-law/?print=pdf> accessed 08 July 2026
Reports
Devon Turner and Julia Khan, ‘The Use of Facial Recognition Technology in South Africa’ (Legal Resource Centre, August 2024)
[1] Sõzarn Bardy, ‘South Africa Is Sleepwalking into Becoming a Surveillance State’ (Mail & Guardian, 20 August 2025) <https://mg.co.za/thought-leader/2025-08-20-south-africa-is-sleepwalking-into-becoming-a-surveillance-state/> accessed 08 July 2026.
[2] Bardy, ‘South Africa Is Sleepwalking into Becoming a Surveillance State’.
[3] 4 of 2013 (hereinafter referred to as ‘POPIA’).
[4] Sections 1, 23 and 26 of POPIA.
[5] Bardy, ‘South Africa Is Sleepwalking into Becoming a Surveillance State’; Devon Turner and Julia Khan, ‘The Use of Facial Recognition Technology in South Africa’ (Legal Resource Centre, August 2024) 21.
[6] The Constitution of the Republic of South Africa, 1996.
[7] Sadia Rizvi, ‘Digital Innovation and Its Impact on Privacy Law’ (July 2020) < https://www.ppmattorneys.co.za/digital-innovation-and-its-impact-on-privacy-law/?print=pdf> accessed 08 July 2026.
[8] Section 26 of POPIA.
[9] Section 27(1) of POPIA.
[10] Bardy, ‘South Africa Is Sleepwalking into Becoming a Surveillance State’.
[11] DP van der Merwe and others, Information and Communications Technology Law (3rd edn, LexisNexis 2021) 438-439 discussing Article 35(1) of the GDPR; Saeed Al Ali and others, ‘Facial Recognition Technology: Protecting Biometric Privacy in the Digital Age’ (2026) 18 J. Leg. Aff. Dispute Resolut. Eng. Constr. 31, 35-36.
[12] Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 12.
[13] Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 12.
[14] Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 12.
[15] Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 5.
[16] Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 10-14.
[17] Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 8-12 and 14.
[18] Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 10-14.
[19] Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 12.
[20] (14867/20) [2020] ZAGPJHC 186 (20 August 2020) (hereinafter referred to as ‘Vumacam’).
[21] Cliffe Dekker Hofmeyer, ‘Administrative bodies: Stay in your lane!’ (CDH, 20 October 2020) <https://www.cliffedekkerhofmeyr.com/en/news/publications/2020/dispute/Dispute-Resolution-Alert-20-October-2020-Administrative-bodies-Stay-in-your-lane-.html> accessed 8 July 2026; Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 13, 14 and 16.
[22] Cliffe Dekker Hofmeyer, ‘Administrative bodies: Stay in your lane!’; Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 20.
[23] Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 20.
[24] Nozipho Nhlapho and Brian Maodza, ‘Privacy Concerns in Facial Recognition Technology at a Higher Private Education Institution in South Africa’ (2025) SPCSJ 10, 11.
[25] Nhlapho and Maodza, ‘Privacy Concerns in Facial Recognition Technology at a Higher Private Education Institution in South Africa’ 14.
[26] Nhlapho and Maodza, ‘Privacy Concerns in Facial Recognition Technology at a Higher Private Education Institution in South Africa’ 12; Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 19.
[27] Regulation (EU) 2024/1689.
[28] Al Ali and others, ‘Facial Recognition Technology: Protecting Biometric Privacy in the Digital Age’ 31 and 34.
[29] Sections 60-68 of POPIA.
[30] Nhlapho and Maodza, ‘Privacy Concerns in Facial Recognition Technology at a Higher Private Education Institution in South Africa’ 14; Turner and Khan, ‘The Use of Facial Recognition Technology in South Africa’ 21 and Al Ali and others, ‘Facial Recognition Technology: Protecting Biometric Privacy in the Digital Age’ 36-37.
