Picture source: Gallo Images/Getty
By Paula Gabriel
Revenge pornography is the act of distributing intimate photography without the consent of the individual being depicted (S Hinduja ‘Social Media, Cyberbullying, and Online Safety Glossary’ https://cyberbullying.org, accessed 2-3-2020). This term would theoretically include the instance where someone accidentally uploads a sexually explicit image onto a social media platform without the subject’s consent, even where no harm was intended.
The term ‘revenge pornography’, however, suggests an element of personal vengeance, which is misleading, since perpetrators may in fact be motivated by other factors, such as the desire for profit or entertainment (MA Franks, ‘“Revenge Porn” Reform: A view from the front lines’ (2017) 69 Florida Law Review 1251 at 1257 – 1258). The alternative term ‘non-consensual pornography’ is more accurate (this article uses the terms interchangeably). The problem with many of the remedies currently available to victims of revenge pornography is the time, costs and complexity involved in court proceedings, by which time a victim’s reputation may be irrevocably destroyed.
Existing criminal law remedies include a charge of crimen injuria, criminal defamation, or even extortion, while civil remedies include damages for defamation or an interdict based on a breach of copyright (where the victim took the photograph themselves). The Protection from Harassment Act 17 of 2011 also entitles a victim of revenge pornography to apply for a protection order, which is coupled with a suspended warrant of arrest.
The Films and Publications Amendment Act 11 of 2019 (the FPAA) – which has yet to come into effect – makes it a criminal offence to expose private sexual photographs and films in any medium, without prior consent of the individual in the photographs and films, and where such distribution is done with the intention to cause the said individual harm. While the criminalisation of the distribution of revenge pornography is certainly a positive development, any remedies in terms of the FPAA remain dependant on the efficacy of the criminal justice system.
This article examines the nature and extent to which the Protection of Personal Information Act 4 of 2013 (POPI) affords victims of revenge pornography with alternative and more immediate relief, which may be sought in addition to existing remedies.
The scope and application of POPI
The 1995 EU Data Protection Directive 95/46/EC has had a profound impact on data privacy laws around the world. It was replaced in 2016 by the General Data Protection Regulation (EU) 2016/679 (GDPR), which attempts to harmonise data privacy laws across Europe and provides for a useful comparison when analysing the provisions of POPI.
Definitions
POPI defines ‘personal information’ as information ‘relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person’. While a photograph or video is not specifically listed in the definition, the Court of Justice of the European Union held, in Frantisek Rynes v Úrad Pro Ochranu Osobnich Údaju (C-212/13, 11-12-2014) that ‘personal data’ as defined in the 1995 Data Protection Directive also referred to the image of a person by a camera because it makes it possible to identify the person concerned.
‘Processing’ is defined in POPI to mean ‘any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including –
(a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
(b) dissemination by means of transmission, distribution or making available in any other form; or
(c) merging, linking, as well as restriction, degradation, erasure or destruction of information’.
A ‘responsible party’ is defined as a ‘public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information’.
I submit that the distribution of revenge pornography on the Internet would classify as processing of personal information where the perpetrator is the responsible party as defined in POPI.
The processing of personal information is excluded from the ambit of POPI in certain instances, but I submit that none of these exemptions apply to the distribution of revenge pornography and that POPI will, therefore, find application.
A complaint to the regulator
In terms of s 74(1) of POPI any person may lodge a complaint with the Information Regulator where their personal information has been processed in a manner that is –
For purposes of investigating the matter the Regulator will have the same powers as a High Court and may summon and enforce the appearance of persons and compel them to give evidence on oath and to produce any records necessary to investigate the complaint (s 81).
Section 81(d) of POPI empowers the Regulator for purposes of an investigation, at any reasonable time, to enter and search any premises occupied by a responsible party. Where access is unreasonably refused, or where the occupier unreasonably refuses to comply with a request by the Regulator, the Regulator may apply to a judge or a magistrate for a search warrant.
A warrant issued under s 82(1) authorises any of the Regulator’s members or staff to enter the premises identified in the warrant and to search, inspect, examine, test and seize any equipment, which was used for the processing of personal information, and to seize any evidence found there. The judge or magistrate, before granting a warrant, must be satisfied that the Regulator has given seven days’ notice to the occupier of the premises demanding access and that access was unreasonably refused, or that the occupier refused to cooperate with the Regulator.
The seven-day notice period will not apply, however, if the judge or magistrate is satisfied that the case is one of urgency, or that compliance with that subsection would defeat the object of the search. The seven-day notice period will hopefully be waived in cases involving revenge pornography.
Issuing an enforcement notice
After completing an investigation, the Regulator may refer the complaint to the Enforcement Committee (s 92), which is an independent body not subject to control by the Regulator. The Enforcement Committee must consider all matters referred to it by the Regulator and may make a recommendation to the Regulator (s 93). After having considered a recommendation made by the Enforcement Committee the Regulator may serve the responsible party with an enforcement notice requiring them to take specified steps and to stop processing personal information (s 95). Where the Regulator considers that an enforcement notice should be complied with as a matter of urgency the compliance notice may stipulate a period of three days within which to comply.
I suggest that a perpetrator – who has distributed revenge pornography – could be required, in terms of an enforcement notice issued by the Regulator, to remove the pornographic material from the website or social media platform in question.
It is unclear how long it will take from lodging a complaint with the Regulator until an enforcement notice is issued. POPI and the regulations in terms thereof also do not stipulate any fees involved in lodging a complaint with the regulator. Nevertheless, the process is likely to be cheaper than obtaining an interdict on an urgent basis, and it remains to be seen which remedy will be faster and more effective.
An administrative fine or criminal charges?
Sections 100 and 103, read with s 107 of POPI make it an offence for a responsible party not to comply with an enforcement notice or to obstruct the Regulator in the performance of its functions. These offences carry a penalty of imprisonment of up to ten years or a fine and remain governed by the principles of criminal law.
However, s 109 provides for the imposition of an administrative fine by the Regulator as an alternative to criminal prosecution. The responsible party can elect either to pay the administrative fine or to be tried in court. Where the responsible party elects to be tried in court on a charge of having committed the offence, the Regulator must hand the matter over to the South African Police Service (s 109(4)). The Regulator may not impose an administrative fine if the responsible party has been charged with an offence on the same set of facts, and where the offender has paid an administrative fine no prosecution may be instituted against them (s 109(7)).
Section 109(5) provides that where an infringer fails to pay the administrative fine, the Regulator may file – with the Registrar or Clerk of the Court – a statement setting out the amount of the fine, which statement shall have the effects of a civil judgment granted in favour of the Regulator for a liquid debt.
Effectively, a person who is guilty of spreading revenge pornography can be required, in terms of an enforcement notice, to take the footage down. If they comply the victim is still entitled to pursue a claim of civil damages in terms of
s 99. However, where the perpetrator does not comply they could find themselves facing criminal prosecution or having to pay a fine. While this fine itself is not payable to the victim, the perpetrator has not gone unpunished and the victim may still pursue a civil claim for damages.
Civil damages
Section 99(1) of POPI provides that a data subject may institute a civil action for damages against a responsible party for breach of any conditions for the lawful processing of personal information, whether or not there is intent or negligence on the part of the responsible party. Section 99 thus provides for liability without fault, where ordinary common law remedies would require at least negligence.
The right to be forgotten
The above remedies are contingent on the victim knowing the identity of the perpetrator. In the event that the perpetrator’s identity is unknown, the victim could potentially rely on s 24 of POPI, which provides that a data subject may request a responsible party to delete personal information that is inaccurate, irrelevant, excessive, incomplete or misleading.
The right to be forgotten, which is contained in art 17 of the GDPR, was first recognised in Google Spain SL and Google Inc v Agencia Espanola de Proteccion de Datos (AEPD) and Mario Costeja Gonzalez (C-131/12, 13-5-2014) in which the European Court of Justice (the ECJ) ruled that search engines are controllers of personal data. The court held that even if the physical server of a company processing data is located outside of the EU, European rules still apply to the search engine operators if they have a branch or a subsidiary in a Member State. An individual thus has the right, where the information is inaccurate, inadequate, irrelevant, or excessive for purposes of the data processing, to ask a search engine to remove links with personal information about them (at para 93 of the ruling).
The right to be forgotten may serve as a valuable remedy for victims of revenge pornography on the grounds that such ‘information’ is irrelevant, inaccurate, or excessive, subject to three considerations.
The ECJ ruling does not mean that information must be deleted off the Internet completely, only that links to information about an individual should be removed from search results. Secondly, it is not clear whether the Google Spain decision also applies to the search feature on social media platforms. Third is the fact that the ECJ subsequently ruled that the right to be forgotten only applies within the EU (Google LLC, Successor in law to Google Inc v Commission Nationale de I’informatique et des Libertés (CNIL)) (C-507/17, 24-9-2019).
Nevertheless, if a South African court were to apply the principles applied by the ECJ in Google Spain, it is possible that South Africans would also be able to request a search engine, in terms of
s 24 of POPI, to remove links to offensive footage from their search results.
Conclusion
The efficacy of any potential remedies in terms of POPI would depend on the speed and capacity of the Regulator and the Enforcement Committee. Nevertheless, there is the potential for POPI to function as an effective tool in combatting revenge pornography, whether used instead of, or in addition to other civil and criminal remedies.
POPI may also provide a solution in terms of the right to be forgotten where the perpetrator’s identity is unknown.
One can only hope that by lodging a complaint with the Regulator the victim may be able to obtain more immediate relief in order to limit the damage to their reputation.
Paula Gabriel BMus MMus (UCT) LLB (Unisa) is an advocate in Cape Town.
This article was first published in De Rebus in 2020 (April) DR 14.
