- within Insolvency/Bankruptcy/Re-Structuring and Cannabis & Hemp topic(s)
Private bodies - such as hospitals, medical practices, banks and everyday employers - regularly receive requests for access to information under the Promotion of Access to Information Act 2 of 2000 ("PAIA"). Many recipients assume they have no choice but to comply with every request placed before them. That assumption is wrong. A recent High Court judgment from the KwaZulu-Natal Division dismissed a former employee’s application for access to his personnel records on multiple procedural and substantive grounds - each of which carries a practical lesson for any institution fielding PAIA requests. This article distils those lessons into a working checklist for private bodies. It is not a substitute for legal advice, but it is intended to equip those on the receiving end of such requests to spot non-compliant requests - and to understand when the law permits, and indeed requires, that they push back.
Lesson 1: Has the Requester Identified a Right?
The single most important filter in PAIA is section 50(1)(a). A requester must demonstrate that the record sought "is required for the exercise or protection of any rights". The threshold, as confirmed in Clutchco (Pty) Ltd v Davis 2005 (3) SA 486 (SCA) and Cape Metropolitan Council v Metro Inspection Services 2001 (3) SA 1013 (SCA), is whether the information will provide "a substantial advantage or an element of need" in exercising or protecting that right. The requester must state what the right is, what information is sought, and how it assists. In the judgment, the court found that the requester’s form did not identify any enforceable right, even when read generously alongside the affidavits - and that there was no indication the record would be decisive in determining any cause of action.
A request that says, in effect, "I want to see my records because I have a constitutional right to information" is circular and insufficient. The requester must explain how the record will help exercise or protect a specific right - such as a right to litigate, to fair labour practices, or to bodily integrity. If the form does not do this, you have a basis to refuse the request.
Lesson 2: Has the Requester Used the Correct Form?
Compliance with PAIA’s prescribed process is a precondition for the validity of any request. The current regulations, published in 2021, require that the request be made on form 2 of annexure "A" and submitted to the private body’s information officer. In the judgment, the request was completed on the old Form C prescribed by the repealed 2002 Regulations. Citing Midi Television (Pty) Ltd t/a E-TV v Director of Public Prosecutions (Western Cape) 2007 (5) SA 540 (SCA), the court held that PAIA "is subject to compliance with a comprehensive process that contains its own checks and balances" and that non-compliance cannot simply be bypassed - the failure was fatal.
Every private body should therefore ensure its information officer can identify an outdated or non-compliant form on sight. A request made on a repealed form is fundamentally deficient, and you are not obliged to treat it as valid.
Lesson 3: Was the Request Directed to the Right Person?
PAIA contemplates that requests will be directed to the private body’s designated information officer. In the judgment, the private body had appointed a designated information officer, yet the requester directed his request to the Human Resources Director instead. The court identified this as a further procedural deficiency.
Ensure, then, that your organisation has appointed an information officer and that their details are accessible - on your website, in reception areas, and in standard correspondence. If a request arrives on the desk of an HR director, a ward manager, or a branch manager, redirect it and advise the requester accordingly. A misdirected request is not a compliant request.
Lesson 4: Has the Requester Respected the Statutory Timeframe?
Section 56(1) of PAIA affords a private body 30 days to respond to a request. In the judgment, the requester demanded a response within seven days - the court noted this truncated timeframe as a further deficiency.
Do not allow a requester to stampede you into a premature response. If a request imposes a shorter deadline, point the requester firmly to section 56(1). Hospitals consulting clinical records, banks assessing privilege, and employers reviewing personnel files should treat the 30-day period as a minimum safeguard, not a bureaucratic inconvenience.
Lesson 5: Is the Requester Trying to Expand the Request After the Fact?
A PAIA request must be assessed on the terms in which it is made. In the judgment, the requester attempted at the hearing to expand his request to include telephone records and a system inspection - neither of which formed part of the original request. The court held that it was impermissible for him to broaden the ambit of his request retrospectively.
If you subsequently receive informal demands for additional records - by email, telephone, or through attorneys - treat each as requiring a fresh, compliant PAIA request. You are not obliged to expand the scope of your response beyond the four corners of the original form.
Lesson 6: Has the Requester Already Received the Information?
Where the requester has already been furnished with information that reasonably addresses the underlying question, the threshold of being "required" under section 50(1)(a) may not be met. In the judgment, the requester had already received a favourable reference, a certificate of employment status, and written confirmation from the CEO that he was not precluded from applying for employment. He had also continued to access the company’s premises as a subcontractor’s employee - access that would not have been permitted had he been dismissed.
Before engaging with a PAIA request, ask whether you have already given the requester the very information - or its practical equivalent - that is being sought. For medical practitioners, this arises where clinical records have already been furnished; for employers, where a certificate of service or reference has already been provided.
Lesson 7: Has the Requester Exhausted Internal Remedies?
Section 78(1) of PAIA provides that a requester may only apply to a court after exhausting the internal appeal procedure (section 74) or the complaints procedure (section 77A). Although the court noted this was not determinative, it observed that there was no indication the requester had followed the mandated procedure before approaching the court.
If you refuse a request and the requester threatens litigation, ensure they are aware of the internal appeal and complaints procedures set out in your PAIA manual. A requester who bypasses these steps and proceeds directly to court does so at their own risk.
When Must You Comply?
The foregoing lessons should not be read as a charter for obstruction. PAIA gives effect to the right of access to information in section 32 of the Constitution, and where a request is procedurally compliant and identifies a right that the information will meaningfully assist in exercising or protecting, access must be given unless a ground for refusal in Chapter 4 of Part 3 applies. "Required" does not mean strict necessity - a "substantial advantage or an element of need" suffices. Refusing a valid request exposes the private body to a court order compelling access, adverse costs consequences, and reputational harm.
Conclusion
The seven lessons distilled above - the identification of a right, the correct form, the proper officer, statutory timeframes, the impermissibility of retrospective expansion, information already provided, and exhaustion of internal remedies - form a practical checklist that any information officer can apply. For hospitals, banks, and employers alike, the message is the same: PAIA imposes obligations, but it also confers protections - and a court will not compel compliance with a request that fails to meet the Act’s requirements.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
