The Police and Prisons Civil Rights Union (POPCRU) expresses its outrage, disgust and strongest condemnation following the reckless circulation of highly confidential medical information belonging to thousands of SAPS employees in the Western Cape province. 

It has come to our attention that an internal Human Resource communication relating to absenteeism management and leave administration was circulated broadly within the SAPS Western Cape environment, accompanied by an attachment titled “leave subcategory”, which allegedly contained confidential medical information of approximately 2 978 members, including their illness diagnoses and sensitive personal medical details. 

This shocking and irresponsible conduct represents one of the gravest violations of privacy, dignity and confidentiality imaginable within the workplace. It is unacceptable that employees entrusted with the administration and safekeeping of sensitive information could so carelessly expose the deeply personal medical records of workers to unauthorised individuals.

The conduct in question is not merely unethical and reckless — it potentially constitutes a direct violation of the Protection of Personal Information Act (POPIA), Act 4 of 2013. Medical information is classified under POPIA as “special personal information”, deserving the highest level of protection and confidentiality.

Section 26 of POPIA expressly prohibits the processing of special personal information concerning a person’s health except under strictly regulated circumstances. Furthermore, Section 19 of POPIA places a legal obligation on responsible parties to secure the integrity and confidentiality of personal information in their possession by taking appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, unlawful access, or unlawful disclosure of personal information.

What has transpired in the Western Cape is the exact opposite of what the law requires.

The circulation of workers’ diagnoses and medical details to a broad email distribution list is not an administrative error that can simply be brushed aside. It is a gross invasion of privacy and a betrayal of the trust that employees place in the institution. These are workers who daily risk their lives under dangerous conditions in service of society, yet their own employer has failed to protect their constitutional right to dignity and privacy.

POPCRU further wishes to emphasise that doctor-patient confidentiality is a sacrosanct principle recognised both ethically and legally. The careless disclosure of medical diagnoses creates conditions for stigma, humiliation, discrimination, workplace victimisation and emotional trauma for affected employees. It is deeply disturbing that such information could be disseminated without consent, without safeguards, and without regard for the devastating consequences on the affected members and their families.

The union therefore demands the following with immediate effect:

Firstly, an urgent and independent investigation must be instituted to determine precisely who authorised, processed, distributed and failed to safeguard the confidential information.

Secondly, every individual responsible for the leakage and circulation of the information must immediately face disciplinary action. POPCRU will not accept scapegoating of junior personnel while those in positions of authority escape accountability.

Thirdly, SAPS management in the Western Cape must publicly account for how such a catastrophic breach of confidentiality was permitted to occur under their watch.

Fourthly, all affected employees must be formally notified about the breach, informed about the nature and extent of the disclosure, and advised on what corrective measures are being implemented to protect them from further harm.

Fifthly, POPCRU demands a full review of all information management protocols relating to employee medical records, absenteeism management systems and leave administration processes within the province.

The union further reserves its rights to pursue all available legal, labour and regulatory avenues should SAPS fail to act decisively against those responsible. POPCRU will not stand idle while workers’ constitutional rights are trampled upon through administrative recklessness and institutional negligence.

We also call upon the Information Regulator of South Africa to closely monitor this matter, as it raises serious concerns regarding compliance with POPIA within SAPS structures.

At a time when workers are constantly reminded about confidentiality obligations, operational discipline and compliance with legislation, it is unacceptable that the very institution tasked with enforcing the law appears incapable of protecting the confidential information of its own members.

This matter cannot be minimised. It cannot be sanitised. And it cannot be buried through internal bureaucracy.

Heads must roll.

The dignity, privacy and constitutional rights of workers are non-negotiable.

Issued by POPCRU

For more information contact Richard Mamabolo on 066 135 4349