LCR4805 Assignment 2 (COMPLETE ANSWERS) Semester
2 2026 - DUE September 2026
A university intern named X photographs international students at an event and publishes
their images, names, ages, countries of origin, challenges faced, and details of their
medical aid schemes—including specific medical conditions not covered—on the
university's website. Which one of the following is the MOST accurate statement regarding
the application of the Protection of Personal Information Act 4 of 2013 (POPIA) to this
scenario?
A) The scenario does not fall within POPIA's ambit because the information was collected
at a public university event, which is a matter of public interest.
B) The scenario falls within POPIA's ambit because the processing of personal information,
including special personal information like medical conditions, is automated and carried
out by a responsible party in South Africa, and the students are data subjects.
C) The scenario falls within POPIA's ambit only if the international students are South
African citizens or permanent residents.
D) The scenario does not fall within POPIA's ambit because X is merely an intern and not a
"responsible party" as defined in the Act.
Expert Rationale: The correct answer is B. POPIA applies to the processing of personal
information where the responsible party is domiciled in South Africa or where the
processing is carried out by an operator or responsible party in South Africa, and the
information is processed by automated or non-automated means that form part of a filing
system. The intern, X, is processing personal information for the university, which is the
responsible party. The information includes "special personal information" (medical
conditions and medical aid membership), which is explicitly covered by POPIA's definition
of personal information. The publication on the university's website constitutes
"processing," defined as any operation or activity concerning personal information,
including collection and dissemination. The data subjects are the identifiable international
students whose information is being processed. Therefore, the scenario falls squarely
within POPIA's ambit, making B correct. A is incorrect because public interest does not
exempt processing from POPIA. C is incorrect because POPIA protects the personal
information of all data subjects, not only South African citizens. D is incorrect because the
responsible party is the university, not the intern in his personal capacity, and X is likely the
operator. The processing is clearly automated through the website publication, triggering
POPIA's application regardless of the intern's status.
,Mary posts a message on her estranged husband John's Facebook wall, falsely accusing
him of being a thief and a fraudster. The post receives numerous negative comments and
damages John's business. Which of the following statements BEST describes Mary's
liability for defamation?
A) Mary is not liable because the publication occurred on a social media platform, which is
a public forum, and the truth of her statements is irrelevant.
B) Mary is liable for defamation if the element of "publication" is met, which occurs as soon
as at least one person other than John reads the post and understands its defamatory
nature.
C) Mary is liable only if John can prove that she acted with the specific intent to cause him
financial harm.
D) Mary is not liable because the damage to John's business is too remote a consequence
of her actions.
Expert Rationale: The correct answer is B. For a claim of defamation, the plaintiff must
prove publication, which is the act of making the defamatory statement known to a third
party. This requirement is fulfilled as soon as an outsider becomes aware of the defamatory
nature of the allegation. In the context of a Facebook post, publication occurs when
someone other than John reads the post. Mary is the author of the defamatory statement
and is therefore principally responsible for its publication. The burden would then shift to
Mary to prove a defence, such as truth and public interest. A is incorrect because the
platform is not a defence; publication on social media is still publication. C is incorrect
because the required intent is animus iniuriandi, the general intent to injure the plaintiff's
reputation, not necessarily specific intent to cause financial harm. The fact that numerous
people commented and John's business suffered further supports that publication
occurred and caused damages, but the core element of publication is met simply by third-
party awareness. D is incorrect because damages are a separate element to be proven,
and business damage is a foreseeable consequence of defamatory statements about one's
character.
A popular online newsgroup hosts an anonymous article accusing a soccer coach of
"match fixing" and "unethical conduct." The coach requests the ISP, which hosts the site, to
remove the article. The ISP fails to do so after three requests. The coach is subsequently
replaced and suffers financial losses. Which of the following is the MOST accurate
statement regarding the ISP's potential liability for defamation?
,A) The ISP is immune from liability because it is merely a conduit and not the author or
publisher of the defamatory content.
B) The ISP could be held liable for defamation if it is proven that it exercised some form of
editorial control or acted negligently in failing to remove the content after being notified.
C) The ISP can only be held liable if the coach can prove that the ISP had actual knowledge
of the defamatory nature of the content before the removal requests were sent.
D) The ISP is strictly liable for any defamatory content hosted on its servers, regardless of
its knowledge or role.
Expert Rationale: The correct answer is B. The liability of an ISP is largely dependent on its
function in the publication process. A distinction is made between authors/publishers
(who exercise editorial control) and mere distributors. If the ISP fails to remove defamatory
content after being notified, it may be held liable, not as an author, but as a distributor who
knew or should have known of the defamatory material. The degree of liability will depend
on the ISP's role and whether its conduct was negligent. In this scenario, the ISP received
three requests and failed to act, which could establish negligence. A is incorrect because
ISPs are not automatically immune; their liability depends on their actions and role. C is
incorrect because the specific question highlights that the ISP failed to remove the article
after three requests, which goes to the element of knowledge; actual knowledge is not
required if constructive knowledge can be proven through repeated notifications. D is
incorrect because strict liability for the media was rejected in National Media v Bogoshi in
favour of a negligence standard. The ISP's failure to remove the content after reasonable
notice shifts the analysis from mere conduit to potential distributor liability.
An employer checks the social media profiles of job candidates as part of the screening
process without informing them. The employer finds information in a candidate's public
profile, not in their private inbox. Which of the following statements about the application
of the Protection of Personal Information Act (POPIA) and the Regulation of Interception of
Communications and Provision of Communication-related Information Act (RICA) is
CORRECT?
A) The employer's processing of information from a public social media profile is
completely exempt from POPIA because the information is public.
B) The employer's processing of information from a public social media profile is
processing of personal information and must comply with POPIA, which requires that
processing be lawful, reasonable, and not excessive, and that data subjects are informed.
C) Accessing a candidate's public social media profile constitutes an "interception" under
RICA, as it involves a communication from the candidate.
, D) Under POPIA, an employer is not required to inform candidates about processing their
information if it is obtained from a publicly accessible source.
Expert Rationale: The correct answer is B. POPIA applies to the processing of all personal
information, including information obtained from public sources like social media profiles.
The principles of POPIA, such as the requirement that processing be lawful, reasonable,
and not excessive, still apply. The employer must inform the data subject (the candidate) of
the processing, even if the information is sourced publicly. The employer's screening
process involves collecting and using personal information for a specific purpose
(employment decisions), which triggers POPIA's conditions for lawful processing. A is
incorrect because public information is not automatically exempt from POPIA; the Act
applies to all personal information regardless of its source. C is incorrect; the RICA
definition of "interception" typically concerns real-time or stored communications, and
accessing a public profile is generally not an "interception" as defined in RICA. RICA
focuses on the interception of communications in transmission, not the viewing of publicly
available information. D is incorrect because POPIA requires responsible parties to notify
data subjects, even when data is collected from a public source, to ensure transparency
and accountability in the processing of personal information.
John and Mary are divorcing. Mary posts on John's Facebook wall, accusing him of being a
thief and fraudster. The post is seen by John's friends and business associates. John's
business suffers. Which of the following is a possible defence Mary could rely on in a
defamation claim, and what must she prove to succeed?
A) The defence of fair comment, where she must prove the comment was made honestly
and without malice.
B) The defence of truth and public interest, where she must prove on a balance of
probabilities that the statements are true and their publication is in the public interest.
C) The defence of absolute privilege, as the statement was made during a personal dispute.
D) The defence of jest, where she must prove that the statement was made as a joke.
Expert Rationale: The correct answer is B. Truth and public interest is a well-established
defence against a defamation claim. The defendant (Mary) bears the onus of proving that
the defamatory statements are true and that it was in the public interest to publish them. If
Mary made a false statement, she cannot use this defence. In this scenario, the accusation
of being a "thief and fraudster" are serious allegations of criminal conduct, which are
statements of fact. To succeed with this defence, Mary would need to provide evidence
that John actually committed theft and fraud. A is incorrect; fair comment is a defence for
2 2026 - DUE September 2026
A university intern named X photographs international students at an event and publishes
their images, names, ages, countries of origin, challenges faced, and details of their
medical aid schemes—including specific medical conditions not covered—on the
university's website. Which one of the following is the MOST accurate statement regarding
the application of the Protection of Personal Information Act 4 of 2013 (POPIA) to this
scenario?
A) The scenario does not fall within POPIA's ambit because the information was collected
at a public university event, which is a matter of public interest.
B) The scenario falls within POPIA's ambit because the processing of personal information,
including special personal information like medical conditions, is automated and carried
out by a responsible party in South Africa, and the students are data subjects.
C) The scenario falls within POPIA's ambit only if the international students are South
African citizens or permanent residents.
D) The scenario does not fall within POPIA's ambit because X is merely an intern and not a
"responsible party" as defined in the Act.
Expert Rationale: The correct answer is B. POPIA applies to the processing of personal
information where the responsible party is domiciled in South Africa or where the
processing is carried out by an operator or responsible party in South Africa, and the
information is processed by automated or non-automated means that form part of a filing
system. The intern, X, is processing personal information for the university, which is the
responsible party. The information includes "special personal information" (medical
conditions and medical aid membership), which is explicitly covered by POPIA's definition
of personal information. The publication on the university's website constitutes
"processing," defined as any operation or activity concerning personal information,
including collection and dissemination. The data subjects are the identifiable international
students whose information is being processed. Therefore, the scenario falls squarely
within POPIA's ambit, making B correct. A is incorrect because public interest does not
exempt processing from POPIA. C is incorrect because POPIA protects the personal
information of all data subjects, not only South African citizens. D is incorrect because the
responsible party is the university, not the intern in his personal capacity, and X is likely the
operator. The processing is clearly automated through the website publication, triggering
POPIA's application regardless of the intern's status.
,Mary posts a message on her estranged husband John's Facebook wall, falsely accusing
him of being a thief and a fraudster. The post receives numerous negative comments and
damages John's business. Which of the following statements BEST describes Mary's
liability for defamation?
A) Mary is not liable because the publication occurred on a social media platform, which is
a public forum, and the truth of her statements is irrelevant.
B) Mary is liable for defamation if the element of "publication" is met, which occurs as soon
as at least one person other than John reads the post and understands its defamatory
nature.
C) Mary is liable only if John can prove that she acted with the specific intent to cause him
financial harm.
D) Mary is not liable because the damage to John's business is too remote a consequence
of her actions.
Expert Rationale: The correct answer is B. For a claim of defamation, the plaintiff must
prove publication, which is the act of making the defamatory statement known to a third
party. This requirement is fulfilled as soon as an outsider becomes aware of the defamatory
nature of the allegation. In the context of a Facebook post, publication occurs when
someone other than John reads the post. Mary is the author of the defamatory statement
and is therefore principally responsible for its publication. The burden would then shift to
Mary to prove a defence, such as truth and public interest. A is incorrect because the
platform is not a defence; publication on social media is still publication. C is incorrect
because the required intent is animus iniuriandi, the general intent to injure the plaintiff's
reputation, not necessarily specific intent to cause financial harm. The fact that numerous
people commented and John's business suffered further supports that publication
occurred and caused damages, but the core element of publication is met simply by third-
party awareness. D is incorrect because damages are a separate element to be proven,
and business damage is a foreseeable consequence of defamatory statements about one's
character.
A popular online newsgroup hosts an anonymous article accusing a soccer coach of
"match fixing" and "unethical conduct." The coach requests the ISP, which hosts the site, to
remove the article. The ISP fails to do so after three requests. The coach is subsequently
replaced and suffers financial losses. Which of the following is the MOST accurate
statement regarding the ISP's potential liability for defamation?
,A) The ISP is immune from liability because it is merely a conduit and not the author or
publisher of the defamatory content.
B) The ISP could be held liable for defamation if it is proven that it exercised some form of
editorial control or acted negligently in failing to remove the content after being notified.
C) The ISP can only be held liable if the coach can prove that the ISP had actual knowledge
of the defamatory nature of the content before the removal requests were sent.
D) The ISP is strictly liable for any defamatory content hosted on its servers, regardless of
its knowledge or role.
Expert Rationale: The correct answer is B. The liability of an ISP is largely dependent on its
function in the publication process. A distinction is made between authors/publishers
(who exercise editorial control) and mere distributors. If the ISP fails to remove defamatory
content after being notified, it may be held liable, not as an author, but as a distributor who
knew or should have known of the defamatory material. The degree of liability will depend
on the ISP's role and whether its conduct was negligent. In this scenario, the ISP received
three requests and failed to act, which could establish negligence. A is incorrect because
ISPs are not automatically immune; their liability depends on their actions and role. C is
incorrect because the specific question highlights that the ISP failed to remove the article
after three requests, which goes to the element of knowledge; actual knowledge is not
required if constructive knowledge can be proven through repeated notifications. D is
incorrect because strict liability for the media was rejected in National Media v Bogoshi in
favour of a negligence standard. The ISP's failure to remove the content after reasonable
notice shifts the analysis from mere conduit to potential distributor liability.
An employer checks the social media profiles of job candidates as part of the screening
process without informing them. The employer finds information in a candidate's public
profile, not in their private inbox. Which of the following statements about the application
of the Protection of Personal Information Act (POPIA) and the Regulation of Interception of
Communications and Provision of Communication-related Information Act (RICA) is
CORRECT?
A) The employer's processing of information from a public social media profile is
completely exempt from POPIA because the information is public.
B) The employer's processing of information from a public social media profile is
processing of personal information and must comply with POPIA, which requires that
processing be lawful, reasonable, and not excessive, and that data subjects are informed.
C) Accessing a candidate's public social media profile constitutes an "interception" under
RICA, as it involves a communication from the candidate.
, D) Under POPIA, an employer is not required to inform candidates about processing their
information if it is obtained from a publicly accessible source.
Expert Rationale: The correct answer is B. POPIA applies to the processing of all personal
information, including information obtained from public sources like social media profiles.
The principles of POPIA, such as the requirement that processing be lawful, reasonable,
and not excessive, still apply. The employer must inform the data subject (the candidate) of
the processing, even if the information is sourced publicly. The employer's screening
process involves collecting and using personal information for a specific purpose
(employment decisions), which triggers POPIA's conditions for lawful processing. A is
incorrect because public information is not automatically exempt from POPIA; the Act
applies to all personal information regardless of its source. C is incorrect; the RICA
definition of "interception" typically concerns real-time or stored communications, and
accessing a public profile is generally not an "interception" as defined in RICA. RICA
focuses on the interception of communications in transmission, not the viewing of publicly
available information. D is incorrect because POPIA requires responsible parties to notify
data subjects, even when data is collected from a public source, to ensure transparency
and accountability in the processing of personal information.
John and Mary are divorcing. Mary posts on John's Facebook wall, accusing him of being a
thief and fraudster. The post is seen by John's friends and business associates. John's
business suffers. Which of the following is a possible defence Mary could rely on in a
defamation claim, and what must she prove to succeed?
A) The defence of fair comment, where she must prove the comment was made honestly
and without malice.
B) The defence of truth and public interest, where she must prove on a balance of
probabilities that the statements are true and their publication is in the public interest.
C) The defence of absolute privilege, as the statement was made during a personal dispute.
D) The defence of jest, where she must prove that the statement was made as a joke.
Expert Rationale: The correct answer is B. Truth and public interest is a well-established
defence against a defamation claim. The defendant (Mary) bears the onus of proving that
the defamatory statements are true and that it was in the public interest to publish them. If
Mary made a false statement, she cannot use this defence. In this scenario, the accusation
of being a "thief and fraudster" are serious allegations of criminal conduct, which are
statements of fact. To succeed with this defence, Mary would need to provide evidence
that John actually committed theft and fraud. A is incorrect; fair comment is a defence for
