PAIA annual Report

The Information Regulator of South Africa annually mandates public and private bodies to submit reports under the Promotion of Access to Information Act (PAIA) for the financial year spanning 1 April to 31 March. These reports detail requests for access to records received and processed, including those granted, refused, and the grounds for refusal. While the reporting obligation is crucial for fostering transparency and accountability, compliance remains a significant challenge, marked by low public awareness, inadequate record-keeping, and historical issues with the submission portal. The Regulator is increasingly exercising its enforcement powers, making robust PAIA compliance essential for all entities to avoid penalties and uphold constitutional rights.

The Promotion of Access to Information Act 2 of 2000 (PAIA) stands as a cornerstone of South Africa's constitutional democracy, giving effect to the fundamental right of access to information enshrined in Section 32 of the Constitution. This legislation is designed to foster a culture of transparency and accountability within both public and private bodies, empowering individuals to exercise and protect their rights more effectively. The Information Regulator (South Africa), an independent body established under the Protection of Personal Information Act 4 of 2013 (POPIA), is entrusted with the critical mandate of monitoring and enforcing compliance with PAIA.

A key mechanism through which the Information Regulator fulfills its oversight role is the annual submission of PAIA reports by public and private entities. These reports provide invaluable insights into the practical implementation of the Act, highlighting trends in information requests, response rates, and the reasons for granting or refusing access. The data collected informs the Regulator's strategic interventions, educational initiatives, and enforcement actions, ultimately shaping the landscape of access to information in the country.

This article delves into the legal framework underpinning PAIA annual reporting, examines the recent reporting obligations for the 2023/2024 financial year, and critically analyses the persistent challenges to compliance. It further explores the Information Regulator's evolving enforcement posture and reviews pertinent case law, concluding with practical implications for legal practitioners navigating this complex regulatory environment.

The Promotion of Access to Information Act 2 of 2000 (PAIA) was enacted to operationalise the constitutional right of access to information, allowing individuals to request information held by the State and by private bodies when such information is required for the exercise or protection of any rights. Initially, the South African Human Rights Commission (SAHRC) was responsible for overseeing PAIA's implementation. However, with the establishment of the Information Regulator in terms of Section 39 of the Protection of Personal Information Act 4 of 2013 (POPIA), the mandate for PAIA enforcement was transferred to this new independent body, effective from 1 July 2021.

The Information Regulator's dual mandate encompasses the promotion and protection of both the right to privacy (under POPIA) and the right of access to information (under PAIA). Its extensive powers and duties include providing education, monitoring and enforcing compliance, consulting with interested parties, handling complaints, conducting research, and reporting to Parliament. This broad scope underscores the Regulator's pivotal role in shaping South Africa's information governance framework.

Central to PAIA's compliance regime is the annual reporting obligation. Section 32 of PAIA mandates the Information Officer of every public body to submit an annual report to the Regulator detailing all access to information requests received and processed. Similarly, Section 83(4) of PAIA empowers the Regulator to request heads of private bodies or their Deputy Information Officers to furnish reports on requests for access to records. These reports are critical for the Regulator to assess the extent to which public and private bodies are upholding the right to access information and to identify areas requiring intervention.

The Information Regulator recently called for the submission of PAIA annual reports for the 2023/2024 financial year, covering the period from 1 April 2023 to 31 March 2024. The submission window typically opens on 1 May, with a deadline of 30 June annually, facilitated through the Regulator's eServices portal. Information Officers (IOs) of public bodies and Heads of Private Bodies (HPBs) or their Deputy Information Officers (DIOs) are required to register on this portal to submit reports detailing the number of requests received, how many were granted in full or partially, how many were refused, and the specific grounds for such refusals.

Despite the clear legal mandate, consistent compliance with PAIA, particularly the annual reporting, remains a significant challenge. Historical data and civil society reports indicate persistently low levels of compliance from both public and private entities. A major contributing factor is the low public awareness of PAIA itself, which in turn leads to fewer requests and less pressure on bodies to comply. Furthermore, poor record-keeping practices within many organisations often result in requests being refused on the grounds that records cannot be found, undermining the very essence of access to information. Institutional capacity constraints, a lack of political will, and technical issues with the online submission portal have also historically hampered effective implementation.

The Information Regulator is, however, demonstrating an increasingly robust approach to enforcement. Failure to submit PAIA reports can trigger compliance checks, including on-site inspections and reviews of an organisation's PAIA framework, potentially leading to enforcement proceedings. Recent enforcement actions highlight this shift, such as the significant enforcement notice issued against Sibanye-Stillwater Limited, a private mining company, directing the disclosure of Social and Labour Plan compliance reports. This ruling underscores the Regulator's willingness to exercise its powers against private bodies, reinforcing the serious consequences of non-compliance, which can include imprisonment for certain offences.

Judicial pronouncements continue to shape the interpretation and application of PAIA. Cases like *Eskom v AfriForum* have affirmed the right to access contracts held by public bodies, even when commercial confidentiality is invoked. Similarly, *Caga and Others v Transnet SOC Ltd and Another* saw the court ordering Transnet to furnish a forensic investigator's report, emphasising that Section 7(1) exclusions do not apply to already concluded proceedings and that public bodies must provide sufficient facts to justify refusal. Conversely, in *Organisation Undoing Tax Abuse v South African National Roads Agency (OUTA v SANRAL)*, the court upheld SANRAL's refusal to disclose sensitive commercial information, demonstrating the delicate balance between transparency and justifiable limitations. The ongoing matter involving the South African Revenue Service (SARS) and the release of former President Jacob Zuma's tax records further illustrates the Regulator's role in compelling disclosure from state institutions. These cases collectively illustrate the evolving jurisprudence and the Regulator's commitment to ensuring that the right to access information is upheld, while also acknowledging legitimate grounds for refusal.

The annual PAIA report remains an indispensable tool for the Information Regulator to gauge the state of access to information in South Africa, promoting transparency and accountability across both public and private sectors. While challenges such as low awareness, poor record-keeping, and administrative hurdles persist, the Regulator's increasing assertiveness in enforcement signals a critical turning point for PAIA compliance. The recent reporting cycle for 2023/2024 underscores the ongoing obligation for all entities to actively engage with the Act's requirements.

For legal practitioners, the implications are clear and significant. It is imperative to ensure that clients, whether public or private bodies, maintain robust PAIA compliance frameworks. This includes having up-to-date PAIA manuals, ensuring Information Officers and Deputy Information Officers are properly registered and trained, and implementing effective record-keeping systems. Practitioners must be prepared to advise on the nuances of justifiable limitations to access, drawing on the growing body of case law, and to guide clients through potential compliance checks and enforcement actions by the Regulator. As South Africa marks 25 years since the enactment of PAIA, continuous education, proactive compliance, and a vigilant approach to evolving regulatory expectations will be crucial for upholding the constitutional right to information and fostering a truly open and accountable society.