Brief Summary

Access to Information — Promotion of Access to Information Act 2 of 2000 — Applicant sought access to information regarding defamatory email affecting her dignity — Respondents claimed no such information existed — Applicant's request deemed refused due to lack of response — Court found applicant had exhausted internal remedies and was entitled to seek relief — Respondents' defence under section 23 of PAIA not upheld as they did not dispute the email's creation within Mintek's environment.

Comprehensive Summary

Summary of Judgment

1. Introduction

This matter concerned an application for access to information under the Promotion of Access to Information Act 2 of 2000 (PAIA). The applicant sought disclosure of specific IT-related records from a public body in order to protect her right to dignity, following the circulation of an allegedly defamatory email within the respondent organisation.

The applicant was Nozuko Mani. The first respondent was the Information Officer of Mintek, cited in that statutory capacity, and the second respondent was Mintek, a public body. The respondents opposed the relief primarily on the basis that the records requested could not be found or did not exist, relying on section 23 of PAIA.

The procedural history was materially shaped by a sequence of internal steps preceding the litigation. After becoming aware of the email, the applicant pursued internal remedies via Mintek’s grievance procedure, obtained limited access to the mail server, and later formulated a narrower, IT-specific request. She then made a formal PAIA request under section 18(1) and, when no decision was communicated within statutory time periods, she lodged an internal appeal under Mintek’s PAIA manual. When this also yielded no response, she approached the High Court for relief.

The general subject matter was whether Mintek was obliged, under PAIA, to provide the identity associated with a specified internal IP address at the relevant time and the related “LOGS” from the Active Directory for specified dates, or whether Mintek could avoid disclosure on the basis that the information did not exist or could not be found, and whether it had complied with the procedural and evidentiary requirements of section 23.

2. Material Facts

It was common cause that the applicant was appointed at Mintek as Head: Market Intelligence with effect from 1 November 2018, and that on 25 October 2018 she became aware of an email circulated internally at Mintek containing allegations of fraud and impropriety in the interview process leading to her appointment, and also alleging a romantic relationship with her immediate supervisor. The court accepted that the email was defamatory in nature and implicated the applicant’s dignity.

It was also common cause that the email was purportedly sent by a “Tshepo Mokgatle”, but that Mintek had no employee by that name. The applicant initially sought an undertaking from Mintek to allow an independent forensic investigation at her own cost, including access to laptops and servers. Mintek did not give the requested undertaking and instead directed the applicant to internal procedures, specifically its grievance procedure.

The applicant lodged a grievance seeking permission for an independent investigation to trace the source of the email by access to the employer’s server and executives’ laptops under supervision to protect the integrity and security of Mintek’s information. In the grievance process, Mintek granted access to the mail server but refused access to the laptops. At the third stage, chaired by an external chairperson (Ms Singh), the applicant’s request was framed as requiring access to the mail server and to the three executives’ laptops to determine the source and origin of the email and where and when it was created. Ms Singh took into account Mintek’s offer of access to the mail server, the applicant’s failure to pursue forensic analysis on that server, and Mintek’s confidentiality and security concerns (including its status as a National Key Point). She concluded that, absent detailed justification, it was unreasonable to insist on access to the laptops.

After the grievance outcome, the applicant conducted her own investigation using the email header. She concluded that the email was created internally using Mintek’s internal IT infrastructure and identified a local IP address associated with the sending device. Based on this, she sought from Mintek the identity of the person using the device associated with that IP address at the relevant time, and the logs for the relevant period retrieved from the Active Directory under the specified domain. Her internal appeal within the division was dismissed, without addressing the additional information she had obtained.

On 29 April 2019, the applicant made a PAIA request to Mintek’s information officer seeking the identity of the employee using the specified IP address on 24 October 2018 and all relevant logs for the specified dates. The respondents did not acknowledge receipt and did not provide a decision or the information within 30 days. After 30 days elapsed, the applicant lodged an internal PAIA appeal. Despite receipt, the respondents did not furnish a decision on the appeal, and the applicant instituted these proceedings.

In opposing the application, the respondents did not dispute that the email was created within Mintek’s environment using Mintek’s tools. The central dispute on the merits was the respondents’ assertion—raised substantively in the litigation—that Mintek did not have the requested information because its system assigns dynamic IP addresses and does not retain historical logs of IP assignments for the relevant dates. The respondents’ affidavits described, in general terms, that IP addresses are assigned at random from a pool, change when users log off and on, and that Mintek can identify current assignments and whether an IP belongs to its pool, but does not keep historical assignment records due to volume. The applicant disputed that the information did not exist, contending that Mintek’s ICT policy and backup/retention processes indicated that relevant information could be retrieved, including via backups.

3. Legal Issues

The first legal issue was whether the applicant had exhausted internal remedies as required by PAIA before approaching the court. This required the court to determine the legal consequences, under PAIA, of the respondents’ failure to decide the internal appeal within the statutory period.

The second and central issue was whether the respondents could rely on section 23 of PAIA (records that cannot be found or do not exist) to resist disclosure, and specifically whether they had complied with section 23’s procedural requirements and discharged the burden imposed by section 81(3) of PAIA. This involved a mixed inquiry of law and application of law to fact: identifying what section 23 and section 81(3) require, and assessing whether the respondents’ affidavits contained sufficient factual material demonstrating that reasonable steps were taken to locate the records and that there were reasonable grounds to believe the records could not be found or did not exist.

A related issue concerned the adequacy of affidavit evidence in motion proceedings, including the distinction between primary facts and mere conclusions, and whether the respondents’ evidence met the required standard to support a section 23 defence.

4. Court’s Reasoning

On exhaustion of internal remedies, the court set out the relevant statutory framework. It noted that section 27 of PAIA deems a request refused if the information officer fails to decide within the period in section 25(1). It further considered the internal appeal mechanism and emphasised that while PAIA expressly deems the initial request refused in such circumstances, it also regulates internal appeals in section 77. In terms of section 77(3)(a), the relevant authority must decide an internal appeal as soon as reasonably possible, and in any event within 30 days after receipt. In terms of section 77(7), failure to give notice of the decision within that period results in the appeal being regarded as dismissed. On the undisputed chronology, the respondents did not decide or notify the applicant of the outcome of the internal appeal. The court therefore held that the internal appeal was deemed dismissed, with the consequence that the applicant had exhausted internal remedies and was entitled to approach the court under section 78.

Turning to the merits, the court focused on the requirements of section 23. It emphasised that section 23 is framed in mandatory terms. If all reasonable steps have been taken to find the record and there are reasonable grounds for believing the record is in the public body’s possession but cannot be found or does not exist, the information officer must notify the requester by way of affidavit or affirmation. The affidavit must provide a full account of all steps taken to find the record or determine whether it exists, including communications with every person who conducted the search.

The court highlighted that it was common cause that the respondents had not complied with section 23 in response to the PAIA request. They had not filed a section 23 affidavit at the time, nor did they provide the applicant with an adequate response explaining the steps taken to locate the records. Instead, the assertion that the information did not exist was advanced meaningfully for the first time in the answering papers. The court also referred to PAIA’s object of avoiding litigation, and criticised the absence of any explanation from the information officer for not responding to the PAIA request and appeal.

The court then addressed the burden of proof. Under section 81(3) of PAIA, the party relying on the refusal must establish that the refusal complies with PAIA. In the context of section 23, this meant the respondents bore the onus to show that reasonable steps had been taken to find the record and that there were reasonable grounds for believing the record could not be found or did not exist. The court accepted that the term “believing” indicates a lighter standard than “satisfy”, but it still required facts enabling the court to conclude that there were reasonable grounds for the belief claimed.

Evaluating the respondents’ affidavit evidence, the court held that the answering affidavit and confirmatory affidavit contained only generalised allegations about Mintek’s IT processes and did not set out the required factual detail about actual searches performed for the requested records. The information officer did not explain what she did to search for the information, what steps were taken to verify whether the information existed, or how it was determined that it was unavailable. The court noted the absence of supporting documentation or policies consistent with the claims and the lack of any account of communications with those who allegedly conducted a search, as section 23(2) requires.

In addressing affidavit adequacy, the court relied on principles that affidavits in motion proceedings serve as pleadings and evidence and must place essential evidence before the court. It also applied the distinction between primary facts and secondary facts or conclusions. On this approach, the respondents’ statements that Mintek conducted an investigation and that the information does not exist were characterised as lacking primary factual detail. The court concluded that the affidavits were “hopelessly inadequate” to establish the section 23 defence and did not assist the court in deciding whether there were reasonable grounds to believe that the record could not be found or did not exist.

The court further rejected the notion that the applicant’s earlier opportunity to access Mintek’s server cured the respondents’ obligations under PAIA. It reasoned that the applicant’s PAIA request was not the same as her initial grievance demand for laptop access, and that it was the respondents’ failure to respond in terms of PAIA—not any failure by the applicant to inspect the server—that led to litigation.

Finally, on remedy, the court accepted that the applicant had identified the right she sought to protect (dignity), the information required, and how it would assist her. Although the court found that the respondents had failed to comply with section 23 and failed to discharge the onus of establishing non-existence of the records, it considered it inappropriate to make a final order compelling access before the respondents had properly complied with section 23’s affidavit requirements. The court therefore adopted an approach that compelled procedural compliance and allowed further affidavit material, rather than issuing an immediate final production order.

5. Outcome and Relief

The court issued a rule nisi, returnable on 5 March 2021, calling upon the respondents to show cause why orders compelling disclosure should not be made final. The contemplated final relief included an order directing the respondents to provide the applicant with the identity of the employee who was using the specified computer or laptop with the specified IP address on 24 October 2018 when the email was sent, and an order directing provision of all logs for that IP address retrieved from the Active Directory for the specified dates.

The respondents were granted leave to file supplementary affidavit(s) complying with section 23 of PAIA on or before 12 February 2021, and the applicant was granted leave to file a supplementary replying affidavit on or before 26 February 2021.

The court ordered the costs of the application to be paid by the respondents on the scale as between attorney and client.

Cases Cited

Lecuona v Property Emporium CC 2010 JDR 0417 (GSJ)

Vumba Intertrade CC v Geometric Intertrade CC 2001 (2) SA 1068 (W)

FirstRand Bank Ltd v Pather 2005 (4) SA 429 (N)

Claase v Information officer, South African Airways Pty Ltd (39/06) [2006] ZASCA 134; [2006] SCA 163 (RSA) (30 November 2006)

Quartermark Investments (Pty) Ltd v Mkhwanazi and Another 2014 (3) SA 96 (SCA)

Die Dros (Pty) Ltd and Another v Telefon Beverages CC and Others 2003 (4) SA 207 (C)

Willcox and Others v Commissioner for Inland Revenue 1960 (4) SA 599 (A)

Reynolds NO v Mecklenberg (Pty) Ltd 1996 (1) SA 75 (W)

Radebe and Others v Eastern Transvaal Development Board 1988 (2) SA 785 (A)

Legislation Cited

Promotion of Access to Information Act 2 of 2000

National Key Points Act 102 of 1980

Rules of Court Cited

No rules of court were cited in the judgment.

Held

The court held that the applicant had exhausted internal remedies because the respondents’ failure to decide the internal PAIA appeal within the statutory period resulted in the appeal being deemed dismissed under section 77(7) of PAIA, entitling the applicant to approach the court under section 78.

The court further held that the respondents had not complied with section 23 of PAIA and had failed to discharge the burden under section 81(3) to justify the refusal on the basis that the records could not be found or did not exist. The respondents’ affidavits contained generalised assertions about IT processes but did not provide the detailed, primary factual account of searches undertaken and communications made that section 23 requires.

Despite these findings, the court held that a final order compelling immediate access was not appropriate at that stage, because section 23 contemplates a proper affidavit process. The court therefore issued a rule nisi and allowed further affidavits to be filed in compliance with section 23, while awarding attorney-and-client costs against the respondents.

LEGAL PRINCIPLES

PAIA requires an information officer to decide a request and notify the requester within the statutory timeframe, failing which the request is deemed refused under section 27. For internal appeals, failure by the relevant authority to notify the appellant of a decision within 30 days results in the appeal being deemed dismissed under section 77(7), thereby exhausting internal remedies for purposes of section 78.

A public body seeking to rely on section 23 of PAIA must do so through an affidavit or affirmation that provides a full account of all reasonable steps taken to find the requested record or determine whether it exists, including communications with each person who conducted the search. Generalised explanations or conclusions about systems or practices are insufficient without primary factual detail of the actual search conducted.

In PAIA litigation, the burden rests on the party refusing access to establish that the refusal complies with PAIA in terms of section 81(3). In motion proceedings, affidavits must contain the essential evidence and primary facts supporting the defence; secondary facts or bare conclusions do not constitute adequate evidential material to sustain the refusal.

Mani v The Information Officer Mintek and Another (26728/2019) [2021] ZAGPJHC 430 (22 January 2021)