29/09/2026
It’s my dad’s birthday today. A year ago, he was in hospital in Johannesburg with pneumonia, after I had him transferred from another hospital on the East Rand of Gauteng.
He turned 81, unconscious much of the time and struggling with memory loss when he was awake. His care at the hospital he had been in was dire, and I arranged for him to be transferred close to my home where the care was impeccable. I was making decisions about his medical care.
Each morning, while he was at the initial hospital, I phoned the ward to ask how his vital signs had been overnight. Most mornings, the staff told me. Then one morning I was told they couldn’t share that information because it was personal information and my dad hadn’t consented.
Well, he couldn’t consent. That was the point. That's exactly why I had been involved to the extent that I had.
After some arguments, the information was made available to me, and I was able to act in his best interests. But those debates over information I needed to make decisions for a man who could at that stage not fend for himself, have stayed with me.
**Consent is not the only lawful basis for using personal information under POPIA.** Actually, it is often your weakest legal basis.
I encounter the same misconception in my work with surveillance. People assume that a camera cannot record them unless they consent, or that footage cannot be accessed without the consent of everyone in it.
Imagine having to ask every criminal on the street for permission before recording what they do.
That is why consent cannot be the only answer. Recording footage and later accessing it each need a lawful justification. The purpose, the circumstances and the reason someone needs access all matter.
My dad’s information deserved protection, correctly so. He also needed someone to receive the information necessary to make decisions about his care. Two things can be true at the same time.
Happy birthday, Daddy! I love you!
