Restrictions: Access to electronic security information

Dear colleagues and students

The University of Cape Town (UCT) recognises that following a security incident, individuals may wish to obtain or view CCTV footage, access-control records or other electronic security information relating to the incident. Such requests may arise where individuals require clarity about what occurred or need information for insurance, disciplinary, criminal or other legitimate purposes.

It is important to clarify that CCTV footage, access-control records and related security information cannot ordinarily be released, copied or made available for general viewing while an investigation is ongoing.

These records may contain personal information relating to students, staff, visitors, witnesses, victims and people who may be under investigation. They may also be evidence in criminal, disciplinary, civil or internal investigative proceedings. UCT is therefore required to protect this information and ensure that it is disclosed only where there is a lawful and authorised basis for doing so.

Protection of Personal Information Act, 2013 (POPIA)

CCTV images and access-control information capable of identifying an individual constitute, or may constitute, personal information for the purposes of POPIA. The university, as the responsible party, has an obligation to protect the confidentiality and integrity of personal information and to prevent unauthorised access, disclosure or processing.

Sections 19 and 20 of POPIA require appropriate safeguards to protect personal information and require persons processing such information to maintain its confidentiality unless disclosure is authorised or required by law.

Accordingly, the fact that an individual appears in CCTV footage, or that an access-control record relates to that individual, does not automatically mean that the complete recording or record may be released to that person. This is particularly relevant where the information also relates to third parties or forms part of an active investigation.

Electronic Communications and Transactions Act, 2002 (ECTA)

CCTV recordings, access-control logs and other digitally stored security information may constitute electronic records or data messages that can be used as evidence.

Sections 14 and 15 of ECTA place particular importance on the integrity, authenticity and evidential reliability of electronic information. Where electronic information may become evidence, UCT must be able to demonstrate that it has remained complete, reliable and appropriately controlled.

Uncontrolled copying, distribution, editing, forwarding or publication of CCTV footage or electronic security records may compromise the integrity, confidentiality or evidential value of such material. Access to evidential material is therefore restricted and an appropriate chain of custody must be maintained.

Interception and monitoring of communications

The interception and monitoring of communications in South Africa is principally regulated by the Regulation of Interception of Communications and Provision of Communication-related Information Act 70 of 2002 (RICA).

Where security systems capture information that falls within the scope of legislation regulating communications or communication-related information, such information may only be accessed, processed or disclosed in accordance with the applicable legal requirements. Security information therefore cannot be treated as information that is freely available for circulation simply because it has been electronically recorded.

Ongoing investigations and the sub judice principle

Where an incident is subject to an active criminal, disciplinary, civil or internal investigation, premature disclosure of evidential material may prejudice the investigation or subsequent proceedings.

While the sub judice principle should not be interpreted as an absolute prohibition on discussing every matter under investigation, the institution has a legitimate responsibility to protect the integrity and fairness of investigations and proceedings.

Premature disclosure of CCTV footage, access records or investigative information could, among other things:

• reveal the identity of witnesses, complainants, victims or suspects
• expose personal information belonging to third parties
• alert persons under investigation to evidence already obtained
• influence or contaminate witness recollections or statements
• enable witnesses or suspects to coordinate versions of events
• compromise investigative techniques or security vulnerabilities
• prejudice disciplinary, criminal or civil proceedings
• undermine the integrity or chain of custody of electronic evidence; or
• result in footage or information being distributed on social media or other platforms outside purposes for which it was originally collected.

Requests for CCTV footage and access-control information

A decision not to provide CCTV footage or access-control records during an investigation does not mean that the information is being withheld indefinitely or that a request will not be considered.

Each request must be assessed against applicable legislation, university policies, the rights of other persons appearing in or affected by the records, and the status of any investigation or proceedings.

Where appropriate, information may be preserved and provided directly to an authorised investigating official, the South African Police Service, a court, disciplinary body, Legal Services or another person or authority legally entitled to receive it. In some circumstances, access may also become possible once an investigation or proceedings have been concluded, subject to POPIA and other applicable legal requirements.

Students and staff who require CCTV footage, access-control records or other security information for legitimate purposes are therefore requested to submit a formal request through the appropriate university process, rather than approaching individual security officers, control-room operators or other staff members for copies or access.

UCT remains committed to balancing transparency and individual rights with privacy, confidentiality, due process and the protection of the integrity of investigations.

The cooperation of staff and students is appreciated in ensuring that security information and potential evidence are managed responsibly and in accordance with South African law.

Properties and Services