In a Government Gazette of 26 September 2025 the Information Regulator published draft regulations relating to the processing of a data subject's health or sex life by insurers, medical schemes and administrators, administrative bodies and others, for comment by 10 October 2025, a mere 10 business days later.
The extraordinary things is that section 32(1)(a) of POPIA (which is not referred to in the regulations) provides that the prohibition of processing special personal information, including information on the health and sex life of a data subject, does not apply to processing by insurance companies, medical schemes, medical scheme administrators, managed healthcare organisations and administrative bodies if the processing is necessary for the assessment of the risk to be insured, the performance of the insurance or medical scheme agreement, or enforcement of any contractual rights and obligations. The proposed regulations require an insurer (and the others mentioned) to conduct a Legitimate Interest Assessment whenever health and sex life information of a data subject is processed and the consent of the data subject cannot be obtained. According to the Promotion of Administrative Justice Act all regulations are required to be rational and reasonable. If a health insurer or medical scheme had to conduct an assessment every time they wish to process the health information of a person whose consent cannot be obtained and keep the required records of that assessment, health insurance would come to a standstill. The processing of health or sex life information by insurers will unnecessarily require authorisation by the Information Regulator. Authorisation requires an application to the information and a notice in the Gazette authorising the processing which may be subject to reasonable conditions imposed by the Information Regulator.
The definition of "administrative bodies" is beyond understanding and other definitions purport, without justification, to change provisions in the Act itself. Although POPIA intentionally and properly does not defined phrases like "legitimate interest", the proposed regulations seek to do so and require "a clear benefit to the data subject that outweighs, to a substantial degree, any interference with the privacy of the data subject resulting from the processing". The Information Regulator does not have the authority to rewrite the Act by regulation, particularly regulations aimed at specific bodies only.
The Constitutional Court has pointed out many times that we are a consultative democracy. Where draft regulations call for comment within a "specified time", as these do, that time has to be reasonable. Ten business days is not reasonable.
The proposed regulations can now be referred by the Information Regulator to the Minister of Justice and Constitutional Development. The Minister will presumably recognise that justice and the constitution are not being served by these draft regulations and that they cannot appear in the form published. Although the short time for comment is over, there is no reason why insurers and other bodies affected should not make representations to the Minister regarding these remarkable proposals. It must be hoped that the Prudential Authority and Financial Sector Conduct Authority, as the primary regulators of insurance, will step in to point out the problems that will be created by the proposed regulations.
Patrick Bracher
Norton Rose Fulbright South Africa
October 2025