, PLEASE USE THIS DOCUMENT AS A GUIDE ONLY
1. In June 2023, a senior employee (X) at Smart Bank downloaded confidential client data and
saved it on his unsecured personal device. Thereafter, X sent an anonymous email demanding
the transfer of 30 million rand to a foreign bank account. He warned that failure to pay the
amount would result in the client's information being publicly disclosed online. Smart Bank has
consulted you, as their attorney, for advice on the prospects of success against employee X in a
criminal matter. In your discussion, you should address the following:
• The applicable legislation.
• Whether employee X can be charged with any offence(s).
• Discuss with reference to relevant legislation, case law, and opinions of legal commentators.
In June 2023, a senior employee (X) at Smart Bank allegedly downloaded confidential client data
and stored it on an unsecured personal device. X then sent an anonymous email demanding 30
million rand to a foreign bank account, threatening to disclose the client's information publicly if the
payment was not made. This case raises important legal questions regarding the applicable
legislation and the possible criminal charges X could face for his actions.
Applicable Legislation
The legal issues raised in this scenario primarily relate to the protection of personal and confidential
data, as well as criminal conduct such as extortion and data breaches. In South Africa, several pieces
of legislation may be relevant to this case, including:
The Protection of Personal Information Act (POPIA) (No. 4 of 2013) - POPIA governs the
processing of personal information, ensuring that data subjects’ personal information is
protected from misuse, unlawful processing, and disclosure (LCR4805, Study Guide, p. 24).
Under POPIA, the unauthorized access to, and disclosure of, confidential information, such as
client data, can lead to serious legal consequences.
The Cybercrimes Act (No. 19 of 2020) - The Cybercrimes Act criminalizes acts that involve
the unlawful interception, use, or disclosure of electronic communications and data. Section 14
of the Act specifically deals with the unlawful possession of personal information, while
Section 15 addresses the illegal disclosure of such information. Furthermore, the act
criminalizes extortion using electronic means, as seen in the demand for 30 million rand via an
anonymous email (Van der Merwe, DP, 2016, p. 65).
The Criminal Procedure Act (No. 51 of 1977) - The Criminal Procedure Act is relevant for
procedural matters and provides the framework for the prosecution of offenses committed
under the aforementioned statutes, including provisions on the admissibility of evidence, search
and seizure, and the rights of the accused.
1. In June 2023, a senior employee (X) at Smart Bank downloaded confidential client data and
saved it on his unsecured personal device. Thereafter, X sent an anonymous email demanding
the transfer of 30 million rand to a foreign bank account. He warned that failure to pay the
amount would result in the client's information being publicly disclosed online. Smart Bank has
consulted you, as their attorney, for advice on the prospects of success against employee X in a
criminal matter. In your discussion, you should address the following:
• The applicable legislation.
• Whether employee X can be charged with any offence(s).
• Discuss with reference to relevant legislation, case law, and opinions of legal commentators.
In June 2023, a senior employee (X) at Smart Bank allegedly downloaded confidential client data
and stored it on an unsecured personal device. X then sent an anonymous email demanding 30
million rand to a foreign bank account, threatening to disclose the client's information publicly if the
payment was not made. This case raises important legal questions regarding the applicable
legislation and the possible criminal charges X could face for his actions.
Applicable Legislation
The legal issues raised in this scenario primarily relate to the protection of personal and confidential
data, as well as criminal conduct such as extortion and data breaches. In South Africa, several pieces
of legislation may be relevant to this case, including:
The Protection of Personal Information Act (POPIA) (No. 4 of 2013) - POPIA governs the
processing of personal information, ensuring that data subjects’ personal information is
protected from misuse, unlawful processing, and disclosure (LCR4805, Study Guide, p. 24).
Under POPIA, the unauthorized access to, and disclosure of, confidential information, such as
client data, can lead to serious legal consequences.
The Cybercrimes Act (No. 19 of 2020) - The Cybercrimes Act criminalizes acts that involve
the unlawful interception, use, or disclosure of electronic communications and data. Section 14
of the Act specifically deals with the unlawful possession of personal information, while
Section 15 addresses the illegal disclosure of such information. Furthermore, the act
criminalizes extortion using electronic means, as seen in the demand for 30 million rand via an
anonymous email (Van der Merwe, DP, 2016, p. 65).
The Criminal Procedure Act (No. 51 of 1977) - The Criminal Procedure Act is relevant for
procedural matters and provides the framework for the prosecution of offenses committed
under the aforementioned statutes, including provisions on the admissibility of evidence, search
and seizure, and the rights of the accused.
