On 5 January, the Regulator, Adv Pansy Tlakula, delivered her enforcement notice on a complaint filed against the JSE by Inhlanhla Ventures.

She set aside the JSE’s refusal to disclose a series of share trades alleged by Inhlanhla to be suspicious – and ordered the exchange to notify all those involved in the trades so that they could submit representations on the release of the records requested by Inhlanhla.

The complaint related to a request for information that Inhlanhla had filed with the JSE in 2023 through a Promotion of Access to Information Act (PAIA) request. Inhlanhla had sought access to records and documents about trades executed on the JSE between 3 and 19 May 2020 in respect of shares of a company, enX Group Ltd.

Inhlanhla, which was adversely impacted by the trades, believed there had been market manipulation, but lacked the necessary evidence of who was behind the trading to confirm or refute its suspicions. So it asked the JSE, which records and stores this trading information, to hand it over.

We wrote about that PAIA request last year.

The Regulator’s enforcement notice confirms the finding of the Regulator’s Enforcement Committee and its PAIA division’s preliminary findings.

The enforcement notice is a carefully reasoned document, setting out the law and legal precedent for its decision. It highlights the imperatives of transparency and the principles of privacy in respect of companies in our constitutional regime.

The recent decisions from the Regulator are important contributions to South Africa’s understanding of what our laws require public and private bodies to disclose and how individuals’ and companies’ rights to privacy should be balanced with the fundamental principles of transparency.

• Read more about the Information Regulator’s decision ordering SARS to release former President Zuma’s tax records here.

Finding the correct balance is key to ensuring accountability.

Disclosure is the legal default

The first legal principle the enforcement notice highlighted is that our legal system sees access to information as the norm and any exemptions are exceptions. PAIA does set out circumstances in which disclosure can or must be refused – but the Regulator stressed that these must be “narrowly construed” and that the burden of justifying that the grounds apply falls squarely on the body seeking to refuse an access request.

In this case, the Regulator found that the JSE had failed to discharge its onus because it had only provided a “mere assertion” and “pure speculation” that the disclosure would cause harm.

The JSE is a public body

The Regulator considered the question of whether in this context the JSE was a public or private body. This was important because the “reasons and motive” for the request are irrelevant for a request to a public body, whereas for a request to a private body the request has to be justified in terms of rights that the requester is seeking to protect or vindicate.

Inhlanhla made the PAIA request as if the JSE was a public body, whereas in its dispute of the complaint, the JSE asserted that it was a private body.

The Regulator found otherwise.

The Regulator noted that the JSE itself aligned its PAIA manual and other processes with the legislation’s provisions governing public (not private) bodies, and that its decision to refuse Inhlanhla’s request was made in terms of PAIA’s grounds of refusals for public bodies. It found that “the JSE presented itself as a public body for purposes of PAIA to the general public and to [Inhlanhla] in particular”.

It also refers to an old case from the Johannesburg High Court which had held that “[t]o regard the JSE as a private institution would be to ignore commercial reality and … ignore the very public interest which the Legislature … has sought to protect”.

The records requested by Inhlnhla are records reflected in the JSE’s Broker Deal Accounting (BDA) system. According to the JSE’s submissions, information is supplied by traders and brokers to the JSE for the purpose of enabling the JSE to fulfil its monitoring functions and regulatory responsibilities in the Financial Markets Act (the FMA).

The regulator ruled that this demonstrated unequivocally that those records were held in the exercise of a public function – and therefore for the purpose of such a PAIA request the JSE was a public body.

Personal information

The second legal principle the Regulator addressed is whether the disclosure of the personal information in the records sought by Inhlanhla would be “unreasonable”. PAIA only prohibits the unreasonable disclosure of personal information, not all and any disclosure of that type of information.

The JSE had maintained that it could not provide the information sought because it included the names, addresses, contact information, ID numbers, residency status, and possibly the tax number of the JSE’s clients. It submitted that the JSE did not have the client’s consent to disclose this information, it was not publicly available and it could not be meaningfully severed from records disclosed to Inhlanhla.

The Regulator discussed the importance of balancing the rights of access to information and to privacy.

A key question in this balancing exercise is whether the disclosure of information would intrude into the “inner sanctum of the private and personal life of the individual”. The Regulator highlighted that the recognition of privacy is to protect an individual’s personal affairs and that the “concept of privacy does not extend to a person’s business affairs”.

South Africa’s courts have discussed the limited nature of the privacy of business transactions and information in the past, and this enforcement notice builds on these broad legal principles.

The Regulator found that “society would not recognise an expectation of privacy by participants in the relevant enX Group trades to be reasonable”.

Contractual confidentiality

Finally, the Regulator confirmed that a contractual confidentiality agreement can never trump PAIA’s requirements of transparency and disclosure. It stated that “a duty of confidence cannot simply be created by agreement; non-confidential matters should not trump the constitutional right of access”.

This is important because, as the Supreme Court of Appeal found in 2006, it cannot be permissible for parties to a contract to simply subvert PAIA’s requirements by inserting a confidentiality clause.

This is true too for the JSE’s reliance on its governing legislation – the FMA – which prohibits the disclosure of confidential information “unless disclosure is required or permitted in terms of a law or a court order”.

The Regulator confirmed that PAIA is a law that permits disclosure, and so PAIA must trump any supposed prohibition on disclosure under the FMA.

In sum, this meant that the Regulator found that the JSE had failed to demonstrate that a legitimate ground for refusing Inhlanhla’s request existed and so ordered it to disclose all the requested information.

Audi

However, one legal principle that is fundamental in our law is audi alteram partem – “hear the other side”. PAIA recognises this principle in its requirement that bodies that have received a request for information inform any third parties who may be affected by the disclosure of the requested information and give them an opportunity to make submissions on whether they believe the body should grant the request.

The JSE did not issue any notices in terms of PAIA to third parties affected by Inhlanhla’s request. The Regulator found that all third parties still had a right to make representations on the possible disclosure of the information sought by Inhlanhla.

Accordingly, the Regulator instructed the JSE to issue the notices to third parties as required by PAIA, and conditioned the release of the information to Inhlanhla on its consideration of any third parties’ submissions.

A broader impact

While the crux of the Regulator’s enforcement notice focused on the technicalities of the JSE’s refusal, it did touch on the underlying reasons for Inhlanhla’s request.

In discussing the expectation of privacy, the Regulator noted that the question was “whether society expects personal information of participants in a highly regulated socio-economic activity, to be protectable; particularly where there are serious allegations made of market manipulation” (our emphasis).

The JSE plays a crucial role in regulating the market – but has been able to use its confidentiality clauses and contractual arrangements to deflect true accountability. How many of us really know what goes on behind that slick glass frontage?

The JSE told us that it will be reviewing the decision and will be applying to court to set aside the Enforcement Notice. It said that “[g]iven that this matter involves personal, commercially sensitive and confidential regulatory information, it would be inappropriate for the JSE to make any substantive comment at this stage.”

Inhlanhla’s request isn’t an abstract request for information. PAIA requests seldom are. The legislation frequently serves as the only opportunity for individuals to access information that will help them to vindicate their own rights or hold other people accountable.

For too long, PAIA requests have been treated as nuisances by bodies across the public and private sector. As the Regulator has noted here, refusals are given with no justification and processes are not followed.

And for too long, regulatory bodies and other entities with public and private functions have failed to accept their obligations to be accountable to the South African public as well as their shareholders.

But this enforcement notice is a warning to the JSE and other similarly-placed bodies.

Can we dare to hope that this positive start to 2026 will continue?

The post Analysis: JSE gets a whipping at the Information Regulator appeared first on AmaBhungane Centre for Investigative Journalism.

We believed that the records would demonstrate that Zuma had not declared all his income to the South African Revenue Service and we had a suspicion that SARS was treating Zuma with kid gloves.

This week, we have been vindicated. On Wednesday, Adv Pansy Tlakula, the Information Regulator, issued an enforcement notice, compelling SARS to disclose all the information we requested. 

The notice and its reasoning is a ringing endorsement of everything we have argued over the past nearly 7 years. It is also a stinging rebuke to the manner in which SARS handled Zuma’s continued failure to abide by his tax obligations.

After SARS refused those first PAIA applications, we took the fight all the way to the Constitutional Court. In May 2023, the Constitutional Court ruled that the tax legislation and PAIA were unconstitutional to the extent that they did not provide for disclosure of tax payer information if the public interest demanded it.

PAIA recognises categories of information which cannot be disclosed, including tax payer information. However, it also creates a “public interest override” and stipulates that a public body must nevertheless disclose information falling into these categories if it would reveal evidence of a substantial contravention of or failure to comply with the law and the public interest in the disclosure clearly outweighs the harm caused by disclosure. 

Following the court victory, we went back to SARS and filed two new requests for information – for Zuma’s tax returns and for various other documents related to his tax affairs. In December 2023, SARS again refused our requests, stating that the documents we requested did not disclose evidence of a contravention of or failure to comply with the law.

And so, we ended up at the Information Regulator, the new regulatory body established to ensure compliance with PAIA and the Protection of Personal Information Act (POPIA). 

Read more about our experience with the Information Regulator here and here

In this week’s findings, the Regulator reiterated that the purpose of the public interest override is to balance the rights to privacy and to access and that it “ensures that important information is disclosed to the public when transparency and accountability justify disclosure above the competing interests”. 

When determining whether the public interest override applies there are two questions to ask: would disclosure reveal evidence of a substantial contravention of or failure to comply with the law, and  whether the public interest in disclosure outweighs the potential harm of disclosure. 

A contravention of the law

The Regulator was unequivocal in answering the first question in the affirmative. It found that Zuma filed his tax returns late every year of his presidency (and then only after a final demand was issued), he under-declared his taxes in 2017 and 2018 (and received penalties for this), he was criminally charged with making false statements in his returns, and he failed to show gross income or material facts in his returns.

Importantly, the Regulator also identified that the information’s disclosure may not only reveal evidence of President Zuma’s contravention of the law; it “may well” also reveal evidence of SARS’s misconduct.

The documents may show how SARS’s “soft approach” to Zuma meant that it failed to perform its constitutional obligations “diligently and without delay” and had failed “to hold Mr. Zuma to the prompt and fulfilment of his tax obligations”. 

The Regulator concluded that SARS’s “apparent failure” to enforce tax legislation in respect of Zuma “constitutes a failure by SARS to comply with the law,” and said that “both legitimate and serious questions can be raised in relation to the manner in which SARS handled Mr. Zuma’s tax affairs and repeated transgressions.”

During the Information Regulator process, there had been debate about whether the documents would reveal there had been a “substantial” contravention of the law, as required by PAIA.

Again, the Regulator was unequivocal. It wrote that the contraventions “can only be substantial” because Zuma broke the law “on numerous occasions” each of which constituted an offence with a prison sentence and that “failure by the President of South Africa to comply with the law is substantial”

Here again, the Regulator had choice words for SARS’s conduct: “the seriousness of the violation of the law does not depend on the extent to which the guardians of the law choose to enforce it”.

A public interest in transparency

In determining whether the public interest in the disclosure of Zuma’s tax records outweighed the harm to Zuma himself or SARS and its ability to collect tax revenue, the Regulator highlighted the importance of transparency in our public bodies.

It confirmed that the public has an interest in knowing whether SARS is exercising its powers fairly and consistently and whether the President is complying with his own tax obligations. It stressed that this is “crucial for maintaining trust in public institutions and the rule of law”.

Beyond the public interest in these specific documents, the Regulator stressed that “there is a genuine public interest in promoting transparency, accountability, public understanding and involvement in the democratic process”.

In addition,  transparency into whether the President complied with tax laws and whether SARS acted appropriately “can act as a deterrent for other public officials or individuals who might consider evading tax or failing to meet their financial obligations.” 

The Regulator accepted that disclosure of records can infringe a person’s privacy but found that the information we sought was solely “commercial information” and so and so any incursion into Zuma’s privacy by disclosure was only a narrow one. 

This is a strong endorsement of transparency from the body also tasked with ensuring compliance with POPIA. 

A need for accountability

The Regulator’s findings demonstrates the importance of strong and rigorous accountability mechanisms in South Africa. 

In addition to enforcing compliance with PAIA, the Regulator has refused to allow SARS to evade responsibility and to weasel out of the obligations imposed on it by the Constitution and the law. 

It has emphasised that the president of the country is not above the law and that the public has a particular interest in knowing whether he or she is complying with the law. 

As our state institutions continue to weaken and impunity rises, the ability of the Information Regulator to hold our public bodies to account must be protected. 

The post A rare glimpse of accountability: the Information Regulator orders SARS to release Zuma’s tax records appeared first on AmaBhungane Centre for Investigative Journalism.