Members asking for scheme information
The commonest community-scheme dispute: a member asks for the owners’ roll or the arrears schedule, and the trustees refuse “because of POPI”. The refusal usually gets the Act backwards. The member is a third party with a legitimate interest — section 11(1)(f) expressly contemplates supplying information to such a third party — and membership rights (requisitioning meetings, electing trustees, scrutinising finances they fund) are about as legitimate as interests get:
“(f) processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.”
PAIA runs alongside: a record of a private body needed for the exercise or protection of rights is accessible on request. The correct trustee response is scope control, not refusal — supply what the membership purpose needs (minimality), and record the disclosure.
Scheme scenarios: lawful or not?
| Scenario | Verdict | Why |
|---|---|---|
| A member requests the contact list to requisition a general meeting | Lawful | Exercising membership rights is a legitimate interest (s 11(1)(f)); PAIA may add an enforceable access right. |
| Trustees review the arrears schedule to manage scheme finances | Lawful | Core trustee function — legitimate interests and the scheme’s governing legislation. |
| Publishing a named arrears list on the noticeboard or group chat | Not lawful | Shaming exceeds the purpose; minimality (s 10) and reasonableness (s 9) fail even though recovery itself is lawful. |
| CCTV at gates and common property with visible signage | Lawful | Security is a legitimate interest; signage satisfies the openness duty (s 18). |
| The managing agent processes owner data for the scheme | Lawful | The agent is an operator — a written contract with security terms is required (s 21). |
| Sharing an owner’s details with a marketer “for community benefit” | Not lawful | No ground covers it; electronic marketing would additionally trigger section 69. |
Scheme WhatsApp groups
Residents’ social groups — braais, lift clubs, lost cats — are purely personal or household activity, outside the Act entirely (s 6(1)(a)). An official scheme channel run by the trustees or managing agent is different: that is the body corporate processing members’ numbers for scheme communication, which a legitimate interest comfortably covers — but it is not a marketing list, and adding the trustees’ side businesses to it walks straight into section 69. The full analysis is on WhatsApp groups and POPIA.
Managing agents are operators
The managing agent processes the scheme’s personal information on its mandate — the definition of an operator. Section 21 requires the body corporate to have a written contract obliging the agent to maintain security safeguards and to report any compromise immediately. Trustees who have never seen such a clause in the management agreement have found their scheme’s first real POPIA gap — the same gap that anchored the Dis-Chem enforcement notice.