Automated Decision-Making and the Right to an Explanation Under POPIA in South Africa: A Legal Perspective

Abstract

The Protection of Personal Information Act 4 of 2013 (POPIA) establishes crucial safeguards against the risks posed by automated decision-making (ADM), particularly under section 71. This section restricts ADM that produces significant legal or personal effects unless specific exceptions apply. However, POPIA does not explicitly grant a right to an explanation, leaving uncertainties around how data subjects can meaningfully contest or understand ADM decisions. Using a doctrinal and comparative methodology, this article examines the legal implications of the provisions of section 71, focusing on its interpretation as either a prohibition against ADM or merely a right to object. The findings highlight the practical and theoretical challenges of defining ‘solely automated’ processes, revealing potential loopholes where nominal human oversight may undermine protections. Comparisons are drawn with international frameworks, such as the European Union’s General Data Protection Regulation (GDPR), to explore how a right to explanation might enhance transparency, accountability, and data subject rights under POPIA. The article further investigates the adequacy of POPIA’s ‘appropriate measures’ requirement, including the necessity of notification rights and clear standards for providing meaningful explanations. By distinguishing between ex-ante and ex-post explanations and between system functionality versus specific decision rationales, it identifies gaps in POPIA’s framework and proposes legal reforms. The article concludes that POPIA requires reform to strengthen algorithmic accountability and data subject protection. It recommends introducing an explicit right to explanation, clarifying the scope of ADM prohibitions, and implementing independent auditing mechanisms to strike a balance between innovation and accountability.