justice department nailed by Info Regulator over cyberattack

The Information Regulator has given out a R5-million administrative fine on the department of justice & constitutional development.

This punishment is said to be the first of its kind in South Africa and follows the justice department’s failure to comply with an enforcement notice issued on 9 May within the given 31-day period.

The requirements for the notice were that the department needed to show proof that it had renewed various licences pertaining to its antivirus software suite and initiated disciplinary proceedings against the officials whose failure to renew these licences compromised the security of its software systems.

It was on the 6th of September 2021 when the justice department was hit by a ransomware attack that left all of its information systems encrypted and unavailable. It impacted all the department’s electronic services, including the issuing of letters of authority, bail services, e-mail and the website. What the Information Regulator does is that it monitors and enforces the provisions of the Protection of Personal Information Act (Popia).

In its official notice regarding the justice department infringement, the regulator said: “The regulator may impose an administrative fine in the amount not exceeding R10-million, or liable upon conviction to a fine or to imprisonment of the responsible officials.” It is alleged that the department ignored the notice and, as a result, waived its right to appeal.

The department has three options in responding to the fine: it could pay it within the stipulated 30 days of its issue; it could negotiate with the regulator to pay the fine in instalments; or it could choose to be tried in court for contravention of Popia.

The department has until 2 August to respond to the Information Regulator.