Article by Melanie Coetzee
The 16 January 2023 Gauteng High Court decision, Hawarden v Edward Nathan Sonnenbergs Inc (attorneys), spotlights the severe liability risks attached to all the role players in the property cycle: from estate agencies to law firms inasfar as the electronic sharing of banking details and other information is concerned.
In this judgement, the Court ordered a R5,5mil damages award to the buyer of a property whose emails with the law firm, in respect of payment of the property purchase price, were unknowingly intercepted and as a result, the purchase price was paid to a fraudulent account. Email interceptions is not new and professionals in the property cycle try to avoid the interception risk with disclaimers on emails, warnings in correspondences with clients and other basic measures (such as requiring a whatsapp to follow on the email or the bank details being password protected). However, disclaimers and other current measures are clearly insufficient as the Court, in this Judgement, held that professional service providers carry a heavier duty of care towards their clients in terms of Data Privacy and Protection. The Protection of Personal Information Act 4 OF 2013 has further entrenched this duty of care by setting out the Regulatory Data Privacy standards in South Africa, which includes:
- All businesses having to have a proper and useful Data Privacy Policy in place in which it provides for the measures taken to protect clients and customers;
- All businesses having to have proper Employee Accountability tools in place as most of the cyber risks face the employees who use the IT systems;
- Formal training on an annual basis;
- All businesses having to have proper Operators Agreements in place to clarify the obligations and liability in sharing information and data with other organisations in its service or goods supply chain;
- Having proper customer/client onboarding processes and documentation available;
- Businesses conducting annual reviews of both their Policies, supporting documents and cyber security layering.
In the event that a Law Firm or an Estate Agency not being 100% compliant with the Regulatory requirements, even indemnity insurance may decline to cover the payment of damages such as those in the 16 January 2023 Court decision with the obligation to pay then vesting squarely on the directors or management’s shoulders. A very concerning thought.
If Estate Agencies and Law Firms are to avoid being held liable for damages suffered due to a client’s payments being misdirected, they should actively address their POPIA compliance and in particular the employee training component.
You can download and read the judgement here.
Melanie Coetzee is a seasoned conveyancing attorney and after having practiced in a corporate property law firm for 16 years, constituted her own Compliance Consultancy in 2021. Melanie specialises in supporting Law Firms and Estate Agencies with all aspects of Regulatory Compliance and in particular POPIA and FICA compliance. You can contact her on general@melaniecoetzee.co.za
