National Student Financial Aid Scheme v Commission for Conciliation, Mediation andArbitration and Others (2025/087146) [2026] ZALCCT 151 (7 September 2026)

CASE LAW UPDATE

Written by: Luzuko Jubase

In this matter, the Labour Court held that the CCMA commissioner had misdirected himself by finding that the dismissal of Ms Abrahams, an accountant employed by NSFAS, was substantively unfair and ordered her retrospective reinstatement.

The Labour Court’s judgment, revisited the commissioner’s reasoning therein and raised important questions concerning the handling of confidential employer information. Ms Abrahams was charged with gross negligence and/or the intentional disclosure of privileged and confidential information. The charge arose from allegations that, during 2022, and without the requisite authorisation, Ms Abrahams repeatedly forwarded and blind-copied her personal email address on several confidential work-related emails containing sensitive NSFAS information. It was alleged that, by transmitting confidential organisational information to her personal email account without authorisation, she exposed NSFAS to potential reputational and financial risk. The conduct was alleged to have contravened NSFAS’s Information Security Policy, which prohibits the forwarding of work-related emails and organisational information to personal email accounts, as well as its ICT Security Management and Acceptable Use Policy, which prescribes various restrictions and requirements governing the use of email and other ICT resources.

In terms of the NSFAS Disciplinary Policy, item 15 provides that the negligent and/or intentional disclosure of privileged or confidential information or documents constitutes misconduct for which dismissal is prescribed as the sanction for a first offence. Item 40, in turn, provides that a failure to comply with or observe NSFAS policies and procedures attracts a final written warning for a first offence and dismissal for a second offence. In proceedings before the CCMA, it was not in dispute that Ms Abrahams had forwarded the emails in question to her personal Gmail account. This conduct was common cause between the parties and therefore did not require further proof.

The issue was how that conduct should be classified.

The question was whether the conduct amounted to the careless or deliberate sharing of private and confidential information, as described in item 15 of the NSFAS Disciplinary Policy, or whether it was simply a failure to follow a workplace policy, as provided for in item 40. The learned acting judge in the Labour Court held that the aforesaid is the real question the commissioner of the CCMA had to decide. On review in the Labour Court, NSFAS contended that the commissioner had misconceived the nature of the enquiry before the CCMA. Firstly, it argued that the commissioner incorrectly approached the matter as one concerning whether confidential information had been disclosed to an unauthorised third party. Secondly, it contended that the commissioner applied an incorrect evidentiary threshold by requiring proof of probable, rather than possible, harm. Simply put, NSFAS argued that the commissioner had considered the wrong question and, as a result, had misunderstood the nature of the dispute that he was required to determine. It accordingly sought an order reviewing and setting aside the award and remitting the dispute to the CCMA for a fresh arbitration before a different commissioner.

In considering whether the commissioner had misconceived the nature of the enquiry, the Court held that the essence of the charge was the placement of confidential information on a personal platform outside the employer’s control. Put differently, the charge concerns the removal of confidential information from the employer’s control, not whether Ms Abrahams had disclosed the information to any further external person. The Court noted that this distinction is itself recognised in the NSFAS policy.

The Commissioner therefore misconceived the enquiry by focusing only on whether the information had been disclosed to an external party. NSFAS’s second argument was that the commissioner misdirected himself by requiring harm to be probable rather than merely possible. He held that, for the risk of the information reaching hackers or similar third parties to be relevant, the harm had to be probable. As no such probability was established, he found that the risk did not carry sufficient weight. The Labour Court disagreed with this reasoning and held that the probability of harm was not an element of the misconduct charged. It noted that NSFAS, as a public entity, holds the personal information of thousands of students and has a duty to safeguard it. NSFAS was therefore entitled, through rational policies, to determine the risks it was willing to accept and to prohibit employees from removing confidential information from its controlled environment. The issue was therefore not whether harm was probable, but whether the employee breached the policy protecting the information. By treating probable harm as the deciding factor, the Court held the Commissioner introduced a requirement that was neither part of the charge nor imposed by the policy. He therefore decided the matter on an incorrect basis.

For these reasons, the Court held that the Commissioner decided an issue that the charge did not raise, and failed to determine the issue that the charge did raise, the proper characterisation of the misconduct and the appropriate sanction. The award was therefore set aside, and the dispute was remitted to the CCMA for a fresh arbitration before a different Commissioner.