Gauteng's e-Panic Button exposed crime reports, photos and GPS locations, DA tells information regulator

The DA is laying a complaint with South Africa’s Information Regulator over a data breach in Gauteng’s e-Panic Button app, and wants the provincial e-government department to answer for how long residents’ information was exposed and whether anyone accessed it without authorisation.

The party’s Gauteng spokesperson for e-government, Michael Waters, said the complaint asks the regulator to establish whether the exposure amounts to a violation of the Protection of Personal Information Act, how the information came to be exposed, and how the department responded once it knew.

As TimesLIVE reported on 28 September, the breach was first set out in a GroundUp report. According to the DA, that reporting found the system had exposed the names and personal details of people who used the app to report crimes, the contents of those reports, photographs, GPS locations and location histories.

Reports involving domestic violence and assault were among the information that could be reached, the party said, and the one-time PINs used to log into the application were also reportedly exposed. Some of the affected information dates back to the app’s launch in 2024.

The e-Panic Button is a Gauteng provincial government application that lets residents call for police or emergency help from a phone, transmitting their location to responders. That design is the point of it, and it is also why the data it holds is unusually sensitive: a person who presses the button has told the state where they are, what is happening and who is involved.

Waters said the department had not told the Gauteng legislature’s portfolio committee responsible for e-government about the breach. “It is disturbing that this data breach was exposed in a report by GroundUp and not by the department first,” he said.

The party wants the department to appear before that committee and explain how long the information had been exposed, whether unauthorised people had accessed it, and whether access logs had been independently examined. It is also asking the provincial government to say what measures have been taken to protect the people whose details were caught up in the exposure, and who will be held accountable.

“Residents who report domestic violence, assault and other serious crimes must be able to trust that the information they provide to the government will be protected,” Waters said.

The timing sharpens the concern. Gauteng has been dealing with a heavy run of gender-based violence and the murders of women in the province, including 12 women whose deaths were recently reported in Ekurhuleni. An app that encourages people to report violence is only useful if the person reporting is not put at further risk by doing so.

The DA has also questioned the province’s continued investment in e-Panic Buttons given the questions now hanging over its cybersecurity.

Under the Protection of Personal Information Act, a responsible party that suffers a breach must notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovering it. The regulator has the power to investigate, to issue enforcement notices and to impose administrative fines. Whether any of that follows in this case is now a question for the regulator, not a conclusion.

What the public record does not yet show is equally part of the story. The department has not said when it learned of the exposure, what it did about it, or how many residents are affected. Those answers sit with the department and, if the DA gets its way, with the portfolio committee.

Source: TimesLIVE, DA calls for probe into Gauteng e-Panic Button data breach