I recently had one of those interactions with an institution of the state that has earned back my respect in recent years, but it left me wondering whether anyone there has thought through the consequences of what they are asking ordinary citizens to do.
Tax season arrived and I duly engaged in the annual ritual, which I am sure many of you are familiar with: you submit your tax return, you almost immediately get informed you will be audited, no longer a surprise as it happens every year, and you wait to see what proof of expenditure is required this year.
As I said, this has become a ritual, and given that I am by nature organised, every invoice has been scanned and loaded into a share drive my tax consultant has access to. Usually, the ritual concludes with submitting the invoices and I get my refund. But no, not this year, the proof demanded was different and that raised my public health hackles.
To put this in context, I am a salaried taxpayer, and Sars already knows where my income comes from – my tax is collected through pay as you earn. I do not have a side hustle, I do not have a trust, an offshore structure, or some elaborate investment arrangement involving a mailbox in a tax haven and a lawyer named Nigel.
The deductions I claimed were modest and lawful – donations to registered charities and limited home-office expenses because I work from home most of the week.
What was different this year was that invoices were no longer sufficient proof of expenditure. To verify these expenses, I was requested to submit bank statements. I reasonably assumed redacted bank statements showing only the relevant transactions would do – unfortunately that was not acceptable. I was left with one of two choices: forgo the deductions or submit a full year of unredacted bank and credit card statements. So not a request to substantiate the expenditure I am deducting, but a request for my entire financial life.
That should concern far more South Africans than those currently trying to resolve a query with Sars. To be clear, this is not an argument that Sars does not have the legal power to request financial records – clearly tax authorities must be able to verify claims and detect fraud. But there is a profound difference between targeted verification and full financial exposure as a matter of routine.
That difference matters because a modern bank statement is no longer just a financial document. It is a behavioural record. It can reveal where you go, who you support, which doctors you see, what treatment you are paying for, whether you are in therapy, whether you are helping a family member in crisis, whether you are financially stretched, and, quite frankly, far more than any official needs to know to establish whether a small deduction is legitimate.
The question is, does any official actually need to know that you are seeing a psychiatrist, an HIV clinician, that you are in a rehab programme or paying for a GBV survivor’s stay in a safe house? That is where this stops being a tax story and becomes something much bigger. It becomes a story about privacy, stigma, trust and safety.
In South Africa, privacy is not an abstract middle-class preference. It is often a form of self-protection.
Many people already make healthcare decisions around what they do not want visible to employers, insurers, administrators, family members or anyone else who has no business knowing. They pay out of pocket for mental health therapy despite being insured. They privately fund HIV care, addiction treatment, reproductive health services or support linked to domestic violence because they fear exposure, judgement or stigma.
That fear is not always rational in a legal sense. But it is entirely rational in a social one.
We live in a country where people still hide their antidepressants in cupboards. Where HIV remains medically manageable but socially dangerous in the wrong setting. Where addiction is moralised, not treated. Where many would rather quietly suffer than risk the wrong person finding out.
Now imagine what happens when the message from the system becomes: if you want to claim what you are lawfully entitled to, you may have to disclose your entire private life.
As I discussed in previous articles, personal health information cannot be viewed as just administrative information that can be demanded by institutions at their whim.
This new Sars approach will inevitably lead to some people, like me, complying but feeling abused. That is how administrative systems begin to shape health behaviour without ever appearing in a health policy It becomes a story about privacy, stigma, trust and safety, this is the unintended consequence of bureaucratic overreach, and my concern is not just a health one but also a safety one.
South Africa is not a low-risk administrative environment. Cyber-crime is rising sharply across the continent, and South African banking and fraud reporting have shown steep increases in digital fraud losses and incidents according to Interpol. A year of full financial records can reveal routines, spending patterns, dependants, pressure points, treatment locations and lifestyle markers that would be deeply useful to criminals if ever exposed. That is what institutions often miss.
The danger is not only who is allowed to access sensitive information. It is what happens once that information exists in more places than it should.
Sars is right to say that taxpayer confidentiality matters. It has repeatedly stressed that taxpayer information is protected under the Tax Administration Act, and that taxpayer trust depends on that confidentiality. But trust is not protected only by what happens after data is collected; it is also protected by restraint before it is collected.
Privacy is part of how people remain safe. It is part of how they preserve dignity. It is part of how they seek help. It is part of how they remain willing to participate honestly in public systems.
- Dr Wolvaardt is the Founder of the Foundation for Professional Development and has recently stepped down as managing director.
- I recently had one of those interactions with an institution of the state that has earned back my respect in recent years, but it left me wondering whether anyone there has thought through the consequences of what they are asking ordinary citizens to do.
- Tax season arrived and I duly engaged in the annual ritual, which I am sure many of you are familiar with: you submit your tax return, you almost immediately get informed you will be audited, no longer a surprise as it happens every year, and you wait to see what proof of expenditure is required this year.
- As I said, this has become a ritual, and given that I am by nature organised, every invoice has been scanned and loaded into a share drive my tax consultant has access to.
- Usually, the ritual concludes with submitting the invoices and I get my refund.
- But no, not this year, the proof demanded was different and that raised my public health hackles.
