South Africa’s COVID-19 Contact Tracing – A Lawful Limitation on Privacy?

The governments’ efforts to combat the spread of COVID-19 and deter contravention of the Lockdown Regulations have been fortified.

 

With the establishment of the COVID-19 Tracing Database, the balancing of citizens constitutional rights comes to the fore, in particular, our rights to life and security versus privacy and protection of personal information.

 

Chapter 3 of the Amendment to the Disaster Management Act Regulations (“the Amendment”) introduces the COVID-19 Contact Tracing measures.

 

What is CONTACT TRACING?

 

People who are in close contact with someone who is infected with a virus are at a greater risk of contracting the virus and possibly spreading it. Contact tracing is a measure or process whereby the movements of those who are infected and the people with whom they were in contact (“contacts”) are monitored.

 

COVID-19 CONTACT TRACING IN SOUTH AFRICA

 

While South Korea swiftly introduced aggressive laws empowering health officials to track the exact location of infected persons – using camera footage, GPS data and car navigation with anonymous alerts to citizens about new infections in their vicinity, South Africa has taken a more moderate approach.

 

The Amendment establishes the COVID-19 Tracing Database in which personal information about an infected person or a person suspected to be infected is kept.

 

This database will include the names and surnames of those who have been tested for COVID-19, their ID numbers, addresses, cell phone numbers, the outcome of their COVID-19 tests and, importantly, the details of their known or suspected contacts. The contents of the database are to be kept confidential with disclosure of the information permitted only if authorised or where ultimately for the purpose of addressing, preventing or combatting the spread of COVID-19.

 

Monitoring movement and location

 

The Amendment empowers the Director-General of the Department of Health (“the DG”) to compel licensed mobile network operators (“MNO” and/or “MNO’S” as appropriate) to provide details on the location and movement of any person known or reasonably suspected to have contracted COVID-19 between 5 March 2020 and until the state of disaster has terminated.

 

In terms of the Amendment, people who have been tested for COVID-19 (data subjects for these purposes) do not need to be notified or to provide their consent for an MNO to share their location or movements with the DG.

 

This measure no doubt represents an encroachment on privacy and raises concerns about the legality of this limitation.

 

ARE THE COVID – 19 CONTACT TRACING MEASURES LAWFUL LIMITATIONS ON PRIVACY RIGHTS?

 

South Africa’s Protection on Personal Information Act, 2013 (POPI) is not yet operative. As such, regard must be had to legal principles which inform POPI as well as international data privacy laws such as the General Data Protection Regulation (GDPR).

 

In essence, privacy laws are geared toward protecting the unauthorised or unlawful disclosure of a data subject’s personal information. Which means that, subject to lawful and necessary exceptions and strict control measures, no person (natural or juristic) can store, collect or share a data subject’s personal information without first obtaining that person’s permission.  The exceptions include instances where the collection, use and /or disclosure of the information is a necessary and proportionate measure to safeguard national security, to enable the exercise of judicial or regulatory functions, to protect legal processes and to serve the public interest.

 

As such, contact tracing is not per se illegal provided that the impetus for such measure falls within lawful exemptions and are subject to strict controls. From this perspective, the Amendments are rational and represent a balanced approach to the privacy right limitation. Lawfulness of the imposition has been maintained through controls contained in the Amendment. In that:

 

• the information (on movement and location) is limited to the period from 5 March 2020 until the end of the state of the national disaster;

 

• the information can only be obtained, used or disclosed by authorised persons and where necessary for the purposes of addressing, preventing or combating the spread of COVID-19;

 

• the DG must, within six weeks after the national state of disaster has lapsed, or has been terminated, notify every person whose information has been obtained that information regarding their location or movements was obtained in terms of these amended regulations;

 

• within six weeks after the end of the national state of disaster, the information in the COVID-19 Tracing Database must be de-identified (and the de-identified information may only be retained and used for research, study and teaching purposes); and

 

• information on location and movement does not entitle the DG to intercept electronic communication – which means the voice messages and texts may not be accessed.

 

In conclusion.

 

While contact tracing is controversial it is useful in assisting the authorities to help those who are infected and prevent further transmission. Privacy rights are limited in these times but subject to strict protocols set out in the Amendments. The right to life and the security of our nation is paramount and lawful limitations in exceptional circumstances must be appreciated.

 

If you have any questions regarding the protection of personal information and/or any other data privacy as it applies to you and your business and as it evolves in response to COVID-19, contact us on 021 9488 273 or send us an email at info@oreillylaw.co.za

 

Article by Alexis Levor

 

Alexis Levor is a commercial and regulatory compliance lawyer at O’Reilly Law Inc.

 

Disclaimer: The materials available at this website are for informational purposes only and not for providing legal advice. Use of and access to this website or any of the e-mail links contained within the site do not create an attorney-client relationship between us and the user or browser.