COVID19 Pandemic, Your Privacy Rights and Contract Tracing
In the current ‘tech’ age, privacy legislation and your rights as regards the processing of your personal information, has become increasingly important. This has seen data protection legislation being enacted on a global scale.
In the wake of the COVID-19 pandemic, authorities worldwide are harnessing the power of mobile technologies to assist in understanding and managing the spread of the disease. This controversial technique, whilst effective, could have disastrous consequences if not implemented with proper privacy checks and encryption.
In South Africa, the Protection of Personal Information Act (POPI) was signed into law on the 19th of November 2013 and published in the Government Gazette (Notice 37067) on the 26th of November 2013. This Act regulates, amongst others, the lawful processing of personal information, the rights of data subjects and security measures on integrity and confidentiality of personal information.
Once all provisions of the Act come into effect, fines and penalties can be imposed on companies, of up to R10 million for any transgressions. Therefore, companies throughout South Africa will have taken steps to ensure their POPI compliance.
The Information Regulator (Adv. Pansy Tlakula) was appointed by the National Assembly in December 2016, who along with her representatives will handle complaints, in relation to transgressions of the Act.
The POPI act saw South Africa‘s regulation serving to protect customer information and the interception of communications. It did not allow Cell phone companies to share any customer information without a Section 205 subpoena (issued in terms of the Criminal Procedure Act 51 of 1977) or without the consent of the customer.
However, after the proclamation of a national state of disaster in South Africa and in order to assist in curbing the spread of the Covid-19 virus, various amendments to the regulations were promulgated (Gazetted on 02 April 2020 in terms of Government Gazette No.11078 ).
Whilst these amendments set out the measures to be implemented to protect the privacy rights of data subjects, they simultaneously allow, amongst others, the Department of Health to direct cell phone companies to provide location and movement data of anyone suspected to have contracted COVID-19 or people who have been in close proximity to them. This is known as contact tracing which is back-tracing the steps of the infected individual in an attempt to find every individual who might have come in contact with them recently and is a key public health response to limit infectious disease outbreaks.
In terms of the Regulations, the National Department of Health has been directed to develop and maintain a national database to enable the tracing of South African residents who test positive for COVID-19 or who are suspected to have contracted the virus. This national database will include the following information:
• First & Last name
• Identity/Passport number
• Residential & Work addresses and / or other addresses where they could be located
• Cellphone number
• COVID-19 test results
• Personal details of all known or suspected contacts of anyone who has tested positive for the virus
To Safe Guard the rights of data subjects, Justice Catherine O'Regan has been appointed by Justice and Correctional Services Minister Lamola as the COVID-19 Designated Judge, to whom government will report to weekly, with the particulars of those who have been traced using cell phone data.
Justice O’Regan will be tasked with ensuring that the privacy and personal information of all individuals remains protected and to make recommendations to certain Cabinet members regarding the enforcement and/or amendment of the regulations in order to safeguard privacy.
In terms of the published regulations, all users whose data has been intercepted, must be informed thereof within six weeks after the lapse of the State of Disaster . With the COVID-19 cases escalating in recent weeks, contact tracing is imperative to curbing the spread and to “flatten the curve”. Although, we do not live in culture of trust when it comes to data, the weight of the value of privacy versus the potential to save lives, is not comparable. Hopefully, it is evident from the regulations published by the South African Government, they are striving to achieve a fair balance between contact tracing and data privacy whilst ensuring that the rights of all South Africans, albeit slightly limited during this time, remain protected.
