On 26 March 2020, South Africa commenced its 21 day lockdown period aimed at reducing the spread of the coronavirus disease 2019 (COVID-19). Along with this lockdown period, came along new regulations that looked to enforce that citizens stay at home unless they needed to leave their homes.

In declaring South Africa’s State of Disaster by amending the Disaster Management Act, it was also legislated that private Internet and digital sector organizations must, upon government's request, provide the location-based services to combat the spread of COVID-19.

"To assist track and trace efforts, [Electronic Communication Network Service] and [Electronic Communication Service] licensees, internet and the digital sector, in general, are directed to provide location-based services in collaboration with the relevant authorities identified to support designated departments to assist and combat the spread of COVID-19," reads section 8.1 of the Electronic Communications, Postal and Broadcasting Directions issued under regulation of the Disaster Management Act, 2002 (Act No. 57 of 2002) as signed law by Stella Ndabeni-Abrahams, South Africa's Minister of Communications and Digital Technologies, on 26 March 2020.

Given that Section 8, titled Individual Tracks and Trace, contained two short paragraphs including the one above, it is understandable that South African citizens became concerned about how the state was going to conduct this tracing and whether or not such mobile phone tracking and tracing will involve the invasion of people's privacy beyond COVID-19 purposes. Such concerns become even more important when considering that just in 2019 a High Court in South Africa found the state guilty of mass surveillance of citizens without proper processes being followed.

Tracing of people who were tested for COVID-19 in South Africa

As such, barely a week after the initial tracking and tracing regulations were signed into law, more clarity was provided as more details were added to the regulations. Specifically, there was more details to explain how the whole process will be conducted and notably that a Judge will be appointed to provide oversight.

DISASTER MANAGEMENT ACT, 2002: AMENDMENT OF REGULATIONS ISSUED IN TERMS OF SECTION 27(2) - 2 April 2020

What is important to note and has been clarified is that the tracing will only be used to locate people who have been tested for COVID-19 for healthcare purposes. The details of such persons will be stored in what will be known as the "COVID-19 Tracing Database." The database, as stated in Chapter 3 of the amended Disaster Management Act regulations will only store the contact details of the people who have "tested for COVID-19."

From a privacy perspective and concerning South Africa's Protection Of Personal Information Act (POPIA), the changes also stipulate that 6-weeks after the State of Disaster has been ended, the database will be de-identified.

It is important to note that the COVID-19 Tracing Database will contain the details of all people who have tested for COVID-19 in South Africa, not just those who tested positive. For those that tested positive, it will only be used to locate them if they cannot be contacted using the contact details they supplied when getting their test done.

Who will have access to South Africa's COVID-19 Tracing Database?

From the initial regulations, and partly why privacy concerns were raised by many, it was not clear as to who will have access to issuing tracing and tracking instructions and who will be responsible for storing such data.

To that effect, it has been specified that the Director General of the Department of Health will be the custodian of the database and importantly, will be the only person who can issue a directive for the tracking and tracing (location and movement data) of any person who tested positive for COVID-19 or is suspected of having contracted the virus. Furthermore, putting to rest any privacy concerns, the amended regulations state that:

"Nothing in this regulation entitles the Director-General: Health or any other person to intercept the contents of any electronic communication."

Although the new amendments are transparent as to how the COVID-19 Tracing Database will be used and who has access to it, we still need to remain vigilant and alert to ensure that those in charge follow the regulations as they are stated given that the database will, once mass testing spreads across South Africa, become a comprehensive one containing many South Africans personal details.

Share this via: