Although the law permits the Department of Health (DOH) to develop and maintain a national database to assist in combatting the spread of COVID-19, which includes contact tracing and geospatial hotspot mapping, there have been some new amendments to the laws.
This is according to law firm Webber Wentzel, which notes these amendments coincide with the president’s announcement that substantive provisions of the Protection of Personal Information Act, 2013 (POPI) will commence on 1 July.
The purpose of the POPI Act is to ensure all South African institutions conduct themselves in a responsible manner when collecting, processing, storing and sharing another entity’s personal information, by holding them accountable should they abuse or compromise personal information in any way.
As the COVID-19 pandemic continues to spread in SA, government announced enhanced lockdown regulations, including those that allow tracking and tracing via cellphones.
The track and trace system is part of its broader support of the fight against the spread of the pandemic in the country.
Government says there are compelling public health reasons for this development, since the database has the potential to assist with policy formulation and with contact tracing.
However, while potentially demonstrating the rapid facilitation through technology of an important public service, there has been an outcry that the database may infringe on constitutional rights to privacy.
Webber Wentzel says the new changes to the COVID-19 database information are welcomed as they indicate the importance placed on the protection of the public’s right to privacy and the obligation on responsible parties to process personal information lawfully.
The law firm says some of the noteworthy amendments are that:
- Any information obtained by the DOH from an electronic communications service provider can only be obtained, used or disclosed by authorised persons and only when necessary to address and combat the spread of COVID-19.
- Although the DOH may develop and implement electronic systems or applications to be used on mobile devices or computers in order to collect information from the public for inclusion in the COVID-19 database – the DOH can only collect such information from members of the public on a voluntary and opt-in basis.
- Although private entities may provide the DOH with information regarding members of the public which is obtained from electronic systems/applications operated by the private entities for inclusion in the COVID-19 database – private entities can only collect such information on a voluntary and opt-in basis and must obtain the express consent of the individual to share the information with the DOH.
“The COVID-19 database may include names and surnames, identity and passport numbers, location addresses and cellphone numbers, COVID-19 test results of such persons and the details of the known or suspected contacts of any person who has tested positive for COVID-19,” says the law firm.
Share