COVID-19: TRACING CONTACTS

In an attempt to combat the novel COVID-19 pandemic, on 25 March 2020, the Minister of Communications, Telecommunications and Postal Services, Stella Ndabeni-Abrahams, announced that cell phone data would be utilised to curb the spread of COVID-19.

Other governments across the world are also planning to make use of location data to monitor the spread of COVID-19, with some indicating that they will work with mobile network operators and make use of anonymous (‘de-identified’) location data to create movement maps.

Contact tracing is a controversial issue worldwide due to differing legal requirements for data protection across various countries. South Korea, for example, was quick to implement legislation that allowed health officials to aggressively trace the footsteps of citizens who test positive for an emerging infectious disease.

Using security camera footage, credit-card records, GPS data from cell phones and car navigation systems, they are able to pinpoint exactly where a person has been. South Koreans are also notified when a person in their district contracts COVID-19 and they are given highly detailed information about their whereabouts – including the exact bus they may have taken and whether or not they wore a mask. Names are, however, not released.

By contrast, this type of aggressive contact tracing would probably be impossible in the United States as there would be serious privacy concerns and civil-liberty law suits.

South Africa has opted for a middle-ground approach to contact tracing.

In the amended Disaster Management regulations gazetted on Thursday, 2 April 2020, (Regulations) the government has detailed the approach to be taken by the Department of Health to develop and maintain a national database to allow the tracing of people who are known or reasonably suspected to have come into contact with anyone known or reasonably suspected to have contracted COVID-19 (COVID-19 Tracing Database).

The COVID-19 Tracing Database, which is to be kept confidential, will include the names and surnames of those who have been tested for COVID-19, their ID numbers, addresses, cell phone numbers, the outcome of their COVID-19 tests and, importantly, the details of their known or suspected contacts.

Under the amended regulations, the Director-General of the Department of Health has the power to direct telecommunications service providers to provide the location and movement of any person known or reasonably suspected to have contracted COVID-19 between 5 March 2020 and until the state of disaster has terminated. This will allow the Department of Health to access information from mobile network operators about individuals’ movements.

In South Africa last week, when the Government indicated its intention to use cell phone data in the fight against COVID-19, many mobile network operators had questions around the legality of contact tracing.

Under general data protection principles (given that South Africa’s comprehensive data protection legislation, the Protection of Personal Information Act, 2013 (POPIA) is not yet in effect), personal information can be collected, used and stored where, among other things, the person collecting and using the information has a legal obligation to do so, it is necessary in order for a government or other public body to perform its public law duties, or it is necessary to pursue the legitimate interests of the person collecting and using the information.

Consent by data subjects (such as people who have been tested for COVID-19) is not required. Health information in particular, which is sensitive personal information, can only be processed for very limited purposes, including the exercise of legal rights and obligations and for historical, statistical and research purposes where a public interest is served. Accordingly, contact tracing is not necessarily impermissible from a data protection and privacy perspective, provided that it is subject to strict controls.

The types of controls contained in the Regulations include that the information may only be obtained, used or disclosed by authorised persons and where necessary for the purposes of addressing, preventing or combating the spread of COVID-19.

The Director-General of the Department of Health must, within six weeks after the national state of disaster has lapsed, or has been terminated, notify every person whose information has been obtained that information regarding their location or movements was obtained in terms of these amended regulations.

In addition, within six weeks after the end of the national state of disaster, the information in the COVID-19 Tracing Database must be de-identified (and the de-identified information may only be retained and used for research, study and teaching purposes).

Further, in an attempt to reassure the public that voice conversations and messages will not be listened to, the regulations explicitly state that nothing in the regulations entitle the Director-General of the Department of Health, or any other person, to intercept the contents of any electronic communication.

The lawful interception and monitoring of communications by law enforcement agencies is dealt with in separate legislation, the Regulation of Interception of Communications and Provision of Communication-Related Information Act, 2002 (RICA), and the contact tracing provisions in the Regulations have a very different objective from RICA.

The Information Regulator (IR), who is the authority appointed to monitor and enforce compliance with the provisions of POPIA once they become effective, has issued a guidance note weighing in on the issue of contact tracing and has voiced its agreement that the regulations are not in conflict with POPIA. The IR’s view is that a person who has tested positive for COVID-19 does, in fact, bear a duty to disclose his or her status, to enable the government to take appropriate measures to combat the spread of COVID-19. Further, the IR has confirmed that, in its view, telecoms operators can provide the government with location-based data of data subjects and that the government can use this personal information to conduct mass surveillance of data subjects, provided that the personal information is anonymised or de-identified in a way that prevents its reconstruction in an intelligible form.

Under the Regulations, Justice Minister Ronald Lamola is tasked with appointing a judge to oversee the tracing and tracking process. The designated judge is to receive weekly reports, including the names and details of everyone traced, and may make recommendations as he or she deems fit regarding the amendment or enforcement of the Regulation in order to safeguard the right to privacy while ensuring the ability of the Department of Health to engage in urgent and effective contact tracing to address, prevent and combat the spread of COVID-19.