COVID-19 Surveillance Infosheet!

Background: surveillance

With the fight against COVID 19 intensifying, governments across the globe have started exploring, with some implementing, the use of Artificial Intelligence and Technology to try and curb the spread of the virus. Many states are now making use of different surveillance mechanisms at their disposal to respond to the pandemic and South Africa is no exception. This action has put the conversation about data and privacy rights protections and put a focus on in-country privacy laws to ensure that states do not embark on a pervasive mass surveillance of their citizens in the quest of addressing the CoronaVirus pandemic. This information sheet aims to simplify what the South African government has committed to doing in ensuring that the use of surveillance does not impact negatively on people’s rights to privacy and that necessary data protections are taken into cognizance, whilst the necessary safeguards are put in place to protect citizens during this period of COVID 19.  

Countries have been encouraged to subscribe to international standards and be in line with the global need to protect the rights of their citizen’s privacy. The WHO released guidelines on how countries should conduct themselves as they embark on surveillance use which directs states to conduct surveillance for COVID-19 in humans. In conjunction with WHO’s guidance on preparedness, readiness and response activities, which strongly recommend active case finding and testing as well as contact tracing in all transmission scenarios. Coupled with these guidelines, the WHO has given specific reflection on why and how this surveillance should conducted:  

i) Monitor trends in COVID-19 virus globally

ii) Rapidly detect new cases in countries where the virus is not spreading, and monitor cases in countries where the virus has started to spread.

iii) Provide epidemiological information to conduct risk assessments at national, regional and global level. 

iv) Provide epidemiological information to guide preparedness and response measures.

Recognizing that technology can play an important role in the global effort to combat the COVID-19 pandemic and the need for government to respond effectively, the past week saw the release of regulations promulgated specifically to make use of data and surveillance to track individuals who test positive for COVID19 as well as individuals who may have been exposed to or came into contact with a person who may be infected with the virus. 

Regulations were released through the ministry of Cooperative Governance and Traditional Affairs (COGTA) as an administrative body for the implementation of the  Disaster Management Act. In these regulations, a series of actions were proposed to ensure effective response to the spread of the virus while protecting the rights to privacy and data protection.

What The Regulations Say:

The Regulations issued in terms of section 27(2) of the Disaster Management Act, 2002, and as published on 2 April 2020 in Government Gazette No 43199, make provision for contact tracing and for a national database to enable the tracing of persons who are known or reasonably suspected to have come into contact with any person known or reasonably suspected to have contracted COVID-19.

The National Department of Health shall develop and maintain a national database to enable the tracing of persons who are known or reasonably suspected to have come into contact with any person known or reasonably suspected to have contracted COVID-19

1. The COVID-19 Tracing Database shall include all information considered necessary for the contact tracing process to be effective, including but not limited to:
2. a) the first name and surname, identity or passport numbers, residential address and other address where such person could be located, and cellular phone numbers of all persons who have been tested for COVID19;
3. (b) the COVID-19 test results of all such persons; and (c) the details of the known or suspected contacts of any person who tested positive for COVID-19.

• The COVID-19 test results of all such persons; and
• The details of the known or suspected contacts of any person who tested positive for COVID-19.

The role of Telecommunications companies:

 Mobile Telecoms companies will provide the actual geolocations that will enhance the ability to build a “heat map of where the virus may probably be spreading to”.

They will implement a track-and-trace system collating multiple data sources such as geographic information systems (GIS) to track an infected person’s exposure and who they may have unknowingly exposed to the coronavirus. 

What Government CAN and CANNOT do during Covid-19 surveillance:

“No person may disclose any information contained in the Covid-19 Tracing Database or any information obtained through this regulation unless authorized to do so and unless the disclosure is necessary for the purpose of addressing, preventing or combating the spread of COVID-19”.

CAN/SHOULD DO: 

• CAN: keep de-identified information of certain individuals who may have tested positive for the virus for public health research purposes 

• CAN: Appoint a Covid-19 designated judge to ensure proper oversight during the tracking and surveillance for Covid-19

• SHOULD: Provide weekly reports to the “Covid-19 designated judge” detailing the names and details of every person that is being tracked using this system

• Should: Take into cognizance, any further recommendations made to the minister on amending the regulations including to further protect privacy rights

• Should: Any person whose movements were traced using this system, will be notified within six weeks of the end of the national disaster
• CAN: arrest and hold liable, anyone who contravenes the law

CANNOT DO/SHOULD ENSURE: 

• CANNOT: Pass on your information to the “spies” Police and State Security Agency as these bodies are cut out of the process. 

• SHOULD ENSURE: No person’s data before March can be sought about their movements whether they tested positive for Covid-19 or not.

• SHOULD ENSURE: No person’s data can be sought after the national disaster
• CANNOT DO: Keep your information for more than six weeks after the surveillance has been completed

After State of Disaster, state Responsibility:

The government will be required to strip off any identifying information that was needed to identify and locate those known or suspected of having the virus and people they had been in contact with.  

Oversight of the surveillance:

“While the Government does all it can to implement measures to fight the spread of COVID19, the Designated Judge has an important role to play to safeguard the privacy and personal information of persons during this process”. 

The new rules provide for basic transparency through oversight by a judge. One of the key things this provides is to ensure that most data collected will be deleted within six weeks of completion of the tracking and ensure the tracking does not continue after the state of national disaster.

The Covid-19 Designated Judge may also make such recommendations to Cabinet members responsible for the departments of Cooperative Governance and Traditional Affairs, Health and Justice and Correctional Services as she deems fit, regarding the amendment or enforcement of this regulation in order to safeguard the right to privacy whilst ensuring the ability of the Department of Health to engage in urgent and effective contact tracing to address, prevent and combat the spread of Covid-19. 

Role and responsibilities of the designated judge:

• Receive a weekly report from the Department of Health containing the list of people who’s location and tracking has being done as provided by the cell phone service providers

• Provide the government with recommendations on how to protect privacy in relation to the part of getting information from cell phone providers while balancing the government’s legitimate need to use the data to be able to respond to the health challenge brought about by the virus

• Play oversight to ensure that the state is accountable to ensuring that they use the information gathered through this system, strictly for curbing Covid-19 and nothing beyond that.
• Look into any possibility that may require further protections be introduced should the current safeguards not be efficient

What Civil Society’s role can be CAN:

Support the designated Covid-19 judge through this period and make sure that they keep a watchful eye and demand greater transparency and cooperation from the state. We should also look to ensure that the designated judge’s report gets tabled and debated in parliament as we seek to hold parliament accountable wherever law breaking may have occurred.  

Annexure:

Designated Covid-19 Judge: Judge Katie O’Regan

About Justice O’Regan

Is a former Judge of the Constitutional Court of South Africa, having served for 15 years from 1994 to 2009.