Balancing privacy with public health: how well is South Africa doing?

By: Michael Sean Pepper, University of Pretoria and Marietjie Botes, University of Pretoria

The French mobile phone application StopCovid, developed to trace people who test positive with COVID-19.
Chesnot/Getty Images

COVID-19 spreads from person to person through droplet and contact transmission. That’s why contact tracing and quarantining have been included as one approach to control the spread of the virus. The aim is to ensure that the number of new cases generated by each confirmed case is maintained below the effective reproduction number.

This process entails identification, assessment and quarantining of people who have been exposed to the virus. But COVID-19 can be transmitted before people are symptomatic. Therefore, in an effort to prevent further transmission, “one-step-ahead” tracing and preemptive quarantining are important measures in limiting the spread of the disease.

President Cyril Ramaphosa acted swiftly once the first cases were identified in South Africa by declaring a national state of disaster. Among the measures taken was the gazetting of amended regulations for contact tracing. These allowed for the creation of an electronic contact tracing database in which the personal information of people infected with COVID-19 – or suspected to have come into contact with infected persons – could be aggregated. Personal information was to be collected from a variety of sources. This included mass testing as well as contact tracing using digital surveillance technologies.

But contact tracing poses a range of challenges – from technological through to the protection of personal privacy. South Africa needs to be cognisant of both if it’s going apply this correctly.

Technology issues

China and Singapore reported success in the use of cellular phones in the fight against COVID-19. Their success has been dependent on smartphone applications that collect GPS and bluetooth location and proximity data. Smartphone applications are also being used in a number of developed countries as virtual health passports.

This isn’t possible in the South African context as only 51% of people surveyed were reported to own smartphones.

South Africa relies on the triangulation of cell tower metadata supplied by electronic communication service providers. This is also problematic. In rural areas with few towers, triangulation is not possible. In urban areas, buildings scatter signals. Even under ideal conditions and with a high density of cell towers, it can only locate a phone to approximately 100 metres. This technology does not allow for identification of close contacts or retrospective traces.

Given these limitations, it is highly unlikely that cellular telephone tracing using cell tower metadata will contribute to identifying or locating COVID-19 cases or contacts in the country.

Read more:
Mobile phone data is useful in coronavirus battle. But are people protected enough?

Privacy issues

In South Africa, marred by historical systematic discrimination, recent abuses of power and continued social marginalisation, particular consideration needs to be given to the measures being used to contain the spread of COVID-19.

There is provision in South Africa law for cellular phone data to be accessed. Data are primarily used in anti-crime activities, and access requires a court order from a judge. Allegations that the information has been used in covert and unauthorised ways have raised suspicion. The use of some information has been challenged in the courts and in late 2019, the Gauteng High Court struck down key parts of the Regulation of Interception of Communications and Provision of Communication Related Information Act as being an affront to the constitutional right to privacy.

What is to stop the state from using the information gathered for contact tracing as a security measure – or for other purposes that fall outside the realm of public health?

In the case of COVID-19, the regulations authorise the Director-General of Health to issue tracking orders. The regulations also instruct the Minister of Justice and Correctional Services to appoint a retired High Court judge as the COVID-19 Designated Judge. Justice Kate O’Regan, a retired Constitutional Court judge, was appointed to oversee the contact tracing database.

To protect public health via contact tracing, balancing privacy rights with other constitutional rights is essential. This is not an easy task. The rights of people in the midst of an epidemic must be considered in both the textual setting of the South African Constitution and their socioeconomic setting.

Health data qualify as special personal information in terms of the Protection of Personal Information Act 4 of 2013. Additional safeguards are required when health data are collected, processed and stored. The Act was due to come into effect on 1 April 2020, but this has been postponed due to the pandemic.

This has left South Africa with its constitutional and common law protection of privacy.

Balancing act

A person’s right to access healthcare is determined by an intricately linked bundle of human rights. This includes the right to dignity, bodily and psychological integrity and privacy.

The government’s power to limit any rights during a pandemic by collecting personal information for purposes of contact tracing must be considered against its constitutional obligations. This includes taking reasonable measures to achieve the realisation of these rights within available resources.

Balancing these rights is nuanced by South Africa’s socioeconomic context, which influences how the rights may be exercised. For example, 13% of the population live in informal settlements, making it difficult to implement evidence based preventative methods such as social distancing and shelter in place directives.

In addition, South Africa relies on guidelines for ethical data management issued by international bodies for protection of people’s privacy during the COVID-19 pandemic. Its electronic contact tracing database is aligned with the interim guidance of the World Health Organisation on contact tracing during COVID-19.

The World Health Organisation has also provided training material and a link to software developed to enable countries to properly manage case-contact relationships and follow-up contacts.

The most essential data privacy principles include transparency, accountability, information quality, security and data subject participation. Data processing, consisting of collection, storage and use, must be lawful and for a clearly defined purpose. This purpose will determine the limits of use.

Protection of privacy goes much deeper than merely protection of personal information. The protection of personal information is fundamental to non-discrimination, human dignity and the freedoms of speech, association, movement and trade. These rights are central to any open and democratic society. The wellbeing and safety of a society as a whole during pandemics rely heavily on the codependent relationships between society, its individuals and their government.

The COVID-19 pandemic has highlighted weak points in the preparedness of countries to deal with large scale health care disasters. It has also pointed out constitutional weaknesses and shortcomings. Capitalising on the fear of another war and in realising his political ambition to establish the United Nations after WWII, Winston Churchill said “Never let a good crisis go to waste”.

Similarly, many modern-day politicians are exploiting the current crisis to strengthen their positions of power. The challenge for society is to seek to improve protection of rights and freedoms during the crisis, rather than to acquiesce in their abrogation.The Conversation

Michael Sean Pepper, Director, Institute for Cellular and Molecular Medicine & SAMRC Extramural Unit for Stem Cell Research & Therapy, University of Pretoria and Marietjie Botes, Post Doctoral Researcher, University of Pretoria

This article is republished from The Conversation under a Creative Commons license. Read the original article.

    Don’t miss out on the latest local news, interviews and competitions.

    Don’t miss out on the latest local news, interviews and competitions.

    Receive the latest news

    Subscribe To Our Newsletter



    Copyright Notice


    1.1 The contents of this Website, including but not limited to its compilation and arrangement, is the exclusive property of Kaya 959, alternatively the suppliers of content to Kaya 959, and accordingly remain protected by South African and International Copyright and Trademark laws.

    1.2 Any person accessing this Website, may not, save for downloading one copy for their personal computers and solely for their private and non-commercial use :

    1.2.1 Copy, disseminate, distribute, advertise, publish, adapt, modify or in any way reproduce the contents of this website for commercial purposes, unless this notice and any disclaimer attached thereto is published in its entirety, or unless the permission of Kaya 959 is obtained in writing.

    Privacy Policy


    POPIA ActTo promote the protection of personal information processed by public and private bodies; to introduce certain conditions so as to establish minimum requirements for the processing of personal information; to provide for the establishment of an Information Regulator to exercise certain powers and to perform certain duties and functions in terms of this Act and the Promotion of Access to Information Act, 2000; to provide for the issuing of codes of conduct; to provide for the rights of persons regarding unsolicited electronic communications and automated decision making; to regulate the flow of personal information across the borders of the Republic; and to provide for matters connected therewith.


    • section 14 of the Constitution of the Republic of South Africa, 1996, provides that everyone has the right to privacy;
    • the right to privacy includes a right to protection against the unlawful collection, retention, dissemination and use of personal information;
    • the State must respect, protect, promote and fulfil the rights in the Bill of Rights;


    • consonant with the constitutional values of democracy and openness, the need for economic and social progress, within the framework of the information society, requires the removal of unnecessary impediments to the free flow of information, including personal information;


    • regulate, in harmony with international standards, the processing of personal information by public and private bodies in a manner that gives effect to the right to privacy subject to justifiable limitations that are aimed at protecting other rights and important interests,
    1. Definitions and Interpretation

    1.1.“Personal Information” means information relating to an identifiable, living, natural person and where it is applicable, identifiable, existing juristic person, including all information as defined in the Protection of Personal Information Act 4 of 2013. 

    1.2  Parliament assented to POPIA on 19 November 2013. The commencement date of section 1Part A of Chapter 5section 112 and section 113 was 11 April 2014. The commencement date of the other sections was 1 July 2020 (with the exception of section 110 and 114(4). The President of South Africa has proclaimed the POPI commencement date to be 1 July 2020.

    1.3. “Processing” means the creation, generation, communication, storage, destruction of personal information as more fully defined in the Protection of Personal Information Act 4 of 2013.  

    1.4. “You” or the “user” means any person who accesses and browses this website for any purpose. 

    1.4. “Website” means the website of the KAYA 959 at URL www.kaya959.co.za or such other URL as KAYA 959 may choose from time to time.   

    1. Status and Amendments

    2.1. KAYA 959 respects your privacy. This privacy policy statement sets out KAYA 959’s information gathering and dissemination practices in respect of the Website. 

    2.2. This Privacy Policy governs the processing of personal information provided to KAYA 959 through your use of the Website. 

    2.3. Please note that, due to legal and other developments, KAYA 959 may amend these terms and conditions from time to time.  

    1. Processing of Personal Information

    3.1. By providing your personal information to KAYA 959 you acknowledge that it has been collected directly from you and consent to its processing by KAYA 959. 

    3.2. Where you submit Personal Information (such as name, address, telephone number and email address) via the website (e.g. through completing any online form) the following principles are observed in the processing of that information: 

    3.2.1. KAYA 959 will only collect personal information for a purpose consistent with the purpose for which it is required. The specific purpose for which information is 
    collected will be apparent from the context in which it is requested. 

    3.2.2. KAYA 959 will only process personal information in a manner that is adequate, relevant and not excessive in the context of the purpose for which it is processed. 

    3.2.3. Personal information will only be processed for a purpose compatible with that for which it was collected, unless you have agreed to an alternative purpose in writing or KAYA 959 is permitted in terms of national legislation of general application dealing primarily with the protection of personal information. 

    3.2.4. KAYA 959 will keep records of all personal Information collected and the specific purpose for which it was collected for a period of 1 (one) year from the date on which it was last used. 

    3.2.5. KAYA 959 will not disclose any personal information relating to you to any third party unless your prior written agreement is obtained or KAYA 959 is required to do so by law. 

    3.2.6. If personal information is released with your consent KAYA 959 will retain a record of the information released, the third party to which it was released, the reason for the release and the date of release, for a period of 1 (one) year from the date on which it was last used. 

    3.2.7. KAYA 959 will destroy or delete any personal information that is no longer needed by KAYA 959 for the purpose it was initially collected, or subsequently processed. 

    3.3. Note that, as permitted by the Electronic Communications and Transactions Act 25 of 2002, KAYA 959 may use personal information collected to compile profiles for statistical purposes. No information contained in the profiles or statistics will be able to be linked to any specific user.    

    1. Collection of anonymous data

    4.1. KAYA 959 may use standard technology to collect information about the use of this website. This technology is not able to identify individual users but simply allows KAYA 959 to collect statistics. 

    4.2. KAYA 959 may utilise temporary or session cookies to keep track of users’ browsing habits. A cookie is a small file that is placed on your hard drive in order to keep a record of your interaction with this website and facilitate user convenience. 

    4.2.1. Cookies by themselves will not be used to identify users personally but may be used to compile identified statistics relating to use of services offered or to provide KAYA 959 with feedback on the performance of this website. 

    4.2.2. The following classes of information may be collected in respect of users who have enabled cookies: The browser software used; IP address; Date and time of activities while visiting the website; URLs of internal pages visited; and referrers. 

    4.3. If you do not wish cookies to be employed to customize your interaction with this website it is possible to alter the manner in which your browser handles cookies. Please note that, if this is done, certain services on this website may not be available. 

    1. Security

    5.1. KAYA 959 takes reasonable measures to ensure the security and integrity of information submitted to or collected by this website, but cannot under any circumstances be held liable for any loss or other damage sustained by you as a result of unlawful access to or dissemination of any personal information by a third party. 

    1. Links to other websites

    6.1. KAYA 959 has no control over and accepts no responsibility for the privacy practices of any third party websites to which hyperlinks may have been provided and KAYA 959 strongly recommends that you review the privacy policy of any website you visit before using it further. 

    1. Queries

    7.1. If you have any queries about this privacy policy please contact us by emailing [email protected] 

    Competition Terms and Conditions

    • The competitions are open to all persons over the age of 18 years; except directors, partners, employees, agents, service providers, and consultants of Kaya 959, the sponsor and all its subsidiaries and its holding company, if any, as well as all spouses, life partners, parents, children, siblings, business partners and associates of such persons.

    • The outcome of the competition is subject to the decision of the judge/presenter, whose decision is final and no negotiation will be entered into thereafter. Neither Kaya 959, sponsors nor their agents will be held responsible or answerable to any dispute arising from the competition or prize awards.

    • Participants/listeners enter or take part in competitions at their own risk and Kaya 959 bears no responsibility for any loss, damage or harm suffered as a result of participation in any of Kaya 959 competition.

    • One listener is entitled to winning one prize in a period of 3 months. Kaya 959 reserves the right not to award a prize if the listener has won a prize prior during the 3 month window period. This also applies to listeners who provide family or friend’s contact details.

    • Kaya 959 reserves the right to redistribute all unclaimed prizes if not claimed after 3 months after being given away On Air or on the website.

    • Prizes are not transferable and may not be exchanged for cash.

    • Finalists will forfeit their participation in the competition if they fail to attend the draws.

    • The competition will run during the period advertised on Kaya 959; entries received outside of the competition period will not be considered for the competition draw.

    • Kaya 959 and their sponsors reserve the right to cancel, modify or amend the competition at any time if deemed necessary in their opinion, or if circumstances arise outside of their control.

    • By entering the competition, entrants agree to accept these rules and to be bound by them.