Balancing privacy with public health: how well is South Africa doing?

By: Michael Sean Pepper, University of Pretoria and Marietjie Botes, University of Pretoria

COVID-19 spreads from person to person through droplet and contact transmission. That’s why contact tracing and quarantining have been included as one approach to control the spread of the virus. The aim is to ensure that the number of new cases generated by each confirmed case is maintained below the effective reproduction number.

This process entails identification, assessment and quarantining of people who have been exposed to the virus. But COVID-19 can be transmitted before people are symptomatic. Therefore, in an effort to prevent further transmission, “one-step-ahead” tracing and preemptive quarantining are important measures in limiting the spread of the disease.

President Cyril Ramaphosa acted swiftly once the first cases were identified in South Africa by declaring a national state of disaster. Among the measures taken was the gazetting of amended regulations for contact tracing. These allowed for the creation of an electronic contact tracing database in which the personal information of people infected with COVID-19 – or suspected to have come into contact with infected persons – could be aggregated. Personal information was to be collected from a variety of sources. This included mass testing as well as contact tracing using digital surveillance technologies.

But contact tracing poses a range of challenges – from technological through to the protection of personal privacy. South Africa needs to be cognisant of both if it’s going apply this correctly.

Technology issues

China and Singapore reported success in the use of cellular phones in the fight against COVID-19. Their success has been dependent on smartphone applications that collect GPS and bluetooth location and proximity data. Smartphone applications are also being used in a number of developed countries as virtual health passports.

This isn’t possible in the South African context as only 51% of people surveyed were reported to own smartphones.

South Africa relies on the triangulation of cell tower metadata supplied by electronic communication service providers. This is also problematic. In rural areas with few towers, triangulation is not possible. In urban areas, buildings scatter signals. Even under ideal conditions and with a high density of cell towers, it can only locate a phone to approximately 100 metres. This technology does not allow for identification of close contacts or retrospective traces.

Given these limitations, it is highly unlikely that cellular telephone tracing using cell tower metadata will contribute to identifying or locating COVID-19 cases or contacts in the country.

Read more:
Mobile phone data is useful in coronavirus battle. But are people protected enough?

Privacy issues

In South Africa, marred by historical systematic discrimination, recent abuses of power and continued social marginalisation, particular consideration needs to be given to the measures being used to contain the spread of COVID-19.

There is provision in South Africa law for cellular phone data to be accessed. Data are primarily used in anti-crime activities, and access requires a court order from a judge. Allegations that the information has been used in covert and unauthorised ways have raised suspicion. The use of some information has been challenged in the courts and in late 2019, the Gauteng High Court struck down key parts of the Regulation of Interception of Communications and Provision of Communication Related Information Act as being an affront to the constitutional right to privacy.

What is to stop the state from using the information gathered for contact tracing as a security measure – or for other purposes that fall outside the realm of public health?

In the case of COVID-19, the regulations authorise the Director-General of Health to issue tracking orders. The regulations also instruct the Minister of Justice and Correctional Services to appoint a retired High Court judge as the COVID-19 Designated Judge. Justice Kate O’Regan, a retired Constitutional Court judge, was appointed to oversee the contact tracing database.

To protect public health via contact tracing, balancing privacy rights with other constitutional rights is essential. This is not an easy task. The rights of people in the midst of an epidemic must be considered in both the textual setting of the South African Constitution and their socioeconomic setting.

Health data qualify as special personal information in terms of the Protection of Personal Information Act 4 of 2013. Additional safeguards are required when health data are collected, processed and stored. The Act was due to come into effect on 1 April 2020, but this has been postponed due to the pandemic.

This has left South Africa with its constitutional and common law protection of privacy.

Balancing act

A person’s right to access healthcare is determined by an intricately linked bundle of human rights. This includes the right to dignity, bodily and psychological integrity and privacy.

The government’s power to limit any rights during a pandemic by collecting personal information for purposes of contact tracing must be considered against its constitutional obligations. This includes taking reasonable measures to achieve the realisation of these rights within available resources.

Balancing these rights is nuanced by South Africa’s socioeconomic context, which influences how the rights may be exercised. For example, 13% of the population live in informal settlements, making it difficult to implement evidence based preventative methods such as social distancing and shelter in place directives.

In addition, South Africa relies on guidelines for ethical data management issued by international bodies for protection of people’s privacy during the COVID-19 pandemic. Its electronic contact tracing database is aligned with the interim guidance of the World Health Organisation on contact tracing during COVID-19.

The World Health Organisation has also provided training material and a link to software developed to enable countries to properly manage case-contact relationships and follow-up contacts.

The most essential data privacy principles include transparency, accountability, information quality, security and data subject participation. Data processing, consisting of collection, storage and use, must be lawful and for a clearly defined purpose. This purpose will determine the limits of use.

Protection of privacy goes much deeper than merely protection of personal information. The protection of personal information is fundamental to non-discrimination, human dignity and the freedoms of speech, association, movement and trade. These rights are central to any open and democratic society. The wellbeing and safety of a society as a whole during pandemics rely heavily on the codependent relationships between society, its individuals and their government.

The COVID-19 pandemic has highlighted weak points in the preparedness of countries to deal with large scale health care disasters. It has also pointed out constitutional weaknesses and shortcomings. Capitalising on the fear of another war and in realising his political ambition to establish the United Nations after WWII, Winston Churchill said “Never let a good crisis go to waste”.

Similarly, many modern-day politicians are exploiting the current crisis to strengthen their positions of power. The challenge for society is to seek to improve protection of rights and freedoms during the crisis, rather than to acquiesce in their abrogation.

Michael Sean Pepper, Director, Institute for Cellular and Molecular Medicine & SAMRC Extramural Unit for Stem Cell Research & Therapy, University of Pretoria and Marietjie Botes, Post Doctoral Researcher, University of Pretoria

This article is republished from The Conversation under a Creative Commons license. Read the original article.