Tracing contacts by limiting privacy in the Covid-19 world: Constitutional or unlawful?

On Friday, in an affidavit responding to an urgent application, President Cyril Ramaphosa went on oath for the first time to justify his actions to deal with the deadly Covid-19 pandemic: “Decisive action was imperative in order to save lives before the [Covid-19] virus reaches proportions that would have a significant strain on our medical system and add to the social maladies our country already faces… [I]f we do not act swiftly and radically the virus could soon place our entire health system under tremendous strain.” 

This was the government’s response to an urgent application, by the Fair and Equitable Society of South Africa (which has since been withdrawn) regarding the manner in which the police and army are enforcing the regulations published under the Disaster Management Act 2002 

Part of the “decisive action” put in place by the government to arrest the spread of the Covid-19 virus includes the new track-and-trace mechanisms which were enacted in the lockdown regulations published last week Thursday.  

These regulations followed a surprising announcement by Communications Minister Stella Ndabeni-Abrahams on 26 March 2020 that South African cellphone companies had agreed to provide the government with cellphone data in order to assist the effort to stop the spread of the virus. 

On the same day, electronic communications, postal and broadcasting directions were issued by Minister Ndabeni-Abrahams under the Disaster Management Act, 2002, which stated that electronic communication network service licensees, as well as the “internet and digital sector in general”, were to provide location-based services in order to support designated departments to assist and combat the spread of Covid-19. At that stage, however, it was unclear how the proposed trace and tracking mechanisms would work and how this information would be processed. 

But the latest regulations provide much-needed clarity on the mechanisms in place. 

The regulations state that: “The National Department of Health shall develop and maintain a national database to enable the tracing of persons who are known or reasonably suspected to have come into contact with any person known or reasonably suspected to have contracted Covid-19.”  This database shall include “all information considered necessary for the contact tracing process to be effective”, including the names, identity or passport numbers, address, cellphone number and Covid-19 test results of all persons who have been tested for Covid-19. In addition, the database will include the details of all persons known or suspected to have been in contact with any person who has tested positive for Covid-19. 

This information – which thus includes highly sensitive medical information – is to be obtained and provided to the Director-General: Health for inclusion in the Covid-19 database, by the person taking a sample for purposes of testing for Covid-19.

Importantly, the amended regulations enable the tracing of any person known or suspected to have contracted Covid-19 by making use of tracking technology. The regulations empower the Director-General to direct any licensed electronic communications service provider (such as MTN, Vodacom and Cell-C) to provide any information regarding the location or movements of any person known or reasonably suspected to have contracted Covid-19 or who has come into contact with a person who has contracted Covid-19.  This directive may be issued without prior notice to the person concerned. 

Experts have emphasised that the ability to trace persons who have been in contact with people who have tested positive for Covid-19 is critical to arresting the spread of the virus and thus saving lives. Thus track and trace mechanisms have been endorsed by the World Health Organisation.

Indeed, track and trace mechanisms have been put in place around the world in an effort to prevent the spread of the pandemic. It is reported that the Italian, Austrian and Belgium governments are using location data from telecommunication companies to track those who have contracted Covid-19. Germany is said to be launching a smartphone app which will trace coronavirus infections, like that of Singapore’s TraceTogether app; while South Korea is placing the data it is obtaining from individuals’ cellphones and credit card records on a publicly available map, which others can check to determine whether they may have come into contact with anyone who has tested positive for Covid-19.  

South Africa’s track-and-trace regulations have been passed against the background of the challenge to the surveillance laws under the Regulation of Interception of Communications and Provision of Communication Related Information Act, 2002 (RICA), which have been declared to be unconstitutional by the Pretoria High Court (the final determination awaits the Constitutional Court’s decision).  

In that case, the amaBhungane Centre for Investigative Journalism challenged various provisions of RICA. Judge Roland Sutherland found them to be woefully defective as the act did not strike the optimal, and lawful, balance between meeting the legitimate objectives of lawful surveillance (such as protecting national security and investigating serious crime) while respecting a citizen’s constitutional rights such as privacy. For instance, RICA allows the state to place a subject under surveillance without any obligation to notify them after the surveillance is over and does not prescribe proper procedures for the processing or storage of such information. 

Given this recent challenge, it was essential that the trace and track regulations contained sufficient safeguards and checks and balances to protect individuals’ rights to privacy while still assisting in the critical effort to stop the spread of the pandemic and thus save lives. It is to be welcomed that the regulations contain nine significant safeguards which go a long way in striking a fair balance between the right to privacy and the need to limit infections and “flatten the curve”.

The first safeguard is that the regulations make clear that no person is entitled to intercept the contents of any electronic communication.  While location data can be as sensitive as content, it is a welcome relief to know that no government official is entitled to peer into the contents of our texts, emails and social media communications, under the guise of addressing the Covid-19 pandemic.  

Second, the information obtained from cellphone companies may only be obtained in relation to the location or movements of persons from 5 March 2020 to the date on which the national state of disaster has lapsed or has been terminated (the default position under the Disaster Management Act is that a national state of disaster will automatically lapse after a period of three months if it is not extended).  

Third, once obtained, the information may only be used or disclosed by authorised persons for the purposes of addressing, preventing or combatting the spread of Covid-19. 

Fourth, any information provided by cellphone companies to the state as part of the track and tracking efforts may only be retained by the Director-General: Health for a period of six weeks. Once this period expires, the information must be destroyed.

The next safeguard is that the regulations provide for a Covid-19 designated judge to be appointed. The designated judge is responsible for ensuring that the right to privacy of all citizens is protected and must make recommendations to government on the amendment and enforcement of the regulations in order to safeguard the right to privacy while ensuring the ability of the Department of Health to prevent and combat the spread of Covid-19. The Director-General is also required to file a weekly report with the designated judge which sets out the names and details of all persons whose location or movements were obtained under the regulations. It was announced last Friday that highly respected former Constitutional Court Justice Kate O’Regan has been appointed as the designated judge.  

The sixth safeguard is that the Director-General: Health must, within six weeks after the national state of disaster has lapsed or has been terminated, notify every person whose information has been obtained as a result of these regulations. This means that if your location information has been obtained by the state under the Covid-19 regulations, you will be informed of this. There can accordingly be no secret surveillance under the guise of combatting Covid-19.  As was argued in the amaBhungane litigation, a right to be notified of surveillance within a certain period after it has taken place is best practice worldwide.  

Safeguard number seven is that six weeks after the state of disaster has lapsed or has been terminated, the information in the tracing database must be de-identified and made anonymous, and used only for research, study and teaching purposes. Any information that has not been de-identified shall be destroyed.  

The eighth safeguard is that the Director-General is also required to file a report on the steps taken to notify those whose information has been obtained and the steps taken to de-identify and destroy the information in the database, after which Judge O’Regan is entitled to give directions on further steps to be taken to protect the privacy of those whose data has been collected.  

Finally, no person may disclose any information contained in the Covid-19 database, or any information obtained through this regulation, unless authorised to do so and unless the disclosure is necessary for the purpose of addressing, preventing or combatting the spread of Covid-19.

While surveillance for any reason is often a controversial topic which rightly raises alarm bells in the minds of those concerned with the privacy of citizens, the ever-increasing spread of Covid-19 infections and the urgency with which countries need to flatten the curve, including by tracing contacts of those infected, necessarily require drastic interventions by governments in order to save lives.  

In his affidavit, President Cyril Ramaphosa stated before the Pretoria High Court in the context of the nationwide lockdown that “these extraordinary measures constituted sacrifices that millions of our citizens were prepared to make in order to save our nation”. 

While the track-and-trace regulations will hopefully assist the government in saving countless lives in the face of Covid-19, it will be important to monitor how the regulations are implemented. We are, and should be, prepared to sacrifice aspects of our privacy in the interests of saving lives, where the limitation on our privacy is as minimal and proportionate as possible. The nine safeguards in the regulations illustrate that the government is being careful to calibrate the competing rights and interests at stake. DM 

Dario  Milo is a partner and Lavanya Pillay an associate at Webber Wentzel.  They acted for amaBhungane in the RICA challenge before the High Court and Constitutional Court