By Varsha Sewlal
Introduction
The scale of the COVID-19 pandemic has underscored the need to act expediently to contain the spread of the virus. Most governments have resorted to utilising technology driven solutions such as location tools on android and smart phones, cell phone tower signals, global position systems, Wi-Fi signals and Bluetooth technology. Contact tracing is a method of surveillance which has raised concerns relating to breach of privacy, stigmatising of infected persons, abuse of databases and the perpetuation of cybercrimes if databases are infiltrated. Despite the controversy that surrounds geospatial technologies, they have a significant role to play in controlling and preventing the spread of diseases.
Global contact tracing interventions
Contact tracing using Bluetooth technology was successfullyimplemented by the Singapore government.[1]Massachusetts Institute of Technology(MIT) developed the Safe Paths Private Kit which utilises a Bluetooth and GPS platform incorporating principles of privacy by design.[2]The Pan-European Privacy Preserving Proximity Tracing consortium developed an application[3]that has been adopted by European Union intended to trace infections and ensures that personal data will remain on the individual’s phone.[4]
The European Data Protection Board published guidelines on the use of location data and contact tracing tools in the context of the COVID-19 outbreak.[5]
Professor Christophe Fraser, from Oxford University’s Nuffield Department of Medicine projects that at least 60 percent of the population must download and use the contact tracing app to effectively stop the spread of the virus.[6] A penetration rate of 60 percent may not be tailored to the dynamics of internet penetration on the African continent.
African Union Contact Tracing Guideline
The African Union published a guideline on contact tracing where active monitoring is proposed requiring a contact to report their health status via text message or telephonically. Investigators physically go through calls made and messages sent and social media accounts are accessed to establish contacts and locations visited.[7] The African Union has not incorporated digital contact tracing mechanisms through mobile phones as yet. African internet penetration rates are at 39.3 percent compared to the rest of the world at 62.9 percent.[8] Contact tracing through technology in Africa faces numerous challenges such as limited smart phone access, the high cost of data and devices which is compounded by limited network coverage.
How South Africa has leveraged technology during the pandemic
Researchers from the University of Cape Town have developed a smartphone application called COVI- ID using Bluetooth and geo-location tools incorporating self-sovereign identity to assist the South African government in tracing persons who have come into contact with infected individuals.[9] Samsung has donated 1500 handsets and collaborated with Telkom whowill provide free internet access to trackers to enable tracing of persons coming into contact with persons who tested positive for the virus.[10]Telkom is collaborating with the National Institute for Communicable Diseases (NICD) and the Council for Scientific and Industrial Research (CSIR) to set up a database enabling analysis of information collected to curb the spread of the virus.[11]
The South African government has deployed an interactive chatbot over the WhatsApp service to answer questions on COVID-19.[12] An application is being developed to assist medical practitioners to manage COVID-19 cases in a hospital.[13]
A Vulnerable Communities Map has been developed illustrating demographic data, levels of health care, mobility level and poverty levels.[14] The health map was created by the Sustainable Development Goal(SDG) Hub at the University of Pretoria. [15]The National Department of Health has assimilated the mapping tool to support vulnerable communities.[16]
The Western Cape Department of Education updated their ePortal to accommodate online learning while schools are closed.[17] The Western Cape Government joined forces with Google and other partners to develop the JUMP mobile platform to assist entrepreneurs to maximise business opportunities and render online resources especially during a downturn in the economy.[18]The inability of our public sector education system to deploy online learning has been laid bare. This has marginalised the majority of South African learners in the public sector schooling system.
The National Department of Health in South Africa has partnered with Praekelt.org Foundation and BCX to launch a contact tracing service called COVIDConnect that responds to COVID-19 enquiries relating to testing, symptoms and advises on precautionary measures. The user can access the results of a COVID 19 test through this application by furnishing their date of birth. The application also furnishes resources on self-care and monitoring. Theservice enables a user who has tested positive for COVID-19 to declare the name and contact details of persons that they have been in contact with, aSMS will then be generated to that individual to warn them of possible exposure. Test results and contact tracing information is sent to a database that is managed and only accessed by the National Department of Health. The database can be accessed by district health offices to enable geo- location of infections. The contact tracing team can make personal calls and visits to contacts should no response be received from the SMS sent out.[19]It is salient to make mention that these individuals have not consented to being contacted.
South African Regulations
The Department of Telecommunications and Postal Services issued Electronic Communications Postal and Broadcasting Directions under Regulation 10 (8) of the Disaster Management Act 2002 where electronic communication network services and electronic communication service licensees are to render location- based services in conjunction with the state to curtail the spread of COVID-19.[20] The South African Post Office is to avail its national address system and any relevant database to support tracking and tracing of infected individuals and individuals who they have been in contact with.[21]
Regulations issued in terms of Section 27(2) of the Disaster Management Act of 2002 on contract tracing were published on the 2April 2020.[22] An amended regulation on contact tracing was published on the 25 June 2020.[23]
The Minister of Justice and Correctional Services appointed Justice Catherine (Kate) O’ Regan in terms of Section 11 H(13) of the regulation which requires that a judge who has been discharged from active service under Section 3(2) of the Judges Remuneration and Conditions of Employment, 2001or a retired High Court judge, as the COVID-19 designated judge.[24] She will serve as the vanguard ensuring thatpersonal informationis not compromised and that the data collected is not exploited.
The Director-General of Health must file a weekly report with the Judge detailing the information collated on the relevant individual which includes personal information and location data.[25] The Judge will make recommendations to cabinet members and the Ministers of Cooperative Governance and Traditional Affairs, Health, Justice and Correctional Services on safeguarding the right to privacy whilst discharging contact tracing mechanisms to combat the spread of COVID-19. [26]
The National Department of Health is empowered to develop and implement electronic systems or applications to be used on mobile devices or computers that would collect information from the public for inclusion on the COVID-19 database.The Director-General also has the power to obtain location data from cell phone companies of infected individuals and people who have been in their immediacy. The database will include details of the tracing process and the outcomes of geospatial hotspot mapping.
The Director- General must submit a report to the judge on the database. She will give direction on privacy issues of those persons whose information has been collected. This report will be tabled in parliament and contraventions to the right to privacy will result in penalties being imposed.[27]
Personal information of the individual will be recorded including the first name, surname, identity and passport numbers, residential address, cell phone numbers, COVID-19 results, details of contacts of person who tested positive for COVID-19. This information is confidential and may not be disclosed unless authorised to do so. Persons conducting testing for COVID-19 must secure first names, surnames, identity or passport number, residential address, cell phone numbers of the person tested, a copy of one of the following (passport, driver’s license, identity card or identity book of the person being tested) and all persons that they have been in contact with.[28]
The amended Regulation provides for information to be secured on a voluntary opt-in basis and through express consent. The type of information, means of collection,purpose for the collection, details on entities that this information will be sent to, information on whether the information will be kept on the user’s mobile phone or a centralised server and period of retention must be explained to the user. A notice must be transmitted to a user on destruction of their personal information.
The department can also receive information from private entities provided that it is done so on a consensual and voluntary opt in basis. The Director-General is empowered to appoint any external organ of state or private entity, to execute functions should it not have the necessary expertise required. Information stored must be encrypted, and access must be subject to password protection. The retention of logs of persons who have accessed the data must be kept including the person’s name, function and reason for access. These logs are to be submitted by the appointed entities to the Director-General every two weeks.Personal information that is adequate, relevant and fit for purpose may be processed. This information cannot be retained once the appointment terminates and cannot be disclosed other than when permitted to do so by the Director-General. Controls must be upheld to protect information collected.
The amended regulation now enables individuals to be informed immediately and not within six weeks of the termination of the national state of disaster that their information is on the database. Information on the database is to be de-identified and may be retained only for research, study and teaching purposes. Information which has not been de-identified must be destroyed.[29]It is also imperative that should any breach of the database occur, that immediate notifications are made to individuals.
The Protection of Personal Information Act 4 of 2013 was promulgated on the 1 July 2020 and gives effect to the constitutional right to privacy.[30]Section 114(1) of POPIA enables a 12-month period of grace for compliance of all forms of processing personal information.This is of particular concern as South African citizens will be subjected to mass surveillance without the overarching protection of data protection legislation.[31]
The Information Regulator, the South African oversight institute mandated to protect personal information,prepared a guidance note on how personal information should be processed in accordance with POPIA while managing and containing the COVID-19 pandemic.[32]POPIA states that the lawful basis for processing personal information must incorporate eight conditions which are:accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.[33]It is integral that personal information stored on databases is not compromised and adequate security safeguards are implemented. POPIA serves as a blueprint as to how personal information must be processed by public and private authorities.
The use of contact tracing through digital technologies and data processing can stem the prolific spread of COVID- 19. Governments are turning to contact tracing to limit the resurgence of the novel coronavirus especially while lockdown measures are being relaxed. It is critical that effective standards are adopted to ensure that the right to privacy is balanced against public interest.
The pandemic has fortified the right to affordable access and affordable devices. Programs to subsidise the uptake of smart phone use and affordable data must be explored to enable the benefits of ubiquitous access to be secured. It is unanimous that digital technologies can support remote learning, remote work and disseminate essential public health information. The need for a synergised effort from the state, private sector and non-government organisations is necessary to achieve this, now more than ever.
References:
African Union Guidance on contact tracing for COVID-19 pandemic https://au.int/sites/default/files/documents/38351-doc-guidance_on_contact_tracing_for_covid-19_pandemic_eng.pdf.(accessed 7th May 2020).
Chaturvedi Aditya (21st April 2020) How South Africa uses tech to fight Covid-19 https://www.geospatialworld.net/blogs/how-south-africa-uses-tech-to-fight-covid-19/.(accessed 7th May 2020).
DTPS(26th March 2020) Electronic Communications Postal and Broadcasting Directions Issued Under Regulation 10 (8) of the Disaster Management Act 2002 (Act No 57 of 2002)
https://www.gov.za/sites/default/files/gcis_document/202003/43164gon-417.pdf (accessed 7th May 2020).
EU (15 April 2020) Mobile applications to support contact tracing in the EU’s fight against COVID-19. https://ec.europa.eu/health/sites/health/files/ehealth/docs/covid-19_apps_en.pdf. (accessed 7th May 2020).
EPDP (21st April 2020) Guidelines on the use of location data and contact tracing tools in the context of the COVID-19 outbreak https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-042020-use-location-data-and-contact-tracing_en.(accessed 7th May 2020).
Information Regulator (3rd April 2020) Guidance Note on The Processing of Personal Information in The Management And Containment of Covid-19 Pandemic In Terms of The Protection of Personal Information Act 4 of 2013 (POPIA) https://www.justice.gov.za/inforeg/docs/InfoRegSA-GuidanceNote-PPI-Covid19-20200403.pdf. (accessed 7th May 2020).
Internet World Stats (31 March 2020) African Internet Penetration Rate https://www.internetworldstats.com/stats1.htm
Labuschagne Hanno( 22 August 2020) How South Africa’s COVIDCONNECT Contact Tracing Platform Protects Privacy https://mybroadband.co.za/news/software/362136-how-south-africas-covidconnect-contact-tracing-platform-protects-privacy.html.(accessed on the 22 August 2020).
Mail and Guardian, Saba A (7 May 2020)Universities rally to fight pandemic https://mg.co.za/sci-tech/2020-05-07-universities-rally-to-fight-pandemic/. (accessed 7 May 2020).
MIT(undated) Private Kit: Safe Paths; Privacy-by-Design Covid19 Solutions using GPS+Bluetooth for Citizens and Public Health Officials.https://safepaths.mit.edu/ (accessed 7th May 2020).
Monzon Luis (30 April 2020) SA Government,UCT Partner on COVID-19 Tracing App https://www.itnewsafrica.com/2020/04/sa-government-uct-partner-on-covid-19-tracing-app/?amp.(accessed 7th May 2020). Self-sovereign identity enables individual control of data where it will not be stored on a state owned or private database.
Protection of Personal Information Act No 4 of 2013
Proclamation No. R21 of 2020, Commencement of certain sections of the Protection of Personal Information Act https://www.justice.gov.za/inforeg/docs/20200622-gg43461-rg11136-pr21-POPIAsections.pdf
Singapore Government (undated) Trace Together https://www.tracetogether.gov.sg/.(accessed 7th
South African Government (2nd April 2020) Disaster Management Act ,2002: Amendment of Regulations issued in terms of Section27(2) Disaster Management Act, 2002 https://www.gov.za/sites/default/files/gcis_document/202004/43199rg11078-gon446.pdf.(accessed 7th May 2020).
South African Government (3rd April 2020)Minister Ronald Lamola appoints Justice Kate O’Regan as Coronavirus COVID-19 Designate Judge https://www.gov.za/speeches/minister-ronald-lamola-appoints-justice-kate-o%E2%80%99regan-coronavirus-covid-19-designate-judge-3.(accessed 7th May 2020).
University of Oxford (16th April 2020) Digital contact tracing can slow or even stop coronavirus transmissions and ease us out of lockdown https://www.research.ox.ac.uk/Article/2020-04-16-digital-contact-tracing-can-slow-or-even-stop-coronavirus-transmission-and-ease-us-out-of-lockdown.(accessed 7th May 2020).
South African Government (25 June 2020) Disaster Management Act ,2002: Amendment of Regulations issued in terms of Section27(2) Disaster Management Act, 2002 Disaster Management Act https://www.justice.gov.za/legislation/notices/2020/20200625-gg43476gon714_Cogta.pdf.
van der Heijden Stephen (26th March 2020) Update Vulnerable Communities Map Project https://www.offerzen.com/blog/update-vulnerable-communities-map-project. (accessed 7th May 2020).Offerzen a tech recruitment company collaborated with the SDG Hub at the University of Pretoria.
Western Cape Education Department (2020) ePortal https://wcedeportal.co.za/.(accessed 7th May 2020).
Western Cape Government (18th March 2020) Jump for Entrepreneurs https://www.westerncape.gov.za/site-page/jump-digital-business-support-platform. (accessed 7th May 2020).
World Economic Forum, Kokoroko Francis ( 5th April 2020) Heres how Africans are using tech to combat the coronavirus pandemic https://www.weforum.org/agenda/2020/04/africa-technology-coronavirus-covid19-innovation-mobile-tech-pandemic. (accessed 7 May 2020).
[1]Singapore Government (undated) Trace Together https://www.tracetogether.gov.sg/.(accessed 7th May 2020).
[2]MIT(undated)Private Kit: Safe Paths; Privacy-by-Design Covid19 Solutions using GPS+Bluetooth for Citizens and Public Health Officials.https://safepaths.mit.edu/ (accessed 7th May 2020).
[4] EU (15 April 2020) Mobile applications to support contact tracing in the EU’s fight against COVID-19.https://ec.europa.eu/health/sites/health/files/ehealth/docs/covid-19_apps_en.pdf. (accessed 7th May 2020).
[5] EPDP (21stApril 2020) Guidelines on the use of location data and contact tracing tools in the context of the COVID-19 outbreak https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-042020-use-location-data-and-contact-tracing_en.(accessed 7th May 2020).
[6]University of Oxford (16th April 2020) Digital contact tracing can slow or even stop coronavirus transmissions and ease us out of lockdown https://www.research.ox.ac.uk/Article/2020-04-16-digital-contact-tracing-can-slow-or-even-stop-coronavirus-transmission-and-ease-us-out-of-lockdown.(accessed 7th May 2020).
[7]African Union Guidance on contact tracing for COVID-19 pandemic https://au.int/sites/default/files/documents/38351-doc-guidance_on_contact_tracing_for_covid-19_pandemic_eng.pdf.(accessed 7th May 2020).
[8] Internet World Stats (31 March 2020) African Internet Penetration Rate https://www.internetworldstats.com/stats1.htm.
[9] Monzon Luis (30 April 2020) SA Government,UCT Partner on COVID-19 Tracing Apphttps://www.itnewsafrica.com/2020/04/sa-government-uct-partner-on-covid-19-tracing-app/?amp.(accessed 7th May 2020). Self-sovereign identity enables individual control of data where it will not be stored on a state owned or private database.
[10] Chaturvedi Aditya (21st April 2020) How South Africa uses tech to fight Covid-19https://www.geospatialworld.net/blogs/how-south-africa-uses-tech-to-fight-covid-19/.(accessed 7th May 2020).
[11]Chaturvedi Aditya (21st April 2020) How South Africa uses tech to fight Covid-19 https://www.geospatialworld.net/blogs/how-south-africa-uses-tech-to-fight-covid-19/.(accessed 7th May 2020).
[12]World Economic Forum, Kokoroko Francis ( 5th April 2020) Heres how Africans are using tech to combat the coronavirus pandemic https://www.weforum.org/agenda/2020/04/africa-technology-coronavirus-covid19-innovation-mobile-tech-pandemic. (accessed 7 May 2020).
[13] Mail and Guardian, Saba A (7 May 2020)Universities rally to fight pandemic https://mg.co.za/sci-tech/2020-05-07-universities-rally-to-fight-pandemic/. (accessed 7 May 2020).
[14]van der Heijden Stephen (26th March 2020) Update Vulnerable Communities Map Project https://www.offerzen.com/blog/update-vulnerable-communities-map-project. (accessed 7th May 2020). Offerzen a tech recruitment company collaborated with the SDG Hub at the University of Pretoria.
[15]van der Heijden Stephen (26th March 2020) Update Vulnerable Communities Map Project https://www.offerzen.com/blog/update-vulnerable-communities-map-project. (accessed 7th May 2020).
[16]van der Heijden Stephen (26th March 2020) Update Vulnerable Communities Map Project https://www.offerzen.com/blog/update-vulnerable-communities-map-project. (accessed 7th May 2020).
[17] Western Cape Education Department () ePortal https://wcedeportal.co.za/.(accessed 7th May 2020).
[18] Western Cape Government (18th March 2020) Jump for Entrepreneurs https://www.westerncape.gov.za/site-page/jump-digital-business-support-platform.(accessed 7th May 2020).
[19] Labuschagne Hanno (22 August 2020) How South Africa’s COVIDCONNECT Contact Tracing Platform Protects Privacy https://mybroadband.co.za/news/software/362136-how-south-africas-covidconnect-contact-tracing-platform-protects-privacy.html.(accessed on the 22 August 2020).
[20]DTPS (26th March 2020) Electronic Communications Postal and Broadcasting Directions Issued Under Regulation 10 (8) of the Disaster Management Act 2002 (Act No 57 of 2002) https://www.gov.za/sites/default/files/gcis_document/202003/43164gon-417.pdf (accessed 7th May 2020).
[21]DTPS (26th March 2020) Electronic Communications Postal and Broadcasting Directions Issued Under Regulation 10 (8) of the Disaster Management Act 2002 (Act No 57 of 2002)
https://www.gov.za/sites/default/files/gcis_document/202003/43164gon-417.pdf (accessed 7th May 2020).
[22]South African Government (2nd April 2020) Disaster Management Act, 2002: Amendment of Regulations issued in terms of Section27(2) Disaster Management Act, 2002
https://www.gov.za/sites/default/files/gcis_document/202004/43199rg11078-gon446.pdf.(accessed 7th May 2020).
[23]South African Government (25 June 2020) Disaster Management Act ,2002: Amendment of Regulations issued in terms of Section27(2) Disaster Management Act, 2002 Disaster Management Act https://www.justice.gov.za/legislation/notices/2020/20200625-gg43476gon714_Cogta.pdf.(accessed 1 July 2020).
[24]South African Government (3rd April 2020)Minister Ronald Lamola appoints Justice Kate O’Regan as Coronavirus COVID-19 Designate Judge https://www.gov.za/speeches/minister-ronald-lamola-appoints-justice-kate-o%E2%80%99regan-coronavirus-covid-19-designate-judge-3.(accessed 7th May 2020).
[25]South African Government (2nd April 2020) Disaster Management Act, 2002: Amendment of Regulations issued in terms of Section27(2) Disaster Management Act, 2002
https://www.gov.za/sites/default/files/gcis_document/202004/43199rg11078-gon446.pdf.(accessed 7th May 2020).
[26]South African Government (2nd April 2020) Disaster Management Act, 2002: Amendment of Regulations issued in terms of Section27(2) Disaster Management Act, 2002
https://www.gov.za/sites/default/files/gcis_document/202004/43199rg11078-gon446.pdf.(accessed 7th May 2020).
[27]South African Government (2nd April 2020) Disaster Management Act, 2002: Amendment of Regulations issued in terms of Section27(2) Disaster Management Act, 2002
https://www.gov.za/sites/default/files/gcis_document/202004/43199rg11078-gon446.pdf.(accessed 7th May 2020).
[28]South African Government (2nd April 2020) Disaster Management Act, 2002: Amendment of Regulations issued in terms of Section27(2) Disaster Management Act, 2002
https://www.gov.za/sites/default/files/gcis_document/202004/43199rg11078-gon446.pdf.(accessed 7th May 2020).
[29]South African Government (2nd April 2020) Disaster Management Act, 2002: Amendment of Regulations issued in terms of Section27(2) Disaster Management Act, 2002
https://www.gov.za/sites/default/files/gcis_document/202004/43199rg11078-gon446.pdf.(accessed 7th May 2020).
[30]Proclamation No. R21 of 2020, Commencement of certain sections of the Protection of Personal Information Act https://www.justice.gov.za/inforeg/docs/20200622-gg43461-rg11136-pr21-POPIAsections.pdf.(accessed 1 July 2020).
[31] South African Government (2nd April 2020) Disaster Management Act, 2002: Amendment of Regulations issued in terms of Section27(2) Disaster Management Act, 2002 Disaster Management Act
[32] Information Regulator (3rd April 2020) Guidance Note on The Processing of Personal Information in The Management And Containment of Covid-19 Pandemic In Terms of The Protection of Personal Information Act 4 of 2013 (POPIA) https://www.justice.gov.za/inforeg/docs/InfoRegSA-GuidanceNote-PPI-Covid19-20200403.pdf. (accessed 7th May 2020).
[33] Protection of Personal Information Act No 4 of 2013, Chapter 3.