The South African government has introduced new, wide-reaching regulations that will allow it to track the whereabouts of anyone on a national database that is being developed, and that will list people who have come into contact with individuals confirmed to be infected with COVID-19 or who have tested positive themselves.
The new regulations, published today, introduce a tracking system unlike anything South Africa has seen before. They will allow the government to know precisely where someone is, and to trace their movements. The regulations take advantage of the fact that so many people in South Africa have mobile phones that they take everywhere with them. Using information obtained from phones, the new system will keep tabs on people and allow the authorities to track the location of anyone and where they have been.
Under the new tracking regulations, ‘electronic communications service providers’ – MTN and Vodacom for example – must provide information they have about subscribers and their whereabouts, when asked to do so by the Director-General: Health. People whose information is given to the health authorities will not necessarily know that this has happened and that they are on a database that allows their whereabouts to be tracked.
The information to be supplied by service providers includes the location and movements of anyone ‘known or reasonably suspected to have contracted COVID-19’. Information must also be provided about the movements and location of anyone who is known or reasonably suspected to have been in contact with someone who tested positive for the virus.
The project involves a retired judge, officially called the ‘COVID-19 Designated Judge’. This judge, yet to be named, is to be provided with weekly reports containing the names and other details of everyone whose location and movements were obtained from service providers.
It will be the task of the ‘COVID-19 Designated Judge’ to make recommendations to the cabinet on the new system. The judge must consider how the regulations can be amended or enforced in a way that both safeguards the right to privacy, while at the same time ensuring the ability of the department of health to get the information it needs, so that officials may ‘urgently and effectively’ trace people to help combat the spread of the virus.
Obviously aware that the vast new system will infringe the constitutional right to privacy, the government stresses that the regulations and the tracking and tracing system they establish are essential to combat COVID-19.
The regulations stress that the information obtained for the tracking system will be confidential. It is partly to ensure the information is not misused that a judge will be drawn into oversight of the system.
No one is allowed to disclose information obtained from the new ‘COVID-19 Tracing Database’ unless it is ‘necessary’ for preventing the spread of the virus.
When someone is tested for the virus, the person who takes the sample must at the same time obtain key personal information – full name, ID or passport number, residential address and the mobile phone number – of the person tested, along with a copy of the person’s ID document. All of this information must then be provided for inclusion on the database.
Similarly, laboratories testing for COVID-19 must send all the details that they have about the person being tested, to the database, along with the results of the test. The National Institute for Communicable Diseases (NICD) is also involved, and must pass on all the details they have of people tested for COVID-19, the results of any tests as well as ‘any information the NICD has regarding likely contacts of the person tested’.
All South Africa’s accommodation establishments are now required to become part of the tracing system. They must keep a register of the details of any guest who stays during the lockdown period and send that information – name, ID, address and mobile phone number as well as a copy of the guest’s driver’s licence or ID – to the tracing database.
The regulations stipulate that the authorities are not allowed to ‘intercept the contents of any electronic communication’ and are only permitted to obtain information related to a subscriber’s whereabouts.
Six weeks after the end of the official state of disaster, the health authorities are to notify everyone whose information and whereabouts they obtained, of the fact that they had been on the tracing database. At that stage, all information on the database is to be ‘de-identified’ and the de-identified material may then be used ‘for research, study and teaching purposes’.
Finally, the authorities are given persuasive powers in case anyone contemplates disobedience: failure to comply with the new regulations constitutes an offence. Anyone convicted will be liable to a fine – the amount is not stipulated – and/or a prison sentence of six months.