Covid-19 crisis: Guidance note on personal information

The Information Regulator of SA has issued a guidance note on processing personal information during the ‘management and containment’ of the Covid-19 epidemic, notes Pam Saxby for Legalbrief Policy Watch. Dated 3 April, the note appears not to have been widely publicised. Bearing in mind that not all sections of the 2013 Protection of Personal Information Act are in force, the regulator ‘encourages proactive compliance by responsible parties when processing (the) personal information of data subjects’ who have been tested, who are infected with Covid-19, or who have been in contact with anyone who is. In that context, the guidance note unpacks the right to privacy as this relates to the protection of personal information during interventions aimed at curbing the spread of the virus.

Against that backdrop, the note confirms that it is mandatory for electronic communication service providers to share the location-based data they hold with any Covid-19 management authority legitimately requiring it; that an employer has the right to ‘force’ a staff member to be tested for Covid-19 and to access information on any staff member’s Covid-19 status; and that anyone infected with the virus is duty-bound to disclose this. Other matters covered include the circumstances in which consent and justification are not deemed necessary and objections may not be raised; collecting information for a specific purpose; its quality; the ‘lawful’ processing of information and any ‘further processing’ deemed necessary for managing the epidemic; ‘special information’ (as defined in the note); accountability; maintaining and retaining documents and records; access to them; and securing the integrity and confidentiality of information collected.