School of Law

Is the South African Government justified in monitoring your whereabouts during the COVID-19 pandemic?
The short answer is yes – if you are known to have COVID-19 or are reasonably suspected to have contracted it.
In a State of Disaster, in these unprecedented times, individual monitoring measures are both lawful and reasonable for the reasons set out below. On 2 April 2020, amended regulations in terms of the Disaster Management Act were published in the Government Gazette No. 43199 – several important changes were promulgated. A full version is available here. At the outset, it must be remembered that although everyone in South Africa has certain fundamental rights, such as the right to privacy and dignity, these rights may be validly limited in certain circumstances in terms of Section 36 of the Constitution. Thus it is clear, for example, that the rights to privacy and dignity are not absolute.

So when will Constitutional rights be justifiably limited? Briefly, by a law of general application and only to the extent that the limitation of rights is reasonable and justifiable in a democratic society. As noted by South Africa’s Constitutional Court, determining whether a limitation is reasonable and justifiable involves a balancing of interests, sometimes referred to as an exercise in proportionality. Several important Constitutional Court judgments, entire books, and many journal articles have been written on the topic of the limitation of rights and proportionality, however one must consider the following: What is the nature of the right being limited? What is the purpose of the limitation? What is the extent of the limitation? Is there a less restrictive means to achieve the purpose? Accordingly, each case will turn on its own unique facts. This brings us back to current events. To help curb the spread of the coronavirus, the National Department of Health has developed the COVID-19 Tracing Database to track, trace and monitor individuals infected with the virus. The database needs to include ‘all information considered necessary for the contact tracing process to be effective’, including details of all those tested for COVID-19 including their first name and surname, identity or passport number, cell phone number(s), residential address (and other addresses where they can be traced), a copy of a photograph from an identity document, driver’s licence and/or passport. Further, if a person tests positive, information about who they were in contact with must be added to the database.

¹Johncom Media Investments Limited v M and Others 2009 (4) SA 7 (CC).
² Islamic Unity Convention v Independent Broadcasting Authority
2002 (4) SA 294 (CC) para 38. Although Justice Langa served as Chief Justice from 2005 until his retirement in 2009, he was the Deputy Chief Justice when this judgment was delivered in 2002. In addition, in terms of Regulation 11H (10), the Director-General of Health may write to any electronic communications service provider to direct that it furnish any information it has regarding the location and/or movements of a person who has contracted COVID-19 – this data is often referred to as geolocation or location data. The Director-General of Health may also obtain this geolocation data in relation to anyone who is reasonably suspected to have come into contact with an infected person. This data may include any information the service provider has available to track location and movement. Before you scream foul; Regulation 11H (12) specifically states that government may not intercept electronic communication – in other words, government should not be intercepting your phone calls or reading your messages, but rather monitoring location data to curb the spread of the virus and to warn vulnerable people.

Further, in terms of Regulation 11H (14), a retired judge will oversee any data gathered from an electronic communications service provider, and will be provided with weekly reports. In terms of Regulation 11H (15), the designated judge may make recommendations to Cabinet members regarding the amendment or enforcement of the regulations to safeguard the right to privacy.

Importantly, within six weeks after the declared State of Disaster has lapsed, all information gathered for the COVID-19 Tracing Database must be de-identified, or destroyed. Also, once the disaster has ended, various reports and steps must be taken to protect citizens’ privacy – including taking recommendations from the designated judge, and to table a final report in Parliament. With this in mind, is the limitation imposed by government on privacy and dignity reasonable and justifiable? In my view it is. The law imposed that limits rights is one of general application; and all things considered, there does not appear to be a less restrictive means to achieve the goal within the context of South Africa’s limited resources, and considering the global disaster we are facing.

In South Africa there are millions of people living with HIV, and other complicated underlying health issues. Coupled with tremendous poverty and inequality in society, government must act swiftly and decisively to curb the spread of COVID-19. It is easy to comment from a position of privilege and bemoan the potential infringement to privacy or dignity; and to complain about our movement being restricted. However, considering the purpose of the limitation and the fact that the world has over a million cases and thousands of people are dying every day, there does not appear to be a less restrictive means to prevent the further spread of the virus in a country like South Africa.

³ This is a process of ensuring a person’s personal information is not revealed. The concept is defined in the Protection of Personal Information Act as: “‘de-identify’’ means to delete any information that—

1. identifies the data subject;
2. can be used or manipulated by a reasonably foreseeable method to identify the data subject; or
3. can be linked by a reasonably foreseeable method to other information that identifies the data subject.

Simply put, the needs of society as a whole must come before the interests of a single person
What will the government use the location based-data for? According to the regulations and interviews with Government Ministers, the data will be gathered and processed in order to trace all persons who have contracted COVID-19 (or reasonably suspected to have contracted the virus) in order to prevent the further spread. Information can be requested from as far back as 5 March, 2020, and these measures will remain in place for the duration of the declared State of Disaster. With limited resources, and a large percentage of the population living with underlying health issues, or in abject poverty, these measures appear reasonable and justifiable in the circumstances – particularly given that there is a measure of oversight, and that the information will be either de-identified or destroyed following the State of Disaster.

Minister of Health Dr Zweli Mkhize has complained about a lack of information relating to infected persons – this database will ensure that vital accurate and up-to-date information is available. Google has already committed to assisting governments around the globe with social distancing and stemming the pandemic, and in addition to Google, who will provide what appears to be de-identified data voluntarily, all electronic communications service providers in South Africa will be compelled to assist under these new regulations.

Communications and Digital Technologies Minister Stella Ndabeni-Abrahams has reassured citizens that the government will not spy on people or intercept calls – rather, she says, government will rely on geolocation data to monitor the virus, and also to potentially warn vulnerable members of society. The Minister further noted that these were unprecedented times and individual rights needed to be limited in order to protect the country. We may not all agree, but we should understand the reasons for the unprecedented actions taken.