The South African government has published amendments to the National Disaster Act which detail its process for tracking citizens who have tested positive for COVID-19, as well as their known contacts, using their smartphones.
South Africans who test positive for the coronavirus or who are suspected to have contracted the virus will have their personal information recorded and stored on a national database, along with their cellphone numbers.
The government will then work with mobile operators to track these positive cases based on their cellphone numbers, as well as to identify and track anyone who they may have come into contact with.
“The National Department of Health shall develop and maintain a national database to enable the tracing of persons who are known or reasonably suspected to have come into contact with any person known or reasonably suspected to have contracted COVID-19,” the regulations state.
This database will include a wealth of personal information on each person registered, including the following:
- First name
- Last name
- Identity number/Passport number
- Residential address
- Work address/Other addresses where they could be located
- Cellphone number
- COVID-19 test results
- The personal details of all known or suspected contacts of anyone who has tested positive for the virus
The regulations noted that the database will not be limited to these data points, and should include “all information considered necessary for the contact tracing process to be effective”.
Collecting tracking data without notice
The new amendments to the regulations allow the health department to access location and movement data of anyone suspected to have contracted COVID-19.
This information can be accessed from mobile operators without requiring the knowledge or approval of the subjects being tracked.
Citizens who are listed on the contact tracing database will be able to be tracked in this manner until the national state of disaster has been terminated.
“The electronic communications service provider must promptly comply with the directive concerned,” the regulations said.
It is important to note that this information may only be retained for six weeks, after which it must be destroyed.
“Nothing in this regulation entitles the Director-General Health or any other person to intercept the contents of any electronic communication,” the regulations added.
Telkom and Samsung have already started working with the health department to support the tracking and tracing of clients by providing 1,500 cellphones.
The track and trace system is being developed alongside the National Institute for Communicable Diseases (NICD) and the Council for Scientific and Industrial Research (CSIR), and takes account of South Africa’s unique circumstances.
Collection and protection of data
The health department will source information for its database from all COVID-19 tests conducted, as well as data processed by the NICD and laboratory tests.
When a person is tested for COVID-19, this information will be obtained on-site and laboratories that have tested a sample for COVID-19 will also be required to provide all the details they have available on the case in question.
The NICD must also provide all the information it has available on the positive tests, as well as that of the subject’s known contacts.
“No person may disclose any information contained in the COVID-19 Tracing Database or any information obtained through this regulation unless authorized to do so and unless the disclosure is necessary for the purpose of addressing, preventing or combatting the spread of COVID-19,” the regulations state.
“The Director-General Health shall, within six weeks after the national state of disaster has lapsed, or has been terminated, notify every person whose information has been obtained… that information regarding their location or movements was obtained in terms of the subregulation.”