Can the South African govt monitor your whereabouts during COVID-19 pandemic?

In short, yes, if you are known to have contracted COVID-19, or reasonably suspected to have contracted COVID-19. In a state of disaster, in these unprecedented times, these measures are both lawful and reasonable for the reasons set out below.

On 2 April 2020, amended regulations in terms of the Disaster Management Act were published in Gazette number 43199 - several important changes were promulgated; a full version is available here.

At the outset, one must recall that although everyone in South Africa has certain fundamental rights - such as the right to privacy and dignity - these rights may be validly limited in certain circumstances in terms of section 36 of the Constitution. As a result, for example, the rights to privacy and dignity are not absolute.

When may constitutional rights be justifiably limited? Briefly, only if done so by a law of general application; and only to the extent that the limitation of rights is reasonable and justifiable in a democratic society. As noted by South Africa's Constitutional Court,[1] determining whether a limitation is reasonable and justifiable involves a balancing of interests; this is sometimes also referred to as an exercise in proportionality.[2] Several important Constitutional Court judgments, entire books, and many journal articles have been written on the topic of limitation of rights and proportionality, but briefly, one must consider the following: what is the nature of the right being limited? What is the purpose of the limitation? What is the extent of the limitation? Is there a less restrictive means to achieve the purpose? Accordingly, each case will turn on its own unique facts.

This brings us back to current events. In order to curb the spread of the coronavirus, the National Department of Health has developed a database known as the COVID-19 Tracing Database. The primary purpose of the database is to track, trace and monitor persons that are infected with COVID-19. The database must include "all information considered necessary for the contact tracing process to be effective", which will include all persons who are tested for COVID-19, and contain: first name and surname, identity or passport number, cellphone number(s), residential address (and other addresses where persons can be located), a copy of a photograph from an identity document, driver's licence or passport. Further, if a person tests positive, they must also list who they were in contact with - this information will be added to the database.

In addition, in terms of Regulation 11H (10), the Director-General for Health may write to any electronic communications service provider to direct that it furnish any information it has regarding the location and/or movements of a person who has contracted COVID-19 - this data is often referred to as geolocation or location data. The Director-General for Health may also obtain this geolocation data in relation to anyone who is reasonably suspected to have come into contact with an infected person. This data may include any information the service provider has available to track location and movement. Before you scream foul, the regulations, however, specifically state - in Regulation 11H (12) - that government may not intercept electronic communication (in other words, government should not be spying on your phone calls and reading your messages, but rather, monitoring location data to curb the spread of the virus, and to warn vulnerable people).

Further, in terms of Regulation 11H (14), a retired judge will oversee any data gathered from an electronic communications service provider, and will be provided with weekly reports. In terms of Regulation 11H (15), the designated judge may make recommendations to Cabinet members regarding the amendment or enforcement of the regulations to safeguard the right to privacy.

Importantly, within six weeks after the state of disaster has lapsed, all information gathered for the COVID-19 Tracing Database must be de-identified or destroyed. Also, once the disaster has ended, various reports and steps must be taken to protect citizens' privacy - including taking recommendations from the designated judge, and to table a final report in Parliament.

With this in mind, is the limitation imposed by government on privacy and dignity reasonable and justifiable? In my view, yes. The law imposed that limits rights is one of general application; and all considered, there does not appear to be a less restrictive means to achieve the goal within the context of South Africa's limited resources, and considering the global disaster we are facing.

South Africa has millions of people living with HIV, and other complicated underlying health issues. Coupled with tremendous poverty and inequality in society, government must act swiftly and decisively to curb the spread of COVID-19. It is easy to comment from a position of privilege and bemoan the potential infringement to privacy or dignity; and to complain about our movement being restricted. However, considering the purpose of the limitation, considering the fact that the world has over a million cases and thousands of people are dying every day, there does not appear to be a less restrictive means to prevent the further spread of the virus in a country like South Africa. Simply put, the needs of society as a whole must come before the interests of a single person.

What will the government use the location-based data for? Based on the regulations, and interviews by ministers, the data will be gathered and processed in order to trace all persons who have contracted COVID-19 (or reasonably suspected to have contracted the virus) in order to prevent the further spread. Information can be requested from as far back as 5 March 2020, and these measures will remain in place for the duration of the state of disaster. With limited resources, and a large percentage of the population living with underlying health issues, or in abject poverty, these measures appear reasonable and justifiable in the circumstances - particularly given that there is a measure of oversight, and that the information will be either de-identified or destroyed following the state of disaster.

Minister of Health Dr Zweli Mkhize has complained about a lack of information relating to infected persons, and this database will ensure that accurate and up-to-date information is available. Google has already committed to assisting governments around the globe to assist with social distancing and stemming the pandemic, and in addition to Google, which will provide what appears to be de-identified data voluntarily, all electronic communications service providers in South Africa will be compelled to do so under these new regulations.

We may not all agree, but we should understand the reasons for the unprecedented actions taken.

[1] Johncom Media Investments Limited v M and Others 2009 (4) SA 7 (CC).[2] Islamic Unity Convention v Independent Broadcasting Authority 2002 (4) SA 294 (CC) para 38. Although Justice Langa served as Chief Justice from 2005 until his retirement in 2009, he was the Deputy Chief Justice when this judgment was delivered in 2002.