Cape Town - The National Department of Health (NDoH) says it will respond to issues raised by the Information Regulator regarding the collection and protection of personal information gathered during Covid-19 contact tracing.
The Regulator on Monday confirmed it had referred the NDoH to the Enforcement Committee over personal information collected as part of the management of the spread of the Coronavirus during the Covid-19 pandemic.
According to the regulator, the decision follows numerous unsuccessful requests for information to the NDoH.
Referral to the Enforcement Committee can culminate in issuing an enforcement notice which has the same effect as a court order.
The matter stems from contact tracing regulations which were issued in terms of the Disaster Management Act, from April 2020.
These regulations authorised the compilation of an electronic Covid-19 contact tracing database for the purpose of managing the spread of Covid-19.
The database was supposed to contain information such as the first name, surname, identity or passport number, residential address and Covid-19 test results of people who are known, or suspected to have come into contact with persons known or suspected to have contracted Covid-19.
The regulator explained that these regulations directed that the NDoH, as the custodian of the database, must, within six weeks of the lapse of the national state of disaster, destroy or de-identify the information in the database.
Further to that the de-identified information could only be used for research, study or teaching purposes.
“Since May 2022, the regulator has been demanding from the NDoH a report indicating how the department is complying with the lawful processing of personal information collected during the Covid-19 response.
“Specifically, the regulator wanted the NDoH to advise whether it had destroyed and/or de-identified the information that had been transferred to it during the national state of disaster in accordance with the procedure set out in the Disaster Management Regulations and provide the regulator with evidence of such action.”
“Additionally, the regulator wanted the NDoH to confirm that it had obtained a report from an expert third-party IT security firm as to the reliability and suitability of the IT security safeguards in place in relation to personal, location and health data held by or on behalf of the government in relation to Covid-19.
The regulator wanted access to this report,” the regulator said in a statement.
“Compliance is not optional. We have been lenient with the NDoH on this point, but we would be failing the data subjects if we, as the regulator, do not take action to ensure that there is compliance and accountability,” said information regulator chairperson, advocate Pansy Tlakula.
Further, according to the regulator, despite acknowledging receipt of its letters, the NDoH failed to accede to the regulator’s requests or explicitly refused to comply.
While the NDoH would not provide a timeline for a thorough response, it said the issue would be addressed.
“The Department of Health has noted and will respond to all issues raised by the Information regulator with regards to collection and protection of personal information gathered during Covid-19 contact tracing.
“The department recognises the role of the regulator to protect data subjects from harm and ensure that their personal information is protected by responsible parties,” said department spokesperson Foster Mohale.
Cape Times