With the state of disaster over, Murray Hunter wonders what will happen to the ambitious, if chaotic, data collection regime that South African health authorities have put in place to fight the pandemic.
President Cyril Ramaphosa’s decision to end the declared two-year state of disaster over the Covid-19 pandemic has brought South Africa to a fork in the road of our journey through the pandemic – and requires thinking about how we will handle the next pandemic as well.
As a reminder, almost all the emergency measures adopted since March 2020 have fallen with immediate effect. We are still required to wear face masks in certain public spaces; there are still crowd limits for large gatherings and certain protocols apply for international travel. Importantly, the R350 Covid Relief Grant will still be issued. COGTA has invited the public to comment on proposed regulations that would govern these matters in the future, here.
An important aspect that deserves more attention is what will happen to the ambitious but chaotic data collection regime that South African health authorities have put in place to fight the pandemic.
Covid-19 and data tracking
You will recall that the onset of the pandemic sparked a flurry of global debate about data protection and public health technologies, as governments and industry players around the world experimented with all kinds of digital technologies and tracking data to try to slow the spread of the virus. .
The somewhat infamous South Africa first experimented with collecting mobile location data in hopes of using it for contact tracing – although this approach was abandoned almost immediately when it became clear that the data was both sensitive enough to raise substantial privacy concerns but not specific enough. actually to help with contact tracing.
The Ministry of Health then turned to less controversial technological solutions, which offered alternative approaches to contact tracing. This includes the Covid Alert app, which uses Bluetooth proximity monitoring to make anonymous exposure notifications. In doing so, the app avoided the major privacy debates of the time, although there were also significant questions about the effectiveness of this app and little data from the Department of Health to prove the case. . CovidConnect, the Ministry of Health’s messaging suite that combines bulk texting and WhatsApp exchanges, used a range of service providers to send public health messages, allowed people to interact with WhatsApp bots to get general information about Covid, allowed access to personal test results, and even named people for contact tracing.
READ | Covid-19: Stop contact tracing and quarantine, says Ministerial Advisory Committee
Throughout the Covid period, our disaster regulations included provisions for health authorities to collect a fair amount of personal data for contact tracing and wider efforts to understand the spread of the virus. The “Covid-19 database”, as described in the regulations, was authorized to include the names, identity numbers, addresses and contact details of anyone who took a Covid test, as well as the contact details of anyone suspected of ‘having been exposed to someone with a Covid infection – and, at least in theory, this could also include a person’s cell location data if that information was deemed necessary for public health purposes.
So now that the state of disaster has passed, what happens to all the data collection?
Although this phone tracking approach never really took off, the regulations that allowed them remained largely in place during the state of disaster. And while the policy is controversial, it included several notable safeguards to try to alleviate privacy and data protection concerns – such as the appointment of a judge to oversee use of the policy and legal provisions that clearly restricted any data collection to legitimate public – health purposes.
READ | What SA learned about Covid and what next steps might be
Perhaps most relevant at the moment, the policy included a sunset clause. Specifically, Covid-19 data collection processes would end with the declared state of disaster itself, at which point all personal data collected under this policy would have to be either destroyed or strictly anonymized as necessary for further information. new research in public health. The supervising judge has the power to set standards on how this data can be acceptably anonymised, and the chief health officer and supervising judge are expected to table reports in parliament on the steps taken to shut down the data collection system. This sunset clause is now triggered.
A time for public scrutiny
This is a vital – perhaps long overdue – moment for scrutiny and public debate of our Covid data collection practices: what has worked, what hasn’t, and how data protection in health public should be addressed in the future.
One of the lingering observations from that time is that officials really wanted to find public health interventions that protected data privacy – but attempts to understand how these policies were implemented and revised often suggested that many parties stakeholders were simply not entirely above the problem. .
It is understandable that at the height of an unprecedented public health crisis, where health officials have been stretched to the limit, this aspect of our policy response has not received full attention.
Yet to date there have been virtually no parliamentary hearings where Covid data collection has been seriously discussed; there appears to be no public information on the effectiveness and uptake of interventions such as CovidConnect or the Covid Alert app. We do not know, for example, whether monitoring measures relating to ICT service providers for Covid Connect messaging services have been implemented. (Regulations require, for example, that each service provider be expected to maintain detailed records of employees who have accessed personal data collected for the Department of Health, and have all employees sign a statement that they understand the Covid data collection regulations and its safeguards.)
After more than two years of the pandemic, where a three-month emergency provision stretched over more than 24 months, now is the time for us to get to the bottom of it.
This should be done first through documents and reports and then through parliamentary oversight hearings. This will give us – the public – a better idea of the policies’ broader human rights impact and public health benefits, and therefore whether a policy like this should be adopted in the future.
New regulations on data collection
As the president said, going forward, the pandemic will be handled in accordance with the national health law. A few weeks ago, the Department of Health released draft regulations that will apparently absorb aspects of Covid public health policies into existing regulations governing the surveillance of other serious illnesses and public health risks. (These diseases are known as “notifiable medical conditions,” which require that certain information about confirmed cases be shared with the appropriate authorities for public health reasons.)
In principle, this can make sense. But alarmingly, the proposed regulations would extend aspects of Covid-19 data collection to these broader health policies and the dozens of other diseases they govern – with no further commitment on how the policies Covid data collection took place. Essentially, before we had a chance to reflect, evaluate and engage the public on the successes or failures of our attempt to balance privacy and public health, these proposed regulations would enact them in perpetuity. .
READ | EXPLAINER: An overview of the proposed Covid-19 regulations now that the state of disaster is over
Specifically, Section 15H of the proposed regulations creates a ‘contact tracing database of reportable conditions’, for which the Department of Health must collect a wide range of personal information about anyone who contracts (or even tests for) one of the approximately 50 illnesses listed as reportable medical conditions in the regulations; the database should also include details of anyone known or suspected of having been exposed to them, for contact tracing purposes.
Again, there is no indication that this is malicious. On the contrary, he appears almost distracted. For example, some of the diseases for which this data collection would now apply cannot even be transmitted from one person to another. (What is the point of contact tracing for malaria?)
It also seems that the data protection implications, if any, of applying Covid-style data collection to this host of other diseases, serious as they are, seem to be given little consideration. As an example, the list of applicable diseases includes gonorrhea, a sexually transmitted infection: the proposed Covid-style contact tracing has broad implications for a patient’s privacy and dignity.
These draft proposals, open for public comment until Thursday, April 14, 2022, appear to be a case of sleepwalking politics. Unfortunately, when it comes to data protection – in the age of Covid and long before – we have already done far too much.
The end of the state of disaster – and the current conjuncture of our response to the pandemic – is a moment of reflection, evaluation and accountability for the political choices that have been made in our responses to this terrible pandemic. Many, no doubt, will turn out to have been the best choices available on the information we had. Others may stand out as mistakes never to be forgotten or never to be repeated.
Either way, these issues need to be aired – through Parliament, our news regulator and beyond. It would be wise to put on hold any proposed regulations to extend or expand these practices until we fully understand the successes and failures of our data collection approaches during the pandemic.
– Murray Hunter is a senior partner at ALT Notice.
To receive Opinions Weekly, subscribe to the newsletter here.
* Want to answer the columnist? Send your letter or article to [email protected] with your name and city or province. You can also send a profile picture. We encourage a diversity of voices and points of view in our readers’ submissions and reserve the right not to publish all submissions received.
Warning: News24 encourages free speech and the expression of diverse opinions. The opinions of columnists published on News24 are therefore their own and do not necessarily represent the opinions of News24.