Article provided by ENSafrica
On 15 March 2020, the South African President declared a national state of disaster in terms of the Disaster Management Act, 2002. A number of measures have since been implemented by the government to counteract the impact of the coronavirus (COVID-19), and several regulations, directives and guidelines have consequently been published.
The Information Regulator, established in terms of the Protection of Personal Information Act, 2013 (“POPIA”), has now issued a Guidance Note on the processing of personal information of data subjects in the management and containment of COVID-19.
Chairperson of the Information Regulator, Advocate Pansy Tlakula, had previously sent a request to President Cyril Ramaphosa to declare that the remaining provisions of POPI commence on 1 April 2020. Not surprisingly, given the national state of disaster, the president did not adhere to this request.
Confirming that not all of the provisions of POPIA have come into effect, the Regulator, in a press statement released on 3 April, nonetheless encourages proactive compliance with POPIA in order to give effect to the right to privacy as it relates to the protection of personal information. The Regulator is clearly of the view that companies should commence their POPIA compliance initiatives, despite the president not proclaiming the commencement date of the Act.
According to the Regulator, the purpose of the Guidance Note is to guide public and private bodies and their operators on the reasonable limitation of the right to privacy when they process personal information of data subjects for the purpose of managing the spread of COVID-19. The Guidance Note also addresses the issue of the provision of location-based data by Electronic Communication Service Providers to government to track data subjects in the management of COVID-19.
The Regulator recognises the need to effectively manage the spread of COVID-19, which has necessitated the limitation of various constitutional rights and supports the need to process personal information of data subjects for the purpose of curbing the spread of COVID-19.