Introduction
On 5 March 2020, the National Institute for Communicable Diseases (NICD) confirmed South Africa’s first case of the Coronavirus.[1] The news alert indicated that the patient had travelled to Italy with his wife and they were part of a group of 10 travellers. After consultation with his doctor, it was confirmed that the patient had been infected with coronavirus (“COVID-19”). On 7 March 2020, a second case of COVID-19 was also confirmed.[2] The news came after misinformation and fake news on COVID-19 has been spreading on social media platforms which increased fear amongst people. Across various social media platforms, people have been making enquiries to identify the COVID-19 patient and his wife. At the same time, people are curious to know who the other 8 people are and whether they have been tested for COVID-19. This made me think about privacy rights in a time of a health crisis.
As a country, do we have the right to know the identity of COVID-19 patients? Since the virus is airborne, it makes logical sense that if we know who the patients are, we can stay away from them, thus preventing the further spread of the virus. Is it in the interest of the public to know the identity of COVID-19 patients? Since the patient flew in from Italy, should information regarding the flight he boarded be shared with the public? This would allow everyone who was on board the flight, or anyone who came into contact with a person who was on board the flight, to take initiative and get tested. In a time of a health crisis or an epidemic, do privacy rights matter? Does the right to access to information extend to access to information about persons who have contracted COVID-19?
POPIA
The Protection of Personal Information Act, 4 of 2019 (“POPIA”), gives effect to the constitutional right to privacy. POPIA sets out 8 lawful conditions to be met by both private and public bodies when processing personal information. POPIA places a general prohibition to the processing of special personal information.[3] Special personal information includes, amongst others, information concerning the health, sex life, biometric information, race and ethnic origin of a person. However, medical professionals and healthcare institutions, among a limited list of other persons, are permitted to process special personal information.[4] Health professionals are bound by various codes and regulations in the health sector which include rules on professional confidentiality.[5] This is why the identity of the COVID-19 patient was not disclosed.
POPIA lists 5 grounds were processing of special personal information is not prohibited. One of the grounds is where the data subject consents to the processing of their special personal information.[6] In the case of COVID-19, a patient may consent to have their health status regarding COVID-19 processed and shared with the public. If that happens, the party processing such special personal information will not be in violation of POPIA.
POPIA also permits the processing of special personal information for historical, statistical or research purposes to the extent that the purpose serves a public interest and the processing is necessary for the purpose concerned.[7] COVID-19 is a novel strand of the generic coronavirus. Scientists across the globe are actively conducting research to find the cure for this virus. It is in the public interest to find a cure for COVID-19. It is also in the public interest to run tests on blood samples, urine samples, saliva samples, etc of COVID-19 patients. Processing of COVID-19 patients’ health data by medical research institutions is therefore justifiable and in line with POPIA.
POPIA further provides that there should be sufficient guarantees to ensure that the processing does not adversely affect the individual privacy of the data subject. One of the ways to ensure that the privacy rights of COVID-19 patients are protected is through anonymisation. Anonymisation of a health record simply means that there are no direct or indirect links between the record and the patient. Once a COVID-19 patient has provided their bodily fluids for further research by medical research centres, there is no need for their names, addresses, occupation and any other identifying information to be part of that record.
Addressing the questions and concerns
Do we have the right to know the identity of COVID-19 patients? Is it in the public interest to know the COVID-19 patients?
As discussed above, medical professionals are bound by professional confidentiality provisions and cannot publicise health information of their patients. Should POPIA come into effect, this position will not be changed. The constitution of South Africa is based on democratic values of human dignity, equality and freedom. Identifying and naming the COVID-19 patients is a gross violation of their right to privacy, dignity and freedom. This can potentially violate their own safety and security. If people know who the patients are, there is always a risk that they can be attacked by some members of the public. Whilst it is interesting for the public to know the identity of the COVID-19 patients, it is not in the public interest to name the patients. It is therefore my opinion that apart from the doctors and the persons conducting research on COVID-19, the public in general does not need to know the identity of COVID-19 patients.
Is there an obligation on the state to name the airline that the first COVID-19 patient boarded?
The Department of Health has an obligation to share information relating the flight details that the COVID-19 patient was on. This information should only relate to the name of the airline and the airline number. It is my argument that the specific dates and times of the flight should not be shared. This is because such information can be used to identify the patient.
Conclusion
The right to privacy is a fundamental right which should be protected even during an epidemic like COVID-19. If you suspect someone to be infected by COVID-19, refer them to their doctor for medical attention. While it is interesting to know the list of COVID-19 patients, it is NOT in the public interest to know COVID-19 patients.
Remember to wash your hands regularly, not to touch your face, mouth, nose or eyes and use your hand sanitizer religiously.
[1] https://citizen.co.za/news/south-africa/breaking-news/2250939/department-of-health-confirms-sas-first-covid-19-case/ accessed 7 March 2020.
[2] https://www.businessinsider.co.za/coronavirus-in-south-africa-everything-we-know-about-covid-19-in-sa-2020-3 accessed 7 March 2020.
[3] Section 26 of POPIA.
[4] Section 32 (a) of POPIA.
[5] Section 14 of the National Health Act 23, of 1993 as amended.
[6] Section 27 (1) (a) of POPIA.
[7] Section 27 (1) (d) of POPIA.
