Impact of the Covid-19 Pandemic on the Protection of Personal Information: Lessons Learnt

According to section 37 of the Constitution of the Republic of South Africa, 1996, the declaration of a state of emergency is done in terms of an Act of Parliament and only when the life of the nation is threatened by war, invasion, general insurrection, disorder, natural disaster or other public emergencies. The declaration should be necessary to restore peace and order. During a state of disaster, the government and other public authorities obtain extraordinary powers to limit certain basic human rights and override policies and procedures to deal with the public emergency. The limitation of human rights must be reasonable and justifiable in an open and democratic society based on human dignity, equality, and freedom. The Coronavirus disease, also known as COVID-19, became a natural disaster threatening public health. The government had to act swiftly to curb the spread of the virus, hence the declaration of a state of disaster under the Disaster Management Act 57 of 2002 on 15 March 2020. Processing personal information became inevitable to curb the spread of the virus. Various methodologies were used to process this information, including manual and automated (digital) methods. One of those automated data processing methodologies was cloud computing services-based platforms. Digital tracking and tracing applications that use cloud-computing services to monitor the movement of data subjects were aggregated. Personal information forms part of privacy. The processing of personal information using these data processing platforms triggered the application of the Protection of Personal Information Act 4 of 2013, which seeks to give effect to the constitutional right to privacy enshrined under section 14 of the Constitution. The question is whether the limitation of the right to privacy in terms of section 36 of the Constitution and the Disaster Management Act was justifiable and reasonably limited in an open and democratic society based on human dignity, equality, and freedom. This study analyses specific provisions of the Protection of Personal Information Act in the cloud-computing context to establish whether the Act provided adequate data protection during a state of disaster.