South Africa: Handing of mobile phone customers’ location data to government is unconstitutional

On March 23, the President of South Africa Cyril Ramaphosa announced that lockdown measures in response to Covid-19 would take effect from March 26. The restrictions included ordering all South Africans, except essential workers, to remain at home, the closure of schools and a ban on the sale of alcohol and cigarettes. 

Not long after the announcement, the National Institute for Communicable Diseases, which is leading the government’s response to Covid-19, asked the country’s biggest mobile phone providers to share with it “high-level aggregated data on how people are moving to help curb the spread of Covid-19” and they agreed.

The South African government subsequently published regulations to give this partnership a legal footing but protests and an outcry over a lack of privacy and data protection safeguards forced the government to revise their approach.

This wasn’t the first time that concerns about a lack of privacy protections for communications metadata in South Africa were raised.

National database

On April 2, the government published revised regulations to set up an electronic Covid-19 tracking and tracing system.

This system would involve a national database of people known to have Covid-19 or suspected of having Covid-19 and those who had been in contact with the same.

The regulations stated the information that would be held on the database would include the person’s name, surname, identity or passport number, residential address and any other address the person could reside, the person’s mobile phone number, their Covid-19 test result/results and the details of people in contact with that person. 

The revised regulations also stated that the Director General of Health could, without prior notice to the person concerned, direct an electronic communications service provider to share with the Director General of Health information it would have regarding the location or movements of any person known to have Covid-19 or suspected of having Covid-19.

The outcry over the initial regulations ensured that the new regulations included safeguards that the system would be overseen by a retired judge; that the data collected would be deleted within six weeks; and that the measure would not outlive the Covid-19 emergency.

Sensitive information

They also include the stipulation that anyone whose movements were traced will be told that they were traced, “within six weeks after the national state of disaster has lapsed, or has been terminated”.

Though these changes and safeguards were welcomed by civil liberties groups, including the Legal Resources Centre (LRC), the LRC still had serious concerns over this collection of location data by the state and, given the unknown length of time that Covid-19 will remain society, fears about the length of time such sensitive information will be shared and used. 

On June 2, the High Court of South Africa, Gauteng Division, declared the country’s lockdown regulations invalid and unconstitutional in that they infringe on the rights and liberties of individuals unjustifiably. The declaration of invalidity has to be confirmed by the Constitutional Court before it can be affected.

It is clear in reading the judgment that the constitutional rights the court was referring to include such rights as the right to privacy in the digital space, including the unfettered right to carry out surveillance of people without any safeguards in place (protected by section 14 of the Constitution and the Protection of Personal Information Act).

The LRC has taken an interest in the matter although it was not party to these proceedings. 

Pic: IamConnorrm/nappy.co/All Africa

(Labelled for non-commercial re-use)