POPI Guidance Note: Covid-19
The Information Regulator has published a guidance note on the processing of personal information in the management and containment of COVID-19 pandemic in terms of the Protection of Personal Information Act 4 of 2013 (POPIA)
The Guidance Note takes the form of Regulations published in terms of section 27(2) of the Disaster Management Act 57 of 2002.
The Regulations should be implemented in conjunction with the applicable conditions for the lawful processing of personal information provided for in POPIA to ensure respect for the right to privacy.
Key aspects of the Guidance note:
The Conditions for processing of personal information as described in the Act should all be applied as with any other form of Personal Information.
The following are specific to COVID-19:
SHARING OF LOCATION BASED DATA
Electronic Communication Service Providers must provide the Government with mobile location-based data of data subjects and the Government can use such personal information in the management of the spread of COVID-19 if:
- processing complies with an obligation imposed by law on the responsible party; or
- processing protects the legitimate interest of a data subject; or
- processing is necessary for the proper performance of a public law duty by a public body; or
- processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.
- However, the Government must still comply with all the applicable conditions for the lawful processing.
The employer is obliged to request specific information on the health status of an employee in the context of COVID-19, if an employee’s health status may endanger other employees. The disclosed information should not be used to unfairly discriminate against such an employee.
The employer can force an employee to undergo testing in order to maintain a safe working environment.
A data subject cannot refuse to give consent to be tested for COVID-19.
A person who has tested positive for COVID-19 has a duty to disclose his or her status.