Managing agents, members of home owners associations and trustees of body corporates will have to take decisions about protective measures to contain the spread of the coronavirus in their community schemes. Both they (and those who contract the virus) need to be aware of rights to privacy about health information. For years HIV sufferers have suffered stigmatisation. Ostracisation of those infected with the virus is already emerging.

It is important that we all have a spirit of ubuntu and help each other at this time. If trustees and managing agents have the right approach to addressing issues and protecting privacy, living in community can be a huge asset. Community schemes need to comply with POPIA and other data protection laws. Understanding these laws can help schemes to respond responsibly. 

Processing information about people with coronavirus

Those living in your community scheme will likely want to know if there are residents or employees in the complex who have the coronavirus. This will help them track who may have been in contact with them. Consider the following:  

  • What if your trustees or the managing agent sends a notice asking you to advise them if you have the coronavirus?
  • What if people panic and ostracise those with the virus?
  • Can you refuse to give this information?
  • Coronavirus is a reportable disease. Who has the right to this information?

Coronavirus in a community scheme example

Imagine the trustees and the agent are not health experts, but they think a good way to prevent the virus spreading is for owners to be aware of any case in the scheme immediately. The agent sends an email to all owners telling them that you must inform the trustees of any resident or employee who has the virus. Imagine they send a form to sign, that asks you to number the residents in your household. It also includes the words “I am aware I must let the trustees and agent know as soon as any of the residents or employees contract the coronavirus, or has contact with someone who has.”

No one tells you:

  • who will have access to this information,
  • who is responsible to keep it secure, or
  • where they will store it.

Imagine now that you and one of your workers contract the virus. An older resident also employs this worker. This resident will be highly at risk if she has contact with this worker. So you inform your managing agent and trustees. The agent and trustees then send an email to everyone in the complex warning them of your house number, and of your and your employee’s health condition. Your neighbours panic. They insist you remove yourself from the complex and isolate yourself somewhere far away from them, and sack your worker, to remove the risk.

Has the processing of this health information been in any way lawful, responsible and fair to you and your worker?

Would these well-intended actions by the agent and trustees put them at risk of breaking the law?

Why data protection for coronavirus is challenging

People are particularly concerned about their privacy when it comes to health-related personal information. They want it to be confidential. Data protection laws treat information about the health and well-being and the sex lives of individuals as especially special or sensitive. There are strict rules about how someone should handle this information. It has become much easier to lose, copy, steal, delete or misuse large databases of sensitive information than it was even a few years ago.

The risks of reputational damage associated with data breaches are also higher than in the past. This is all hugely heightened at a time such as this, when a pandemic is on the cards. It is therefore very important for anyone that is processing health information about the coronavirus to understand the impact of data protection laws (like POPIA). 

What if you consented to someone collecting your health information without understanding the consequences?

What can you do?

  • If you are a resident, don’t sign any consent form about passing on information about your health if you feel your community scheme is coercing you into it. It is in everyone’s interest to communicate certain information, but the receiver of such information must handle it responsibly.
  • Managing agents and trustees need to inform themselves about what information they can collect and disseminate so that they can help their community scheme to overcome this challenge. Consent forms will be defective if someone unduly influences another to sign them. Process health information lawfully by asking us to review your existing consent form or draft you a new consent form.

Trustees and their managing agent appear to have much more power than an individual resident. This is not the case if the requests they send are not lawful. As recommended by our President, we must take swift, purposeful, and collective action to contain the risks of the virus. Community schemes are extremely well placed to take collective action. Now is the time to think through how to do so responsibly and lawfully.