The South African Information Regulator (IR) has referred the National Department of Health (NDoH) to the enforcement committee because the NDoH has not provided information about personal data it collected during the COVID-19 pandemic. The regulator might issue an enforcement notice against them (including an administrative fine), which has the same effect as a court order. It looks like the NDoH might be the first responsible party that the regulator fines. There are lessons we can all learn from this.

If the regulator asks you to provide information to them, give it to them.

How did the Department of Health get to this?

In April 2020, regulations were issued to create an electronic COVID-19 contact tracing database for the purpose of managing the spread of COVID-19. The Information Regulator sought to confirm that the NDoH de-identified or destroyed the personal data it collected during COVID-19 after the lifting of the national state of disaster. The NDoH failed to provide this information despite the Information Regulator asking many times. The requests included a formal Information Notice (section 90) that the Regulator issued in November 2022.

Therefore, the regulator has referred the matter to the Enforcement Committee (section 92) and the regulator might issue an enforcement notice (section 95).

On 3 April 2020, the regulator released a COVID 19 guidance note on the processing of personal information in the management and containment of the COVID-19 pandemic.

The information regulator monitors compliance

POPIA requires the regulator to monitor the NDoH’s compliance with POPIA and the regulator requires accountability for how responsible parties handle personal information. The NDoH collected personal information during the pandemic (including special personal information of people such as COVID test results) and the NDoH must be accountable for how they handled that personal information.

Lessons for others to learn

  • The regulator is taking action and holding responsible parties accountable.
  • If the regulator asks you to provide information to them, give it to them.
  • Once the purpose for which you collected personal information is complete, delete or de-identify it.
  • If you are the NDoH, you should join our data protection programme and work through the module on resolving disputes with authorities. Otherwise, ask us for help.
  • If you process health-related information, you should join our data protection programme and work through the data protection in healthcare lens. Otherwise, ask us for help.
  • You can learn more about the coronavirus and data protection.
  • The regulator will refer matters to the Enforcement Committee even though the rules of procedure for the Enforcement Committee are in draft form.