On Friday, 4 December, Maverick Citizen and Section27 hosted a webinar on assessing South Africa’s approaches to privacy in Covid-19 digital contact tracing. The webinar also launched a new report on the subject.

Moderated by Maverick Citizen editor Mark Heywood, the discussion brought together privacy advocates Murray Hunter (Media Policy and Democracy Project), Avani Singh (Applied Law and Technology Advisory) and the National Department of Health’s Gaurang Tanna for a debate about the role of digital contact tracing in South Africa’s Covid-19 response, and what lessons we can learn for the next crisis.

The race to develop digital tools to fight the spread of Covid-19 has sparked privacy concerns across the world. Many feared the global pandemic would result in emergency measures that would outlast the emergency and that digital contact tracing would become a tool for mass surveillance.

Tanna says that to combat Covid-19 and break the chain of transmission, the population needs to “implement non-pharmaceutical interventions (such as wearing masks and physical distancing) and those who are diagnosed positive need to be isolated”. Equally important, however, is that the health system needed to be able to “quickly detect positive cases, trace and quarantine contacts, and isolate positive cases, especially as many will not experience or display symptoms”.

“Contact tracing is an essential and integral part of containing Covid-19 at a population level. It is more especially important as we approach the second wave,” says Tanna.

When the Covid-19 outbreak first occurred in March 2020, South Africa’s approach was to use locational information that came from cellular network providers. While this method did track your location, Hunter points out that we need to remember this system was produced as a response to an emergency.

“As a result of the urgency, it was not open to public discussion and external feedback which might have improved the system and identified problems in the system. But this was not possible in March 2020,” says Hunter.

Realising that this approach did not work and concerned about privacy, the government turned to a new system which uses two modalities – Covid Connect and Covid Alert. This system not only better protects personal data, but also improves the effectiveness of contact tracing.

“What was interesting is to see that the same government that had been fighting the surveillance reforms in the Constitutional Court actually responded very thoughtfully to the privacy concerns that would have come up with a system that used cellular location data,” says Hunter. “These modalities do not raise the same kinds of privacy concerns that we saw with the first response.” 

Hunter explains that the thinking behind digital contact tracing is “that the virus spreads so quickly, the earliest you can intervene, the better. It dramatically reduces how effective our response is in containing the spread of the virus.”

Covid Connect and the Covid Alert application

Covid Connect is a WhatsApp- and message-based service that digitises an otherwise labour-intensive process. It provides health guidance and connects healthcare workers to patients and vice versa.

Tanna explains that in South Africa, nearly two-thirds of the population use WhatsApp. As a result, Covid Connect has been a “great tool to get the reach required for this pandemic”.

Tanna says that Covid Connect has had more than eight million unique users — 9.6-million risk assessments and screenings have been done.

“However, the limitation with Covid Connect is that, like manual contact tracing, we [the Department of Health] would not be able to derive any context. The limitation of Covid Connect is that it requires users to have access to WhatsApp. Additionally, it relies on the accurate capturing of a cellphone number by the person collecting specimens.”

This is where the Covid Alert application is extremely beneficial.

Covid Alert is a free to use Bluetooth-enabled contact tracing application that is used to improve the contact tracing process. It constantly “polls” other users within its proximity.

“With the Bluetooth app, we are now able to derive context. As soon as the app finds another app user, it is able to log a record of this person,” says Tanna.

This log is completely anonymous as it is up to the user to send out an alert should they test positive for Covid-19. If a user decides to send out an alert, the application will then use the unique Bluetooth codes of devices that were nearby, thus notifying individuals and providing context of where the contact was made and for how long.

The limitation, however, is that it requires a smartphone.

Tanna explains that two primary concerns have been raised.

The first is battery drainage. “Covid Alert uses Bluetooth Low Energy protocol, so it does not significantly drain your battery.”

The second is privacy concerns. “All of the information is private. No personal information is collected,” says Tanna.

Hunter says one thing people need to hear is that the “Covid Alert app is not being used to track your location”.

To date, just above one million people have downloaded Covid Alert. Tanna and Hunter strongly encourage people to download the application.

“We need everybody to play their part,” says Tanna.

“Digital contact tracing augments efforts by healthcare workers to do contact tracing without being overwhelmed. Many countries have introduced digital contact tracing applications. The more people use them, the more control of Covid-19 can be achieved,” says Tanna.

Privacy beyond contact tracing

Singh says that in the context of contact tracing, while the government has put in frameworks for heightened data protection, it has also raised concerns for other applications beyond Covid-19 and contact tracing.

“Privacy is central to questions of identity, autonomy, decision making. We are seeing a demand by the public to have agency over their personal information.”

Singh explains that in South Africa “we have had a bit of a chequered record of the protection of personal information. While the Covid Alert application itself does not appear to collect personal information, which I think is really a positive development, it does give rise to concerns about data protection more broadly.”

These concerns are around the period of retention (how long information can be stored) and security.

The data collected by the Health Check application, for example, is not anonymised. “The application has been used and promoted by the Department of Higher Education to control access to higher education facilities.”

Singh explains that people need to know their rights when it comes to privacy.

“There must be a valid ground of justification, where you can collect or process personal information. The Protection of Personal Information (POPI) Act states that you should be able to understand who has been given access to your personal information, for what purpose and who that information is being shared with,” says Singh.

Singh says there are lessons to be learnt from the Covid Alert application.

While the Department of Health has taken positive steps to ensure privacy, Singh says that there is more work to be done.

“There is a fundamental need for an effective privacy framework in South Africa and a need for better coordination. The lack of involvement of the Information Regulator, for example, is something that has been of concern for privacy advocates,” says Singh. 

While some South Africans rightly express concerns over data protection with regard to digital contact tracing, the Department of Health worked hard to find responses that would help fight Covid-19 without risking people’s personal data. DM/MC

Like what you’re reading? Sign up to the Maverick Citizen newsletter and get a weekly round-up sent to your inbox every Tuesday. Free. Because paywalls should not stop you from being informed.