[Regulation 8 Heading substituted by section 2(a) of Notice No. 714, GG43476, dated 25 June 2020]
means the database established by the National Department of Health in terms of subregulation (2); and
[Definition substituted by section 2(a) and (b) of Notice No. 714, GG43476, dated 25 June 2020]
| (b) | "COVID-19 Designated Judge" |
means a judge designated in terms of subregulation (13).
| (2) | The National Department of Health shall develop and maintain a national database in order to guide appropriate responses in addressing, preventing or combating the spread of COVID-19, including contact tracing and geospatial hotspot mapping. |
[Regulation 8(2) substituted by section 2(c) of Notice No. 714, GG43476, dated 25 June 2020]
| (3) | The COVID-19 Database may include all information considered necessary for the National Department of Health to guide appropriate responses in addressing, preventing or combating the spread of COVID-19, including but not limited to: |
| (a) | the first name and surname, identity or passport numbers, residential address and other address where such person could be located, and cellular phone numbers of all persons who have been tested for COVID-19; |
| (b) | the COVID-19 test results of all such persons; and |
| (c) | the details of the known or suspected contacts of any person who tested positive for COVID-19. |
[Regulation 8(3) substituted by section 2(d) of Notice No. 714, GG43476, dated 25 June 2020]
| (4) | The information contained in the COVID-19 Database and any information obtained through this regulation is confidential. |
| (5) | No person may disclose any information contained in the COVID-19 Database or any information obtained through this regulation unless authorized and unless the disclosure is to do so necessary for the purpose of addressing, preventing or combating the spread of COVID-19. |
| (6) | Where any person is to be tested for COVID-19, the person taking the sample for purposes of testing must obtain as much of the following information as is available at the time of taking the sample— |
| (a) | the first name and surname, identity or passport number, residential address, and cellular phone numbers of the person tested; and |
| (b) | a copy or photograph of the passport, driver's licence, identity card, identity book of the person tested; |
and promptly submit this information, along with any information it has regarding likely contacts of the person tested, to the Director-General: Health for inclusion in the COVID-19 Database.
| (7) | Where any laboratory has tested a sample for COVID-19, the laboratory must promptly transmit to the Director-General: Health, for inclusion in the COVID-19 Database— |
| (a) | all details the laboratory has, including the first name and surname, identity or passport numbers, residential address and cellular phone numbers, regarding the person tested; |
| (b) | the COVID-19 test result concerned. |
| (8) | The National Institute for Communicable Diseases (NICD) must transmit to the Director-General: Health. for inclusion in the COVID-19 Database— |
| (a) | all details the NICD has, including the first name and surname. identity or passport numbers, residential address and cellular phone numbers of any person tested for COVID-19; |
| (b) | the results of the COVID-19 test concerned; and |
| (c) | any information the NICD has regarding likely contacts of the person tested. |
| (9) | Every accommodation establishment must, promptly after the coming into force of this regulation, transmit to the Director-General: Health, for inclusion in the COVID-19 Database, the following information regarding every person staying at the accommodation establishment during the period of lockdown— |
| (a) | the first name and surname, identity or passport number, residential address and cellular phone numbers of the person concerned; and |
| (b) | a copy or photograph of the passport. driver's licence, identity card or identity book of the person concerned. |
| (10) | The Director-General: Health may, in writing and without prior notice to the person concerned, direct an electronic communications service provider licensed under the Electronic Communications Act, 2005 (Act No. 36 of 2005) to provide him or her, for inclusion in the COVID-19 Database, with such information as that electronic communications service provider has available to it regarding— |
| (a) | the location or movements of any person known or reasonably suspected to have contracted COVID-19; and |
| (b) | the location or movements of any person known or reasonably suspected to have come into contact, during the period 5 March 2020 to the date on which the national state of disaster has lapsed or has been terminated. with a person contemplated in subparagraph (a), |
and the electronic communications service provider must promptly comply with the directive concerned.
| (11) | The information referred to in subregulation (10)— |
| (a) | may only be obtained in relation to the location or movements of persons during the period 5 March 2020 to the date on which the national state of disaster has lapsed or has been terminated; |
| (b) | may only be obtained, used or disclosed by authorised persons and may only be obtained, used and disclosed when necessary for the purposes of addressing, preventing or combating the spread of COVID-19 through the contact tracing process or geospatial hotspot mapping; |
[Regulation 8(11)(b) substituted by section 2(e) of Notice No. 714, GG43476, dated 25 June 2020]
| (c) | where relevant to the contact tracing process, or geospatial hotspot mapping, must be included in the COVID-19 Database; and |
[Regulation 8(11)(c) substituted by section 2(f) of Notice No. 714, GG43476, dated 25 June 2020]
| (d) | apart from what is included in the COVID-19 Database, may only be retained by the Director-General: Health for a period of six weeks after being obtained and shall thereafter be destroyed. |
| (12) | Nothing in this regulation entitles the Director-General: Health or any other person to intercept the contents of any electronic communication. |
| (13) | The Cabinet member responsible for justice and correctional services has, in terms of section 7(1)(a) read with paragraph (d) of the definition of "service" in section 1(1) of Judges' Remuneration and Conditions of Employment Act, 2001 (Act No. 47 of 2001), appointed a Constitutional Court Judge who has been discharged from active service to perform service as a COVID-19 Designated Judge as provided for in the Regulations. |
| (14) | The Director-General: Health must file a weekly report with the COVID-19 Designated Judge setting out the names and details of all persons whose location or movements were obtained in terms of subregulation (10)(a) and 10(b) respectively. |
| (15) | The COVID-19 Designated Judge may make such recommendations to the Cabinet members responsible for cooperative governance and traditional affairs, health and justice and correctional services as he or she deems fit regarding the amendment or enforcement of this regulation in order to safeguard the right to privacy while ensuring the ability of the Department of Health to engage in urgent and effective measures to address, prevent and combat the spread of COVID-19. |
[Regulation 8(15) substituted by section 2(g) of Notice No. 714, GG43476, dated 25 June 2020]
| (16) | The Director-General: Health shall, within six weeks after the national state of disaster has lapsed, or has been terminated, notify every person whose information has been obtained in terms of subregulation (10) that information regarding their location or movements was obtained in terms of subregulation (10). |
| (17) | Within six weeks after the national state of disaster has lapsed or has been terminated— |
| (a) | the information on the COVID-19 Database shall be de- identified; |
| (b) | the de-identified information on the COVID-19 Database shall be retained and used only for research, study and teaching purposes; |
| (c) | all information on the COVID-19 Database which has not been de-identified shall be destroyed; and |
| (d) | the Director-General, Health shall file a report with the COVID-19 Designated Judge recording the steps taken in this regard. and the steps taken pursuant to subregulation (16). |
| (18) | Upon receipt of the report in subregulation (17)(d), the COVID-19 Designated Judge shall be entitled to give directions as to any further steps to be taken to protect the right to privacy of those persons whose data has been collected, which directions must be complied with. |
| (19) | The report required by subregulation (17)(d) and any directions given in terms of subregulation (18) shall be tabled in Parliament. |
| (20) | The National Department of Health may develop and implement electronic systems or applications to be used on mobile devices or computers in order to collect, on a voluntary basis, information from members of the public for inclusion in the COVID-19 Database, provided that— |
| (a) | the information may only be collected and used in order to guide appropriate responses in addressing, preventing and combating the spread of COVID-19, including for the purposes of geospatial hotspot mapping; |
| (b) | the information concerned is only obtained from users of mobile devices and computers on a voluntary and opt-in basis; |
| (c) | in order to obtain the necessary consent from the user of the mobile device or computer, the terms and conditions of the electronic system or application must explain and request the user's express consent regarding— |
| (i) | which information will be collected and stored via the electronic system or application; |
| (ii) | the means by which the information will be collected and stored; |
| (iii) | the purposes for which any information will be collected and used; |
| (iv) | the entities or persons to which that information will be transmitted, and under what conditions; |
| (v) | whether the information will be kept on the user's mobile device or a centralised server; |
| (vi) | the period for which the information will be retained; and |
| (vii) | the notice that will be given to users when the information has been destroyed. |
[Regulation 8(20) inserted by section 2(h) of Notice No. 714, GG43476, dated 25 June 2020]
| (21) | The National Department of Health may receive, on a voluntary basis, information regarding members of the public from electronic systems or applications operated by private entities for inclusion in the COVID-19 Database, provided that— |
| (a) | the information may only be received and used in order to guide appropriate responses in addressing, preventing and combating the spread of COVID-19, including for the purposes of geospatial hotspot mapping; |
| (b) | the private entity concerned has obtained the information concerned from users of mobile devices and computers on a voluntary and opt -in basis; and |
| (c) | the private entity concerned has obtained the express consent of the user concerned to transmit the information to the National Department of Health for inclusion on the COVID-19 Database. |
[Regulation 8(21) inserted by section 2(h) of Notice No. 714, GG43476, dated 25 June 2020]
| (22) | The Director-General of Health may, in writing and subject to the provisions of subregulation (23), appoint any organ of state outside the Department of Health or private entities to provide services necessary for the carrying out of his or her powers and functions under this regulation. |
[Regulation 8(22) inserted by section 2(h) of Notice No. 714, GG43476, dated 25 June 2020]
| (23) | The appointment of entities in terms of subregulation (22) may only take place where it is not reasonably possible for the services to be performed by the Department of Health itself due to the Department of Health not having the necessary expertise, equipment or personnel available or due to the delays that would result from the Department of Health performing the services itself. |
[Regulation 8(23) inserted by section 2(h) of Notice No. 714, GG43476, dated 25 June 2020]
| (24) | Where entities are appointed in terms of subregulation (22)— |
| (a) | the appointed entities are bound by these Regulations as if it were the Director-General of Health or an official appointed by him or her; |
| (b) | the appointed entities shall conclude a written agreement with the Director-General of Health which records that the appointed entities have understood this regulation and accepts that it and its employees are bound to comply with it; |
| (c) | every employee of an appointed entity who has access to any of the information or data obtained pursuant to the appointment of the entity shall sign an undertaking recording that she or he has understood this regulation and accept that he or she is bound to comply with it; |
| (d) | information stored by the appointed entities or transferred to or from the appointed entities must be in an encrypted form, save where this is not possible in achieving the purposes of this regulation, and access must be subject to password protection; |
| (e) | logs of every person who has had access to the data in encrypted or unencrypted form must be kept by the appointed entities, including the person's name, function, the date on which and the reason for which the data was accessed, which logs must be submitted by the appointed entities to Director-General of Health every two weeks; |
| (f) | only personal data that is adequate, relevant and limited to what is necessary in relation to the purpose may be processed; |
| (g) | the appointed entities will keep any information or data obtained pursuant to its appointment separate from any of the appointed entities other information or data; |
| (h) | following the end of the appointment period, the appointed entities may not retain any of the information or data obtained pursuant to its appointment, whether in original or duplicate form; |
| (i) | the appointed entities may not disclose any information or data obtained pursuant to their appointment with any other person or entity, other than where expressly permitted in writing by the Director-General of Health for the purposes of this regulation; and |
| (j) | the Director-General of Health shall inform the COVID-19 Designated Judge of the appointment of entities concerned. |
[Regulation 8(24) inserted by section 2(h) of Notice No. 714, GG43476, dated 25 June 2020]
