The purpose of the Protection of Personal Information Act (POPI Act), as defined by the Act itself, is to protect personal information, to strike a balance between the right to privacy and the need for the free flow of, and access to information, and to regulate how personal information is processed.
The Act sets the minimum standard regarding personal information as well as regulating the “processing” of personal information.
By “processing” the Act refers to the collecting, receiving, recording, organising, retrieving, or use of any such information; and the distribution or sharing of any such information.
However, the Information Regulator (The Regulator) recognizes the need to effectively manage the spread of COVID19, which has necessitated the limitation of various constitutional rights of data subjects.
The Regulator therefore supports the need to process personal information of data subjects to curb the spread of COVID-19.
As such, if the non-disclosure of a patient’s medical information would pose a serious threat to public health, then the medical information must be disclosed.
For the disclosure to be justified, the risk of harm to others must be serious enough to outweigh the patient’s right to confidentiality and privacy.
For more information, contact Tracey Mouton at Golberg & de Villiers Inc. on 041 5019800.
Article authored by Share Hassan, Candidate Attorney, Labour Law Division