Appropriate steps are taken to protect data that could, either alone or when combined with other data, result in the identification of individuals or vulnerable groups within datasets used to tackle COVID-19
After an extensive desktop search of online information, no information could be found to demonstrate what any such appropriate steps are required or have been taken.
Data collected for epidemiological purposes shall not be shared or used by other parts of government, such as police forces or Ministries of Interior
After an extensive desktop search of online information, no information could be found to suggest that there are restrictions on the sharing of data that was collected for epidemiological purposes with other parts of government.
Protocols shall be established to respond to potential data breaches of datasets containing sensitive data
The Data Protection Act requires that the data controller or a third party who processes data under the authority of the data controller shall notify the Data Protection Commission when there are reasonable grounds to believe that the personal data of a data subject has been accessed or acquired by an unauthorised person. Such parties must also notify the data subject of the unauthorised access or acquisition as soon as reasonably practicable after the discovery of the unauthorised access or acquisition of the data.
Individuals or vulnerable groups who may be harmed by the misuse of their data in response to the COVID-19 pandemic – either intentionally or accidentally – shall have access to judicial redress and due process
Although such individuals and groups would formally have access to judicial redress to persue a civil claim, they may in fact experience difficulty in obtaining legal advice and representation.
Governments and public bodies shall retain all intellectual property rights over databases and all derivative data outputs produced using African citizens’ data as part of the COVID-19 response
After an extensive desktop search of online information, no information could be found to demonstrate that governments and public bodies have registered or asserted any such intellectual property rights.
Governments, private companies and other entities shall commit to engaging with civil society organisations and digital rights defenders in order to identify responsible and practicable ways of winding-down any emergency data collection, processing and use at the end of the pandemic, in accordance with local laws and in line with international best practices
After an extensive desktop search of online information, no information could be found to suggest that any such engagement has taken place.