Transparency in Mauritius

The Ministry of Health and Wellness publishes up to date aggregate statistics on a website regarding the reported number of Covid-19 cases, the reported number of active Covid-19 cases, reported number of Covid-19 deaths and the reported number of people cured from Covid-19. Statistics Mauritius, with the support of the Ministry of Finance Economic Planning and Development, has also published a dashboard comprising important international and national economic and social indicators. This has been updated on a daily basis with information gathered from various government ministries and departments.

In collaboration with the UNDP Global Centre for Technology, Innovation and Sustainable Development, the OpenELIS software, based on open source software, was made available to the Ministry of Health and Wellness as an enterprise-level laboratory information system. The software was customised to provide for a flexible COVID-19 test catalogue; batch processing of bio-samples; and barcode generation for improved printing and reporting capabilities. The software serves as both an effective laboratory software solution and business process framework.

“The Data Protection Act 2017 applies to the processing of personal data (name, contact details, travel history, and family connections of individuals) and special categories of personal data (temperature, blood sample, amongst others). According to the Guide on Data Protection for Health Data and Artificial Intelligence Solutions issued by the Data Protection Office, organisations must be transparent regarding the measures they implement in the context of Covid-19, including the purpose/s of collecting the personal data, the intended recipients of the data and how long it will be retained at the time of collection through the display of appropriate notices. They are also required by section 21(c) of Data Protection Act to the provide individuals with information regarding the processing of their personal data in a format that is concise, easily accessible, easy to understand, and in clear and plain language.

The Communicable Diseases Control Unit, which is within the Directorate of Public Health Services of the Ministry of Health and Wellness, has been responsible for analysing and collecting data pertaining to Covid-19, surveillance at the points of entries, and coordinating case management and contact tracing. Epidemiological data was entered in a geographic information system programme. This helped Government reinforce community surveillance in areas where clustered cases occurred.

The UNDP Country office assisted the National Health Laboratory Services to adopt a new laboratory information management system for COVID-19. This system aimed to effectively manage laboratory samples and related data throughout the testing, reporting and archiving procedures with the use of a barcoding system. With the assistance of the Innovation and Sustainable Development in Singapore, the UNDP Country Office ensured the Ministry of Health and Wellness was able to use the OpenELIS software. This software was customised by the Central Health Laboratory team and the Central Informatics Bureau from the Ministry of
Information Technology, Communication and Innovation. The University of Washington was also contracted by the UNDP Country Office to help with the implementation of the system and procured the necessary software and hardware. The Mauritius Telecom was responsible for ensuring internet connectivity and the Ministry of Information was responsible for cloud storage.”

“As clarified in the Guide on Data Protection for Health Data and Artificial Intelligence Solutions issued by the Data Protection Office, the Data Protection Act provides for various legal grounds upon which personal data may be lawfully processed. These include the data subject’s consent to the processing for one or more specified purposes; and the process being necessary for, among others, the purpose of historical, statistical or scientific research; the legitimate interests pursued by the controller or by a third party to whom the data are disclosed, except if the processing is unwarranted in any particular case having regard to the harm and prejudice to the rights and freedoms or legitimate interests of the data subject; the exercise, by any person in the public interest, of any other functions of a public nature; the performance of any task carried out by a public authority; for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; in order to protect the vital interests of the data subject or another person; for compliance with any legal obligation to which the controller is subject; or the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject before entering into a contract.

There are additional requirements for special categories of personal data, including data concerning physical or mental health or condition (such as the temperature of an individual, blood sample, tests amongst others), genetic data or biometric data. In terms of section 29 of the Data Protection Act, the processing of such data must be carried out in the course of legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and the data must not be disclosed outside that body without the consent of the data subjects. Such data may also be processed for the purpose of preventive or occupational medicine; for the assessment of the working capacity
of an employee, medical diagnosis, the provision of health or social care or treatment or the
management of health or social care systems and services or pursuant to a contract with a health
professional and subject to prescribed conditions and safeguards; the purpose of carrying out the obligations and exercising specific rights of the controller or of the data subject; or protecting the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving consent.”

The Data Protection Office has issued a Guide on Data Protection for Health Data and Artificial Intelligence Solutions

Upon a positive PCR test, the Central Health Laboratory contacts the Communicable Diseases Control Unit who in turns contacts the person or concerned authorities where the person is isolated. The Communicable Diseases Control Unit’s Rapid Response Team then intervenes to transfer the person test positive to COVID-19 to a treatment centre. The updated statistics are also shared in with the other public health authorities and the High-Level Committee on COVID-19.

An extensive desktop search of online sources did not reveal any relevant information.

After an extensive desktop search of online information, no instances of parliamentary, judicial or public scrutiny of intra-governmental data sharing was found.