The answer to this question posed by the media, probably lies in the National Health Act (the Act).

The Act provides that all information concerning a patient, including their health status, treatment or stay in a health establishment, is confidential. This information may not be disclosed unless:

  • the patient consents to that disclosure in writing;
  • a court order or any law requires that disclosure; or
  • non-disclosure of the information represents a serious threat to public health.

If a patient is for some reason unable to give informed consent (in the context of being provided with a health service), the Act allows for such consent to be given by a person mandated by the patient in writing to grant consent on the patient’s behalf, or by a person authorised to give such consent in terms of any law or court order. Examples include curators, or persons who have been granted a power of attorney.

If the patient is unable to give informed consent, and there is no person mandated or authorised to give such consent, then consent may be given by the spouse or partner of the patient. In the absence of a spouse or partner, consent may be given by the following people, in the specific order listed:

  • parent;
  • grandparent;
  • adult child; or
  • sibling.

The provisions of the Act referred to above, relate to a living patient. The Protection of Personal Information Act (POPI) regards information relating to a living person’s health as ‘special personal information’ worthy of protection. POPI is not yet in force, but contains a number of conditions for the lawful processing of personal information, which give effect to the right to privacy. The Information Regulator has published a guidance note on the right to privacy, and the processing by public and private bodies of personal information relating to data subjects (for example individuals who have tested for or are infected with COVID-19) for the purposes of containing the spread and reducing the impact of COVID-19.

But what about the deceased, and journalists?

POPI does not expressly refer to a deceased data subject. However, based on its definitions of ‘data subject’, ‘person’ and ‘personal information’, its scope is seemingly limited to the processing of personal information relating to an identifiable living natural person (and where applicable, an identifiable existing juristic person). This means that even if POPI had been in force, none of its provisions would create any binding legal obligations for public or private bodies who process any information about deceased persons (for example the NCC, the Department of Health, National Institute of Communicable Diseases, independent laboratories, and voluntary organisations).

However, the definition of ‘personal information’ in the Promotion of Access to Information Act (PAIA) remains law in the absence of POPI’s enforcement and precludes private and public bodies from unreasonably disclosing personal information about a person, including a deceased individual (unless the person requesting the information is the deceased’s next of kin or makes the request with the written consent of the next of kin).

POPI also does not apply to the processing of personal information solely for the purpose of journalistic expression. Regard must be had to the Press Code of Ethics and Conduct for South African Print and Online Media (the Press Code).

Clause 3.2 of the Press Code states that the media must afford special weight to South African cultural customs concerning the protection of privacy and dignity of people who are bereaved and their respect for those who have passed away. Clause 3.4 precludes the media from disclosing the HIV / AIDS status of people without their consent. Clause 4.4 provides that the media must only disclose sufficient personal information (as defined in POPI) to identify the person being reported on, as some information may enable others to intrude on their privacy and safety.

The regulations to the Disaster Management Act provide that the Department of Health must create and maintain a database to enable the tracing of people who are known or reasonably suspected to have come into contact with a person known or suspected to have contracted COVID-19 (the Tracing Database). The Tracing Database must include the name and surname of all persons who have been tested for COVID-19, the test results, and the details of the known or suspected contacts of any person who tested positive for COVID-19. The regulations expressly state that the information in the Tracing Database is confidential, and that no person may disclose that information unless authorised to do so and the disclosure is necessary for purposes of addressing, preventing or combatting the spread of COVID-19. Failure to comply with these provisions may lead to a fine or imprisonment for up to six months.

In light of this disaster management regulation, the provisions of the Press Code, and the rights to privacy and human dignity enshrined in the Constitution’s Bill of Rights, the media should probably only publish the names of those who die of COVID-19 with the appropriate consent.

The exception to that would be if the non-publication of the name would result in a serious threat to public health. It may be in the public’s interest to publish the name of the deceased to alert those who were in contact with the deceased, particularly if the deceased was a public figure who frequented public gatherings. In such cases, the public benefit may outweigh the rights to privacy and human dignity. Journalists would need to exercise their professional discretion, perhaps in consultation with their regulator and the Department of Health.