On 17 April 2020, the Mauritius Data Protection Office (the
"DPO") published a guide on data
protection in the context of the Coronavirus (COVID-19)
outbreak. The DPO, as the enforcing authority under the Data
Protection Act (the "Act"), has
reiterated that all organisations involved in the processing of
data should continue to comply with all their obligations under the
Act.
Data processing in the context of COVID-19
The Guide reminds data controllers that consent is not the sole
basis for processing data. While the Act allows a data controller
to process personal data when necessary, in respect of special
categories of data (including health data), further specific
conditions will apply. For instance, the DPO acknowledges that
supermarkets are under a legal obligation to take the temperature
of their customers, and it could be argued that this is required to
protect the vital interests of data subjects, other people within
the supermarket, and to allow the
