Important Information
This website uses cookies. By using this website you accept the use of cookies. Learn more.
On 21 April, within its Plenary Session, the European Data Protection Board (EDPB) adopted two essential guidelines on the major data processing activities performed in the context of the Covid-19 pandemic: Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak (Guidelines 04/2020) and Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak (Guidelines 03/2020).
The main aspects tackled by Guidelines 04/2020 are the use of location data and of contact tracing applications. Once again, EDPB underlines that personal data should be processed in accordance with the legal processing principles no matter the purposes aimed. More precisely, the location data collected from electronic communication providers may only be transmitted to authorities or other third parties to the extent that: (i) they have been anonymised by the provider or, (ii) with the prior consent of the users(for data indicating the geographic position of the terminal equipment of user, which are not traffic data);
Also, storing and/or gaining access to location data, collected directly from the terminal equipment of user, shall be allowed only if: (i) the user has given consent or (ii) the storage and/or access is strictly necessary for the information society service explicitly requested by the user.
Data controllers should perform a “reasonability test”, assessing the ability to link the data with an identified or identifiable natural, based both on objective aspects (time, technical means), as well as contextual elements (population density, nature and volume of data etc.). Only data passing this test shall be considered anonymised.
Concerning the use of contact tracing applications, EDPB mentions that such applications should be used based on a voluntary adoption by the users, without any negative consequences for the individuals who decide not to or cannot use such applications. The controllers for such application could mainly be national health authorities, but this is not a rule.
It is important that the processing activity is very specific, as to exclude further processing for purposes unrelated to the management of the COVID19 outbreak (e.g., commercial or law enforcement purposes). Also, as a general rule, personal data should be stored only for the duration of the COVID-19 crisis.
The legal ground for the processing of personal data will not necessarily be data subject’s consent, but rather the performance of a task in the public interest (Art. 6(1)(e) GDPR). To the extent that health data is processed, legal basis such as Art. 9(2)(i) (reasons of public interest in the area of public health), Art. 9(2)(h) (healthcare purposes), Art. 9(2)(a) (explicit consent), Art. 9(2)(j) (scientific/research purposes) may be used;
A detailed contact tracing applications analysis guide may be found in the Annex to Guidelines 04/2020.
As per Guidelines 03/2020 on rules of processing of heath data for the purpose of scientific research, EDPB emphasises, inter alia, the following rules and recommendations regarding the processing of health data for scientific research purposes, in the context of Covid-19 outbreak:
It is considered that the fight against COVID-19 has been recognised by the EU and most of its Member States as an important public interest. Thus, public authorities, as well as private entities playing a role in pursuing such public interest may rely on this derogation, but mainly as a temporary measure due to the urgency of the actual situation.
The initial transfers carried out for the purpose of research in the Covid-19 outbreak context may be based on these derogations. However, long-lasting research projects in this regard, including repetitive transfers, need to be subject of appropriate safeguards in accordance with Article 46 GDPR.
Musat & Asociatii Privacy team assists all its clients with customized legal advice in order to support them during these difficult times. For any queries or information, do not hesitate to contact our specialized lawyers in privacy matters: