Data Protection under SARS-CoV-2
General Comments
The sudden outbreak of cases of COVID-19-afflictions ("Corona-Virus"), which was declared a pandemic by the WHO affects data protection in various ways. Different data protection authorities published guidelines for employers and other parties involved in the processing of data related to the Corona-Virus (read more below).
The Corona-Virus has also given cause to the use of different technologies based on data collection and other data processing activities by the EU member states and private companies. These processing activities mostly focus on preventing and slowing the further spreading of the Corona-Virus and on monitoring the citizens' abidance with governmental measures such as quarantine.
At the moment, it is not easy to figure out, which processing activities are actually supposed to be conducted and which are only rumours. This page will therefore be adapted once certain processing activities have been confirmed. For now, this article does not assess the lawfulness of particular processing activities, but rather outlines the general conditions for data processing in connection with the Corona-Virus.
It must be noted that several activities - such as monitoring, if citizens comply with quarantine and stay indoors by watching at mobile phone locations - can be done without having to use personal data under Article 4(1) GDPR, if all necessary information can be derived from anonymised data. The GDPR does not apply to activities that only rely on anonymised data.
Principles of Article 5 GDPR
Regardless of the exceptional situation, data processing activities in connection with measures against the Corona-Virus that rely on personal data (Article 4(1) GDPR) have to comply with the principles of data processing as lined out in Article 5 GDPR:
- Lawfulness, fairness and transparency: Data processing must be lawful under Article 6 GDPR and/or Article 9 GDPR. Some member states have already passed laws that deal with the Corona-Virus which must be taken into consideration when assessing the lawfulness of processing. See below for more information. Furthermore, processing must be fair and transparent. This includes i.e. that data subjects whose data is being processed for purposes of fighting the Corona-Virus must be informed under Article 13 GDPR or Article 14 GDPR once their data has been obtained.
- Purpose limitation: Personal data collected for the purposes of preventing/slowing the further spreading of the Corona-Virus and monitoring the citizens' abidance with governmental measures shall only be processed for these purposes.
- Data minimisation: Only personal data that is truly necessary for these purposes may be collected and processed.
- Accuracy: Personal data must be accurate and, where necessary, kept up to date.
- Storage limitation: Once the purposes for processing are fulfilled, the data must be deleted or anonymised.
- Integrity and confidentiality: Appropriate security of the personal data, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage must be ensured with the implementation of technical or organisational measures (Article 32 GDPR).
Legal Basis under Article 6 GDPR
Insofar data processing concerns only personal data, that does not qualify as special categories of personal data (Article 9(1) GDPR), processing activities can realistically be based on:
- Article 6(1)(d) GDPR, if processing is necessary to protect vital interests of the data subject or of another natural person; since the Corona-Virus is considered to be highly virulent, data can be processed in order to protect both infected people and others, to prevent them from being infected.
- Article 6(1)(e) GDPR, if processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; this legal basis can be invoked by public authorities pursuing the mentioned purpose.
- Article 6(1)(f) GDPR, legitimate interests pursued by the controller; this legal basis may also be invoked by private controllers, since there will not always be vital interest of the data subject or of other persons at stake, but processing is only necessary for "less severe" reasons, e.g. if certain goods and services are limited due to difficulties of supply and it must be ensured that these goods and services are equally distributed among customers. Article 6(1)(f) GDPR does not apply to processing carried out by public authorities in the performance of their tasks; these authorities have to rely on Article 6(1)(e) GDPR.
Legal Basis under Article 9 GDPR
Article 9(1) GDPR lines out the conditions under which special categories of personal data may be processed. With regards to the Corona-Virus this mostly concerns health data, genetic data and biometric data for the purpose of uniquely identifying a natural person (e.g. at airports or state borders).
Article 9(1)(i) GDPR deals with scenarios such as the current Corona-Virus, which qualifies as a "serius cross-border threat to health":
"[...] processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy."
Furthermore, Recital 46 of the GDPR specifically mentions epidemic scenarios:
"The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Processing of personal data based on the vital interest of another natural person should in principle take place only where the processing cannot be manifestly based on another legal basis. Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters."
Envisaged or conducted processing activities regarding COVID-19 per EU member state
The following table shows data processing activities that have been envisaged by EU member states or that are already have been implemented:
| EU member state | Processing Activities | Status | Comments | Source |
|---|---|---|---|---|
| Austria | Telecommunication provider A1 transmits - allegedly anonymised - localation data of mobile phone users to the Austrian government | Confirmed | The purpose of this processing activity is to track the decrease of the presence of citizens in public areas.
According to A1, the location data are being anonimsed by assigning randomly generated numbers to each mobile phone user. These numbers are changed every 24 hours. A1 also stated on its home page, that movement of persons is only analysed and visualised in "groups of 20 or more people", since the technology has originally been developed to track streams of tourists in the proximity of tourist attractions. Concerns have been voiced that there is no legal basis for the processing of historical location data. In addition, it is unclear whether the assignment of random temporary numbers qualifies as anonymisation or is a measure of mere pseudonymisation. If the latter is true, the GDPR fully applies. |
https://www.derstandard.at/story/2000115828957/mobilfunker-a1-liefert-bewegungsstroeme-von-handynutzern-der-regierung |
| Belgium | Example | Example | Example | Example |
| Bulgaria | Example | Example | Example | Example |
| Croatia | Example | Example | Example | Example |
| Republic of Cyprus | Example | Example | Example | Example |
| Czech Republic | Example | Example | Example | Example |
| Denmark | Example | Example | Example | Example |
| Estonia | Example | Example | Example | Example |
| Finland | Example | Example | Example | Example |
| France | Example | Example | Example | Example |
| Germany | Example | Example | Example | Example |
| Greece | Example | Example | Example | Example |
| Hungary | Example | Example | Example | Example |
| Ireland | Example | Example | Example | Example |
| Italy | Example | Example | Example | Example |
| Latvia | Example | Example | Example | Example |
| Lithuania | Example | Example | Example | Example |
| Luxembourg | Example | Example | Example | Example |
| Malta | Example | Example | Example | Example |
| Netherlands | Example | Example | Example | Example |
| Norway | Bergen municipality implemented a location based alert and information system. | Confirmed | The implemented system is used for "geo-fencing" the municipality, so that people arriving within the perimeter are notified of restrictions to avoid infection. In addition, the system can send an alert to all SIM-cards in a geographic area to break up crowds. Apparently, only an approximation of the number of people in a given area and of a certain size is provided, as well as different nationalities connected to SIM-cards.
According to the municipality, the data is received aggregated from the telecommunication providers. |
https://www.bt.no/nyheter/lokalt/i/wPQMdn |
| Poland | Example | Example | Example | Example |
| Portugal | Example | Example | Example | Example |
| Romania | Example | Example | Example | Example |
| Slovakia | Example | Example | Example | Example |
| Slovenia | Example | Example | Example | Example |
| Spain | Example | Example | Example | Example |
| Sweden | Example | Example | Example | Example |
DPA Guidelines
In the context of the Corona Virus, the EU/EEA data protection authorities released guidelines on the processing of personal data and also on the continuity of their tasks in times of the Corona-Virus:
Austria
The Data protection authority (the DSB) issued guidelines here. The DSB explained the existing legal basis for the collection and processing of health data by employers, in particular the transfer of sensitive data to health authorities. In addition, the DSB provided a sample form for the collection of private contact details of employees in order to warn about an infection in the company. An information sheet about data security and home office can also be found on the webpage.
Croatia
The Data protection authority (the AZOP) issued guidelines here. It focused on the health data of employees and stressed that a valid legal basis would be either Article 6(1)(c) GDPR, or Article 6(1)(d) GDPR or Article 9(2)(b) GDPR.
Czech Republik
The Data protection authority (the UOOU) issued FAQS (Frequently asked questions) here. The FAQs focused on the acknowlegment of the state of emergency under Article 9(2)(i) GDPR and its the consequences on data subjects' rights.
Denmark
The Data protection authority (Datatilsynet) issued guidelines on working from home here. It contains advice to the employers and employees. Datatilsynet emphasized the importance of internal guidelines for working at home and related security measures, which shall be taken on company and personal devices.
Datatilsynet also issued guidelines for employers on handling information about employees who are infected with COVID-19 or who have traveled in risk areas here.
Estonia
The Data protection authority (the AKI) issued guidelines here. The AKI explained whether the employer is entitled to request medical records from employees.
France
The Data protection authority (the CNIL) issued guidelines here. The CNIL addressed the numerous requests from businesses about the collection and sharing of employees' health data.
Germany
The Federal Data protection authority (the BfDi) issued guidelines here, as well as the DPA of Bradenburg, see here. The BfDI emphasized the sensitivity of personal data in the context of COVID-19 and the continuing responsibility to comply with the data protection principles.
Greece
The Data protection authority (the HDPA) issued guidelines here. The DPA stressed that the right to the protection of personal data is not absolute and that its application should be balanced against other fundamental rights, taking into consideration the principle of proportionality. However, it emphasised that any communication of personal data (and particularly health data) to third parties shall not be allowed if it can lead to discrimination and stigmatisation.
Hungary
The Data protection authority (the NAIH) issued guidelines here. The NAIH listed the data protection measures that are expected from the employers arising from the responsibility for ensuring the conditions for the safe performance of work. It also addressed the fact that health care providers and doctors shall still comply with data protection.
Iceland
The Data protection authority (the Persónuvernd) issued guidelines here. The guidelines refer to the general data protection principles that need to be followed. It further contains recommendations for employers and schools.
Italy
The Data protection authority (the Garante per la protezione dei dati personali) issued guidelines "No do-it-yourself (DIY) data collection" here. The Garante mainly recommended that private and public bodies must refrain from collecting, in advance and in a systematic and generalised manner, the employees' and workers' personal data and must follow the instructions from the Ministry of Health and the competent institutions.
Ireland
The Data protection authority (the DPC) issued guidelines here. The DPC elaborated on the application and meaning of the general data protection principles in the context of processing of personal data related to the virus. The DPC further focused on the existing rights of employers and the time to answer the requests of data subjects.
Latvia
The Data protection authority (the DVI) issued guidelines here. The DVI clarified that the processing of sensitive data in such circumstances is lawful if necessary to protect the vital interests of the data subject or other natural person (eg surveillance of an epidemic) and for reasons of public interest in public health serious cross-border threats to health, pursuant to Article 9 (2) (i) and (j) GDPR.
Luxembourg
The Data protection authority (the CNPD) issued guidelines here. The CNPD wrote some recommendations addressed both to private and public sphere and concerning the measures which have to be implemented for the prevention, information, and safety of all the stakeholders'.
The Netherlands
The Data protection authority (the AP) issued guidelines here. The AP focused on the measures the employer has to take to and process sensitive data and further explains which information the employer is allowed to request and collect when an employee is ill. Both employers and employees has to follow the guidelines of the National Institute for Public Health and the Environment. The AP also offers guidelines how to work save at home and protect sensitive data here.
Norway
The Data protection authority (the Datatilsynet) issued guidelines here. Datatilsynet answered questions regarding the use of video services for communications and webcams for schools. Further recommendations relate to the data processing from health authorities, hospitals and companies in their role as controller or processors and as employers.
Romania
The Data protection authority (the ANSPDCP) issued guidelines here. The ANSPDCP focused on the processing of health data under exceptional circumstances and it underlined the importance of data controllers complying with their obligations for information and transparency and for maintaining security of processing.
Slovenia
The Data protection authority (the IP) issued guidelines here. The IP focuses on the disclosure and processing of personal data from medical institutions and others working in the health sector. It also elaborates on the processing of statistical data in this context.
Spain
The Data protection authority (the AEPD) issued guidelines here (also available in English here). Additionally, it has also published a FAQ document, a small communication regarding webs and apps offering self-evaluation and tips on COVID-19, and another small communication regarding phishing campaigns on COVID-19.
Sweden
The Data protection authority (the Datainspektionen) issued guidelines here. Datainspektionen answered questions relating to the responsibilities of the employer and the processing of personal data in connection with the virus.
The UK
The Data protection authority (the ICO) issued guidelines here. The ICO mainly focused on the processing of personal data in the employment context, i.e the security measures which have to be implemented during homeworking, collection and sharing of the employees' health data.
EDPB
The EDPB issued a statement on 16 March 2020 here. Mainly, the EDPB focused on the processing necessary for reasons of public interest or to protect vital interest or to comply with another legal obligation (Articles 6 and 9 GDPR). Also, the EDPB mentioned that additional rules for the processing of electronic communications apply, in the light of the ePrivacy Directive.
On 19 March 2020, the EDPB adopted a full statement here, explaining the lawfulness of processing, processing in the employment context as well as processing of location data.
