Data Protection under SARS-CoV-2
General Comments
The sudden outbreak of cases of COVID-19-afflictions ("Corona-Virus"), which was declared a pandemic by the WHO affects data protection in various ways. Different data protection authorities published guidelines for employers and other parties involved in the processing of data related to the Corona-Virus (read more below).
The Corona-Virus has also given cause to the use of different technologies based on data collection and other data processing activities by the EU/EEA member states and private companies. These processing activities mostly focus on preventing and slowing the further spreading of the Corona-Virus and on monitoring the citizens' abidance with governmental measures such as quarantine. Some of them are based on anonymous or anonymized data (like for statistics or movement patterns), but some proposals also revolved around personalized tracking.
At the moment, it is not easy to figure out, which processing activities are actually supposed to be conducted and which are only rumors. This page will therefore be adapted once certain processing activities have been confirmed. For now, this article does not assess the lawfulness of particular processing activities, but rather outlines the general conditions for data processing in connection with the Corona-Virus.
It must be noted that several activities - such as monitoring, if citizens comply with quarantine and stay indoors by watching at mobile phone locations - can be done without having to use personal data under Article 4(1) GDPR, if all necessary information can be derived from anonymised data. The GDPR does not apply to activities that only rely on anonymised data.
Principles of Article 5 GDPR
Regardless of the exceptional situation, data processing activities in connection with measures against the Corona-Virus that rely on personal data (Article 4(1) GDPR) have to comply with the principles of data processing as lined out in Article 5 GDPR (read more). As a situation like the Corona-Outbreak will often allow processing under different legal basis (see below), the main element to contain disproportionate processing, are the principles in Article 5:
- Lawfulness, fairness and transparency: Data processing must be lawful under Article 6 GDPR and/or Article 9 GDPR. Some member states have already passed laws that deal with the Corona-Virus which must be taken into consideration when assessing the lawfulness of processing. See below for more information. Furthermore, processing must be fair and transparent. This includes i.e. that data subjects whose data is being processed for purposes of fighting the Corona-Virus must be informed under Article 13 GDPR or Article 14 GDPR once their data has been obtained.
- Purpose limitation: Personal data collected for specific purposes, like preventing/slowing the further spreading of the Corona-Virus within a company, monitoring the citizens' abidance with governmental measures, medial research or tracking of interactions with infected persons shall only be processed for these purposes. The purpose must be in line with the legal basis chosen by the controller or defined by national legislation.
- Data minimisation: Only personal data that is truly necessary for these purposes may be collected and processed. It is not possible to process data that is not crucially necessary to fulfill the choose purpose.
- Accuracy: Personal data must be accurate and, where necessary, kept up to date. Especially "big data" and "quick and dirty" approaches that may be though of at times of crisis, may conflict with this principle. In cases where personal consequences may rely on data (e.g. limitation of movement, access to health care or saving people from infections) the accuracy of personal data is of utmost importance.
- Storage limitation: Once the purposes for processing are fulfilled, the data must be deleted or anonymised. When processing data about individual persons, the currently established timelines (e.g. the now common 14 days of quarantine) also form the basis for any storage limitation. Data may be anonymized, to be further used for statistics or research purposes.
- Integrity and confidentiality: Appropriate security of the personal data, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage must be ensured with the implementation of technical or organisational measures (Article 32 GDPR). Taking security measures seriously is especially crucial when processing operations are stated under short timelines and pressure and the wider populations should trust these measures.
Legal Basis under Article 6 GDPR
Insofar data processing concerns only personal data, that does not qualify as special categories of personal data (such as health data under Article 9(1) GDPR (see below)), processing activities can realistically be based on:
- Article 6(1)(d) GDPR, if processing is necessary to protect vital interests of the data subject or of another natural person. Recital 46 of the GDPR, explicitly names the "monitoring of epidemics" as a vital interest. As the Corona-Virus is considered to be highly virulent, data can be processed in order to protect both infected people and others, to prevent them from being infected.
- Article 6(1)(e) GDPR, if processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; this legal basis can be invoked by public authorities pursuing the mentioned purpose. Such a measure may be based on a national implementing law (Article 6(2) GDPR).
- Article 6(1)(f) GDPR, legitimate interests pursued by the controller or by a third party; this legal basis may also be invoked by private controllers, since there will not always be vital interest of the data subject or of other persons at stake, but processing is only necessary for "less severe" reasons, e.g. if certain goods and services are limited due to difficulties of supply and it must be ensured that these goods and services are equally distributed among customers. Article 6(1)(f) GDPR does not apply to processing carried out by public authorities in the performance of their tasks; these authorities have to rely on Article 6(1)(e) GDPR.
Legal Basis under Article 9 GDPR
Article 9(1) GDPR lines out the conditions under which special categories of personal data may be processed. With regards to the Corona-Virus this mostly concerns health data, genetic data and biometric data for the purpose of uniquely identifying a natural person (e.g. at airports or state borders).
Article 9(2)(i) GDPR deals with scenarios such as the current Corona-Virus, which qualifies as a "serius cross-border threat to health":
- "[...] processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy."
Furthermore, the recent Latvian DPA (the DVI)'s guidelines highlight that Article 9(2)(j) GDPR could be a legal basis for scientific research purporses or statistical purposes.
Lastly, Recital 46 of the GDPR specifically mentions epidemic scenarios:
- "The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Processing of personal data based on the vital interest of another natural person should in principle take place only where the processing cannot be manifestly based on another legal basis. Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters."
Other elements of GDPR
Obviously, all other elements of GDPR also apply to processing of personal data, when fighting the Corona-Virus. Notably the rights of the data subject (Article 12 to 23 GDPR) including the rights to information ("Privacy Policy"), access, rectification and alike are highly relevant to any Corona related processing.
The concept of "privacy by design" Article 25 GDPR seems crucial in designing larger scale systems. As many processing operations will relate to sensitive health data, special precautions from a data security standpoint Article 32 GDPR should be observed.
In addition, data protection impact assessments under Article 35 GDPR will be mandatory regarding a lot of these processing activities, especially in cases of large scale processing of special categories of personal data (Article 35(3)(b) GDPR) or the systematic large scale monitoring of publicly accessible areas (Article 35(3)(c) GDPR).
DPA Guidelines
In the context of the Corona Virus, the EU/EEA data protection authorities released guidelines on the processing of personal data and also on the continuity of their tasks in times of the Corona-Virus:
EDPB
The EDPB issued a statement on 16 March 2020 here. Mainly, the EDPB focused on the processing necessary for reasons of public interest or to protect vital interest or to comply with another legal obligation (Articles 6 and 9 GDPR). Also, the EDPB mentioned that additional rules for the processing of electronic communications apply, in the light of the ePrivacy Directive.
On 19 March 2020, the EDPB adopted a full statement here, explaining the lawfulness of processing, processing in the employment context as well as processing of location data.
Austria
The Data protection authority (the DSB) issued guidelines here. The DSB explained the existing legal basis for the collection and processing of health data by employers, in particular the transfer of sensitive data to health authorities. In addition, the DSB provided a sample form for the collection of private contact details of employees in order to warn about an infection in the company. An information sheet about data security and home office can also be found on the webpage.
Bulgaria
The Bulgarian Parliament adopted Law on Measures and Actions during the the state of emergency. One of the measures requires the establishment of checkpoints at the regional cities so that law enforcement authorities can check people.
The Bulgarian DPA (CPDP) issued an opinion regarding the legality of the the processing of personal data by the Ministry of Interior by collecting declarations from citizens passing through the checkpoint.
Croatia
The Data protection authority (the AZOP) issued guidelines here. It focused on the health data of employees and stressed that a valid legal basis would be either Article 6(1)(c) GDPR, or Article 6(1)(d) GDPR or Article 9(2)(b) GDPR.
Czech Republic
The Data protection authority (the UOOU) issued FAQS (Frequently asked questions) here. The FAQs focused on the acknowlegment of the state of emergency under Article 9(2)(i) GDPR and its the consequences on data subjects' rights.
Denmark
The Data protection authority (Datatilsynet) issued guidelines on working from home here. It contains advice to the employers and employees. Datatilsynet emphasized the importance of internal guidelines for working at home and related security measures, which shall be taken on company and personal devices.
Datatilsynet also issued guidelines for employers on handling information about employees who are infected with COVID-19 or who have traveled in risk areas here.
Estonia
The Data protection authority (the AKI) issued guidelines here. The AKI explained whether the employer is entitled to request medical records from employees.
France
The Data protection authority (the CNIL) issued guidelines here. The CNIL addressed the numerous requests from businesses about the collection and sharing of employees' health data. Moreover, the CNIL released guidelines on the good practices for home office regarding the security of the processing here.
Germany
The Federal Data protection authority (the BfDi) issued guidelines here, as well as the DPA of Bradenburg, see here. The BfDI emphasized the sensitivity of personal data in the context of COVID-19 and the continuing responsibility to comply with the data protection principles. The Datenschutzkonferenz (DSK) also issued a resolution on Coronavirus here. The DSK focusing on the data protection law principles, as foreseen in Article 5 GDPR, which ensure to protect fundamental rights and to process lawfully personal data during the pandemic. The authority also highlighted that the measures took to fight against the virus should be designed and implemented to be reversible to ensure that the personal data which are no necessary collected after the pandemic crisis, are no longer processed.
Greece
The Data protection authority (the HDPA) issued guidelines here. The DPA stressed that the right to the protection of personal data is not absolute and that its application should be balanced against other fundamental rights, taking into consideration the principle of proportionality. However, it emphasised that any communication of personal data (and particularly health data) to third parties shall not be allowed if it can lead to discrimination and stigmatisation.
Hungary
The Data protection authority (the NAIH) issued guidelines here. The NAIH listed the data protection measures that are expected from the employers arising from the responsibility for ensuring the conditions for the safe performance of work. It also addressed the fact that health care providers and doctors shall still comply with data protection.
Iceland
The Data protection authority (the Persónuvernd) issued guidelines here. The guidelines refer to the general data protection principles that need to be followed. It further contains recommendations for employers and schools.
Italy
The Data protection authority (the Garante per la protezione dei dati personali) issued guidelines "No do-it-yourself (DIY) data collection" here. The Garante mainly recommended that private and public bodies must refrain from collecting, in advance and in a systematic and generalised manner, the employees' and workers' personal data and must follow the instructions from the Ministry of Health and the competent institutions.
Ireland
The Data protection authority (the DPC) issued guidelines here. The DPC elaborated on the application and meaning of the general data protection principles in the context of processing of personal data related to the virus. The DPC further focused on the existing rights of employers and the time to answer the requests of data subjects. The DPC issued also guidance on how to deal with data subjects access requests during this period.
Latvia
The Data protection authority (the DVI) issued guidelines here. The DVI clarified that the processing of sensitive data in such circumstances is lawful if necessary to protect the vital interests of the data subject or other natural person (eg surveillance of an epidemic) and for reasons of public interest in public health serious cross-border threats to health, pursuant to Article 9 (2) (i) and (j) GDPR.
Luxembourg
The Data protection authority (the CNPD) issued guidelines here. The CNPD wrote some recommendations addressed both to private and public sphere and concerning the measures which have to be implemented for the prevention, information, and safety of all the stakeholders'.
The Netherlands
The Data protection authority (the AP) issued guidelines here and here. The AP focused on the measures the employer has to take to and process sensitive data and further explains which information the employer is allowed to request and collect when an employee is ill. Both employers and employees has to follow the guidelines of the National Institute for Public Health and the Environment. The AP also offers guidelines how to work save at home and protect sensitive data here.
Norway
The Data protection authority (the Datatilsynet) issued guidelines here. Datatilsynet answered questions regarding the use of video services for communications and webcams for schools. Further recommendations relate to the data processing from health authorities, hospitals and companies in their role as controller or processors and as employers.
Poland
The President of the Personal Data Protection Office (UODO) issued a statement here. The President of UODO informed that the issues related to the processing of health data as a result of activities aimed at preventing spread of COVID-19 virus are regulated in the specific legal provisions, in particular in the so called "Special Law" of 2 March 2020. The President of UODO stated that the provisions on the protection of personal data cannot be considered as an obstacle to conducting activities with regard to fighting the virus. The adopted provisions of the Special Law do not conflict with the principles of data processing and do not infringe the GDPR.
Romania
The Data protection authority (the ANSPDCP) issued guidelines here. The ANSPDCP focused on the processing of health data under exceptional circumstances and it underlined the importance of data controllers complying with their obligations for information and transparency and for maintaining security of processing.
Slovakia
The Data protection authority (the UOOUSR) issued information with FAQs (Frequently asked questions) here and here. The FAQs focused on the processing of health data under exceptional circumstances and on the importance of information security measure while working from home. The UOOUSR also issued information on processing of data concerning quarantined persons by municipalities here, unofficial Slovak translation of EDPB's Statement on the processing of personal data in the context of the COVID-19 outbreak here, as well as small communication on the Chair of the Committee of Convention 108 and the Data Protection Commissioner of the Council of Europe recalling the principles of data protection in these times of fight against the COVID-19 pandemic here (the original is available in English here).
Slovenia
The Data protection authority (the IP) issued guidelines here. The IP focuses on the disclosure and processing of personal data from medical institutions and others working in the health sector. It also elaborates on the processing of statistical data in this context.
Spain
The Data protection authority (the AEPD) issued guidelines here (also available in English here). Additionally, it has also published a FAQ document, a press release on public and private webs and apps offering self-evaluation and tips, a small communication on illicit webs and apps offering self-evaluation and tips, a small communication regarding phishing campaigns and a small communication on temperature taking at stores, work centres and other establishments.
Sweden
The Data protection authority (the Datainspektionen) issued guidelines here. Datainspektionen answered questions relating to the responsibilities of the employer and the processing of personal data in connection with the virus.
United Kingdom
The Data protection authority (the ICO) issued guidelines here. The ICO mainly focused on the processing of personal data in the employment context, i.e the security measures which have to be implemented during homeworking, collection and sharing of the employees' health data.
Other sources
The European Union Agency for fundamental rights ('FRA') issued a report on the fundamental rights implications during the Corona pandemic, it includes a short analysis on the data processing by employers and by the media.
