April 27, 2020

At the 22^nd plenary on 17 April 2020, the EDPB discussed:

• the state of play on the preparation of the guidelines on the processing of health data for research purposes in the context of the COVID-19 outbreak; and
• the state of play on the preparation of the guidelines on geolocation and other tracing tools in the context of the COVID-19 outbreak.

At the 23^rd plenary on 21 April 2020, the EDPB adopted both sets of guidelines. The EDPB said that neither set will be submitted for public consultation due to the urgency of the current situation and the necessity to have the guidelines readily available.

The EDPB says that the guidelines on the processing of health data for research purposes in the context of the COVID-19 outbreak aim to shed light on the most urgent legal questions concerning the use of health data, such as the legal basis of processing, further processing of health data for the purpose of scientific research, the implementation of adequate safeguards and the exercise of data subject rights.

The guidelines state that the GDPR contains several provisions for the processing of health data for the purpose of scientific research, which also apply in the context of the COVID-19 pandemic, in particular relating to consent and to national legislation. The GDPR foresees the possibility of processing certain special categories of personal data, such as health data, lawfully where it is necessary for scientific research purposes.

In addition, the guidelines address legal questions concerning international data transfers involving health data for research purposes related to the fight against COVID-19, in particular in the absence of an adequacy decision or other appropriate safeguards.

Andrea Jelinek, Chair of the EDPB, said: “… The GDPR does not stand in the way of scientific research, but enables the lawful processing of health data to support the purpose of finding a vaccine or treatment for COVID-19”.

As for the guidelines on geolocation and other tracing tools in the context of the COVID-19 outbreak, these aim to clarify the conditions and principles for the proportionate use of location data and contact tracing tools, for two specific purposes:

1. using location data to support the response to the pandemic by modelling the spread of the virus in order to assess the overall effectiveness of confinement measures; and
2. using contact tracing, which aims to notify individuals who may have been in close proximity to someone who is eventually confirmed as a carrier of the virus, in order to break the contamination chain as early as possible.

The guidelines emphasise that both the GDPR and the E-Privacy Directive (2002/58/EC) contain specific provisions allowing for the use of personal data to support public authorities and other agencies at both national and EU level in their efforts to monitor and contain the spread serious health threats such as COVID-19. The general principles of effectiveness, necessity, and proportionality must guide any measures adopted by Member States or EU institutions that involve the processing of personal data to fight COVID-19.

The EDPB says that it stands by and underlines the position expressed in its letter to the European Commission (14 April) that the use of contact tracing apps should be voluntary and should not rely on tracing individual movements, but rather on proximity information regarding users.

In addition, the EDPB adopted a guide for contact tracing apps as an annex to the guidelines. The purpose of this guide, which is non-exhaustive, is to provide general guidance to designers and implementers of contact tracing apps, underlining that any assessment must be carried out on a case-by-case basis. To read the EDPB’s press release in full and for a link to the guidelines, click here.