May 4, 2020

In reply to a letter from the United States Mission to the European Union, the EDPB looks into transfers of health data for research purposes to enable international cooperation for the development of a vaccine. The US Mission enquired into the possibility of relying on a derogation of Article 49 of the GDPR to enable international flows.

The EDPB tackled this topic in detail in its recently adopted Guidelines on the processing of health data for scientific research. In its letter, the EDPB reiterates that the GDPR allows for collaboration between EEA and non-EEA scientists in the search for vaccines and treatments against COVID-19, while simultaneously protecting fundamental data protection rights in the EEA.

The EDPB said that when data are transferred outside the EEA, solutions that guarantee the continuous protection of data subjects’ fundamental rights, such as adequacy decisions or appropriate safeguards (included in Article 46 GDPR), should be favoured.

The EDPB considers, however, that the fight against COVID-19 has been recognised by the EU and Member States as an important area of public interest. This may require urgent action in the field of scientific research, necessitating transfers of personal data to third countries or international organisations.

In the absence of an adequacy decision or appropriate safeguards, public authorities and private entities may also rely upon derogations included in Article 49 GDPR.

The EDPB also adopted a response to a request from MEPs on common guidance in the fight against coronavirus. The EDPB said that data protection laws already take into account data processing operations necessary to contribute to fighting an epidemic, therefore there is no reason to lift GDPR provisions, but to observe them. In addition, the EDPB refers to the guidelines on the issues of geolocation and other tracing tools, as well as the processing of health data for research purposes in the context of the COVID-19 outbreak.

The EDPB also replied to a letter from one MEP on the use of apps in the fight against coronavirus. The EDPB referred to its recently adopted Guidelines on the use of location data and contact tracing apps, which highlight that such schemes should be voluntary in nature, use the least amount of data possible, and should not trace individual movements, but rather use proximity information of users. To read the EDPB’s press release in full, click here.