March 30, 2020

The EDPB acknowledges that taking measures to contain and mitigate COVID-19 can involve the processing of different types of personal data.

The EDPB says that data protection rules (such as the GDPR) do not hinder measures taken in the fight against the coronavirus pandemic. The fight against communicable diseases is a valuable goal shared by all nations and therefore, should be supported in the best possible way.

However, the EDPB underlines that, even in these exceptional times, the data controller and processor must ensure the protection of the personal data of the data subjects. Therefore, a number of considerations should be taken into account to guarantee the lawful processing of personal data and in all cases it should be recalled that any measure taken in this context must respect the general principles of law and must not be irreversible. Emergency is a legal condition which may legitimise restrictions of freedoms provided these restrictions are proportionate and limited to the emergency period.

The statement addresses the lawfulness of processing in various contexts, including in the employment context. It reminds readers of the core principles relating to the process of personal data and encourages transparency with data subjects, as well as the adoption of adequate security measures and confidentiality policies ensuring that personal data are not disclosed to unauthorised parties.

The statement also covers the use of mobile location data and what employers can and cannot do with their employee’s personal data. To read the statement in full, click here.