Home
Search

Footnote & Bibliography: COVID-19 vs the General Data Protection Regulation

Written by Brittney Tessier |

In times of national emergency, governments make difficult decisions to suspend certain rights in order to advance national security protocols for the benefit of the greater good. In the European Union (EU), threats to public health are considered matters of national security. The COVID-19 pandemic led some Member States to declare a state of emergency in order to control the spread of the virus.[1] They were met with significant difficulties trying to control the spread throughout their communities. While businesses took a manual approach to contact tracing of their employees and patrons accessing their services, national public health authorities developed nation-wide contact tracing models through the collection of data via smartphone applications (apps). In the wake of the virus, guidance from the European Data Protection Board (EDPB) was published to support Member States as they navigated the troubling waters of processing personal data via contact tracing while upholding the fundamental rights and freedoms of their citizens.[2] This commentary aims to demonstrate how secondary EU legislation, including the General Data Protection Regulation (GDPR), the Health Threats Decision, as well as the ePrivacy Directive[3], works to uphold the fundamental rights and freedoms of EU citizens with regard to personal data and privacy guaranteed by the Treaty for the Functioning of the European Union (TFEU), the European Convention on Human Rights (ECHR) and the Charter of Fundamental Rights of the European Union (CFREU) during the COVID-19 pandemic.

Public health crises and national security

The recognition of public health crises as matters of national security first appeared in the 2013 Health Threats Decision.[4] This decision was adopted in the aftermath of the H1N1 pandemic of 2009 as a means of promoting ‘cooperation and coordination between member states in the field of serious health threats’.[5] It requires that Member States share public health data with one another to track cross-border threats. This decision ‘open[ed] the door to bring communicable disease tools of contact tracing into the realm of security’.[6] While the securitization of public health could lead to breaches of fundamental rights in national health emergencies, the EDPB emphasized the flexibility provided by the GDPR[7], stating that its ‘data protection rules do not hinder measures taken in the fight against the coronavirus pandemic’ and that ‘even in these exceptional times, the data controller and processor must ensure the protection of the personal data of the data subjects’.[8] In saying this, the EDPB maintains the importance of upholding fundamental rights, even in a national public health crisis.

The GDPR and the right to privacy and protection of personal data

Protection of personal data is guaranteed by article 16(1) of the TFEU and by article 8(1) of the CFREU. Article 8 of the ECHR guarantees to right to privacy. Though article 8 ECHR does not outrightly state the protection of personal data, the European Court of Human Rights has interpreted this article in support of its inclusion, which includes protection of data pertaining to an individual’s health.[9] In 1995, the EU recognized the need to implement legislation in order to protect the right to privacy due to the creation of the Internet and the technological advancements that were on the rise at this time.[10] As a result, the European Data Protection Directive[11] was passed and ‘establish[ed] minimum data privacy and security standards, upon which each member state based its own implementing law’.[12] These minimum standards set by the directive were not enough to protect the rights of individuals with regard to privacy and data processing. The need for an updated data protection framework that would guarantee the protection of EU citizens from unlawful interference in their personal lives was apparent. Out of these discussions came the GDPR.

The scope of the GDPR applies to the collection and processing of personal data of individuals in the EU, even if the processing of the data takes place outside of the EU.[13] It defines personal data as being

any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.[14]

Article 5 of the GDPR outlines the protection and accountability principles that must be followed when processing personal data. Further to this, article 6(1) provides the circumstances in which processing of personal data is considered lawful. Subsection (d) indicates that processing of personal data shall be considered lawful if the ‘processing is necessary in order to protect the vital interests of the data subject or of any other natural person’[15] and subsection (e) considers it lawful if the ‘processing is necessary for the performance of a task carried out in the public interest’.[16] And finally, article 9(1) of the GDPR holds that the processing of personal data related to several factors, including health-related data, is strictly prohibited; however, such data, whether related to health or another listed factor, may be processed if the data subject provides explicit consent[17] or if the ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health’.[18] Based on these requirements, national public authorities have a lawful basis for processing data related to the health of a data subject using contact tracing apps, to monitor the spread of the COVID-19 virus and protect the public from infection, and can do so because the processing of such data ‘is necessary for reasons of public interest in the area of public health’.[19]

What’s different about location (proximity) data?

While the processing of health-related data is lawful under the current circumstances, the EDPB in its guidance on data processing through contact tracing apps has encouraged national public health authorities and their data controllers to do so in a way that maintains respect for the privacy of data subjects. In their guidance on contact tracing apps released on 19 March 2020, the EDPB indicated that where data is processed ‘for reasons of substantial public interest in the area of public health’, explicit consent of the individual is not required[20]; however, where the collected data includes location data, such data can only be used if it is ‘made anonymous or with the consent of individuals’.[21] The ePrivacy Directive makes matters dealing with telecommunication data slightly more complicated. It was developed to work alongside Directive 95/46/EC, now the GDPR, and deals specifically with the ‘processing of personal data in the electronic communication sector’.[22] Article 15 of the ePrivacy Directive provides that member states can introduce national legislative measures that restrict data protection rights guaranteed by the directive in the name of public security, as long as these measures are proportionately democratic.[23] These measures must not derogate from the CFREU and the ECHR, and they are subject to judicial review by the EU Court of Justice and the European Court of Human Rights.[24] While Member States have access to safeguards under the ePrivacy Directive, it is challenging enough for governments to mobilize the nation in an effort to control the spread of an infectious disease; the additional effort required to consider all aspects of data protection while drafting emergency legislation is not likely to be at the top of their list.[25] As a result, we can see that many Member States have opted to follow the rules laid out in the GDPR and have adopted contact tracing apps that request the consent of data subjects for processing of their location data.

Conclusion

It has become apparent during the COVID-19 virus outbreak worldwide that rights to privacy and protection of personal data are not absolute, and the need to protect individuals’ right to life and security is of a greater importance. While individuals may wish to maintain a level of privacy from government interference in their personal lives, a slight intrusion via contact tracing is a small price to pay for the benefit of public health and national security. The GDPR was designed to be flexible so that Member States would be able to process personal data on a lawful basis, while also guaranteeing the protection of fundamental rights and freedoms of EU citizens.[26] The GDPR also provides appropriate remedies accessible to individuals who believe that their personal data is being processed for unlawful reasons. EU citizens are not left at the mercy of national authorities when it comes to their personal data. While the contact tracing apps developed during the COVID-19 pandemic process personal data related to the individual’s location and proximity to infected individuals, it is a means adopted by the government to protect its citizens, not to keep tabs on them. Regardless, the rights of EU citizens remain thoroughly protected by the General Data Protection Regulation.

Author Bio

Brittney Tessier is currently studying at Queen’s University Belfast in the LL.B Senior Status program. Her areas of interest include public law, human rights and judicial review.

Bibliography

Primary Sources
  • C-311/18 Data Protection Commissioner v Facebook Ireland, Maximilian Schrems [2020] ECR II-559
  • Council Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31
  • Council Directive 2002/58/EC of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) [2002] OJ L201/37
  • Council Decision 1082/2013/EU of 22 October 2013 on serious cross-border threats to health and repealing Decision No 2119/98/EC [2013] OJ L293/1
  • Council Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1
  • L.H. v Latvia, no. 52019/07 (ECtHR, 29 April 2014)
Secondary Sources

Footnotes

  • [1] Krisztina Binder et al., ‘States of emergency in response to the coronavirus crisis: Situation in certain Member states’ (European Parliament, 4 June 2020) <https://www.europarl.europa.eu/RegData/etudes/BRIE/2020/649408/EPRS_BRI(2020)649408_EN.pdf> (accessed 13 December 2020).
  • [2] Andrea Jelinek, ‘Statement on the processing of personal data in the context of the COVID-19 outbreak’, (European Data Protection Board, 19 March 2020) https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_statement_2020_processingpersonaldataandcovid-19_en.pdf (accessed 19 November 2020).
  • [3] Council Directive 2002/58/EC of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) [2002] OJ L201/37 (ePrivacy Directive).
  • [4] Council Decision 1082/2013/EU of 22 October 2013 on serious cross-border threats to health and repealing Decision No 2119/98/EC [2013] OJ L293/1.
  • [5] Hannah van Kolfschooten and Anniek de Ruijter, “COVID-19 and privacy in the European Union: A legal perspective on contact tracing,” [2020] 41(3) Contemporary Security Policy 478, 481.
  • [6] ibid.
  • [7] Council Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1 (General Data Protection Regulation).
  • [8] Jelinek (n 2).
  • [9] See L.H. v Latvia, no. 52019/07 (ECtHR, 29 April 2014).
  • [10] Ben Wolford, ‘What is the GDPR, the EU’s new data protection law?’, (Proton Technologies AG, 2020) <https://gdpr.eu/what-is-gdpr/> (accessed 25 November 2020).
  • [11] Council Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31.
  • [12] Wolford (n 10).
  • [13] General Data Protection Regulation, art 3(1).
  • [14] ibid, art 4(1).
  • [15] ibid, art 6(1)(d)
  • [16] ibid, art 6(1)(e).
  • [17] General Data Protection Regulation, art 9(2)(a).
  • [18] ibid, art 9(2)(i).
  • [19] ibid.
  • [20] Jelinek (n 2).
  • [21] ibid.
  • [22] ePrivacy Directive, art 1(1).
  • [23] ibid, art 15(1).
  • [24] ibid.
  • [25] Dr. Martin Braun et al., “COVID-19 : European Data Protection in Times of Pandemic” (WilmerHale, 24 March 2020) <https://www.wilmerhale.com/en/insights/client-alerts/20200324-european-data-protection-in-times-of-pandemic> (accessed 17 November 2020).
  • [26] ‘Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak’ (EDPB, 21 April 2020) <https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_20200420_contact_tracing_covid_with_annex_en.pdf> (accessed 17 November 2020).