19 Mar DATA PROTECTION AND COVID-19
In the last few weeks, Governments, public and private organizations throughout Europe have been taking measures to contain and mitigate the spreading of the COVID-19. These measures consist of a number of actions that may involve the processing of different types of personal data.
On March 16, 2020, Andrea Jelinek, Chair of the European Data Protection Board (EDPB), said: “Data protection rules (such as GDPR) do not hinder measures taken in the fight against the coronavirus pandemic. However, I would like to underline that, even in these exceptional times, the data controller must ensure the protection of the personal data of the data subjects. Therefore, a number of considerations should be taken into account to guarantee the lawful processing of personal data.”
As pointed out by Andrea Jelinek, the GDPR is a broad legislation and also provides rules that apply to the processing of personal data in a context such as the one relating to COVID-19. For Andrea, the GDPR provides legal grounds to enable the employers and the competent public health authorities to process personal data in the context of epidemics, without the need to obtain the data subject’s consent. This applies for instance when the processing of personal data from employees is necessary for reasons of public interest in the field of public health, or in order to protect the data subject’s or a third party’s vital interests, or to comply with another legal obligation.
It seems that the processing of personal data resulting from the coronavirus outbreak may be covered by “Recital 46” of the GDPR. According to this recital, the processing of personal data is lawful when it is necessary to protect an essential interest to the life of the data subject or to any third party, including those related to humanitarian purposes, to the monitoring of epidemics and their spread or in humanitarian emergencies scenarios.
In Brazil, the measures adopted have not been different from those practiced in the European Union. Public authorities, organizations and companies have decided to follow certain standards to, on the one hand, help identify people with the virus and, on the other hand, reduce the proliferation of the coronavirus and protect their employees.
In this regard, Law No. 13.979/2020 was enacted and Ordinances No. 356/2020 and No. 188/2020 from the Ministry of Health were published, which declare the state of emergency due to human infection with the new coronavirus (2019-nCoV) and establish measures to cope with the public health emergency, such as the mandatory determination to carry out medical examinations and laboratory tests, as well as the need for immediate communication contacts of people who have been possibly infected by the coronavirus.
The Brazilian General Data Protection Law cannot halt data processing in situations like these. On the contrary, it must be construed accordingly with other rules from our legal system, in order to protect collective interests, the health and the well-being of the community.
First, it is worth noting that the Brazilian General Data Protection Law does not apply to the processing of personal data carried out solely for the purposes of public security or State security.
Besides, the Brazilian General Data Protection Law establishes that the processing of personal data and sensitive personal data may be carried out in order to comply with a legal obligation (in light of the abovementioned legislation) or in order to protect the data subject’s or third party’s life or physical safety.
Nevertheless, as pointed out in the statement by the EDPB president, this is not enough. Data controllers and operators must take additional measures (mainly security measures) to protect personal data and correlated rights.
Although there are additional measures to be adopted, it is comforting, at this moment and under this perspective, to know that both the GDPR and the LGPD provide grounds for the data processing of people who have the risk of being contaminated by the coronavirus and to comply with the measures taken by authorities, public organizations and private entities.
This article is intended exclusively to provide information and does not contain any opinion, recommendation or legal advice from KGV Advogados concerning the matters herein addressed. Copyrights are reserved to Kestener, Granja & Vieira Advogados.
No Comments