16 March 2020

On 16.03.2020, Chair of the European Data Protection Board ("EDPB") made a statement regarding the precautions taken by governments, public and private organizations across the Europe to prevent the Covid-19 epidemic and the necessary measures about the processing of the different types of personal data during these precautions.

In the statement made by Andrea Jelinek, Chair of the EDPB, it was stated that the rules of protection of personal data, such as the European General Data Protection Regulation ("GDPR"), would not prevent measures to be taken against the Coronavirus outbreak, but even in such exceptional times, the data controller is responsible for ensuring the protection of personal data. Therefore, in order to guarantee the lawful processing of personal data, several factors must be taken into account.

It is stated in the related statement that the GDPR had a wide perspective, such as the provisions (Articles 6 and 9) that may allow data controller employers and authorized public health authorities to process personal data in the context of the Coronavirus epidemic without the consent of the data subject.

On the other hand, in the case of electronic communication data processing (such as mobile location data), based on ePrivacy Directive; the principle of enabling the operator to process the location data, only by anonymizing or with the consent of the individuals. Therefore, public authorities should primarily aim to process location data anonymously. This would allow reports to be generated about the concentration of mobile devices in a particular location.

When it is not possible to process only anonymized data, Article 15 of the ePrivacy Directive allows the Member States to take the necessary legal measures based on national security and public security reasons. In this case, public health protection can also be evaluated within the scope of national and/or public safety exemption. On the other hand, it was also emphasized that the emergency legislation should be applied only in necessary cases in a suitable and measured manner in accordance with the democratic society requirements. If relevant measures are taken based on national and/or public security, Member States are obliged to provide adequate safeguards, such as permitting individuals' right to a judicial remedy.

You can find the text of the statement  here.

Should you have any queries and/or remarks, please do not hesitate to contact us. 

Kind regards,

Zumbul Attorneys-at-Law