Privacy & Information Security Law Blog

On April 7, 2020, the European Data Protection Board (the “EDPB”) announced that it had assigned mandates to its expert subgroups to develop guidance on several aspects of data processing amidst the COVID-19 crisis.

In particular, the EDPB assigned a mandate to the technology expert subgroup to focus on geolocation and other tracking tools. The EDPB indicated that the guidance will focus on several issues, including (1) the use of aggregated and anonymized location data; (2) applying data protection principles (such as lawfulness, necessity, proportionality, accuracy and data minimization) to available tools for tracking individuals and their location; (3) a general legal analysis of apps used to contain the spread of COVID-19; (4) the safeguards necessary to ensure compliance with data protection principles; (5) recommendations regarding contact tracing applications; and (6) limiting the measures taken in response to COVID-19 to a specific timeframe.

In addition, the EDPB assigned a mandate to the compliance, e-government and health expert subgroup to focus on processing health data for research purposes in the context of COVID-19. The guidance will focus on (1) processing health-related data to advance scientific and medical research; (2) applying data protection principles (such as lawfulness, proportionality, transparency, compliance with data subject rights requests, and storage limitation) to the processing of health-related data; (3) re-use of medical research data in connection with COVID-19 data sharing; and (4) information dissemination and data subjects rights in an emergency situation.