This article was published in 2020. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
GGD Zaanstreek-Waterland has lost 132 coronavirus tests. This was reported by the website Skipr. According to the sources, it is still unclear how this could have happened. The GGD (Dutch regional public health service) states that it is investigating the matter further.
Statement by GGD Zaanstreek-Waterland
GGD Zaanstreek-Waterland has lost 132 coronavirus tests. The GGD in question reports this on its own website: ”
GGD Zaanstreek-Waterland has unfortunately discovered that the test tubes of people who were tested in Purmerend on Thursday morning 3 September have been lost. To date they have not been found and the cause is still unknown. A very unfortunate matter that we are getting to the bottom of! The test tubes do not contain any personal data.
Today we are trying to contact all the people concerned to inform them, to offer our sincere apologies and to offer them a new test. The first people can already be tested today. Those affected will of course be given priority for the test and the result. The GGD is deploying extra staff for this. We deeply regret this incident and are doing everything we can to reach the people concerned as quickly as possible.
People who are concerned about their test result can call 075-651 83 88. This number is available 7 days a week from 08.00 to 17.00.”
**Consequences for the data subjects **When taking and carrying out coronavirus tests, researchers use the saliva of the people being tested. Although the GGD states that the tubes do not contain personal data, saliva can contain genetic information about citizens. We call this special category personal data. This data can be read in laboratories, provided the right machines are available. The loss of these coronavirus tests is therefore a sensitive matter.
##What to do in the event of a loss of such data
Any organisation can be confronted with a loss of data, such as the missing tubes in this case. We recommend reporting it to the Dutch Data Protection Authority (AP). This is better than reporting it at a later stage following a complaint to the regulator. We also recommend informing the data subjects about the data breach and any measures taken as quickly as possible.
Help with data breaches
Is your organisation possibly dealing with data breaches? Feel free to contact us, so that we can support you practically and pragmatically in handling data breaches. This helps you avoid hefty fines and brings peace of mind to your organisation.