This article was published in 2020. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
Introduction
Because of the COVID-19 pandemic, scientific research is currently under way in the fight against SARS-CoV-2, better known as the coronavirus, in order to produce research results as quickly as possible. At the same time, this raises legal questions about the use of health data for these purposes. The European Data Protection Board (EDPB) has published Guidelines on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak.
Below you can read a summary of the published Guidelines.
Data protection rules, such as the General Data Protection Regulation (GDPR), do not hinder measures taken in the fight against the COVID-19 pandemic. On the contrary, the GDPR provides special rules for the processing of health data for the purpose of scientific research. Those rules also apply in the context of the COVID-19 pandemic.
Legal bases required
The processing of health data for the purpose of scientific research must be covered by one of the legal bases in Article 6(1) or Article 9 GDPR. The rules must be interpreted in the light of the principles set out in Article 5 GDPR (principles relating to the processing of personal data).
Responsibilities of the data controller
The data controller, in cooperation and coordination with the data processor, must ensure data integrity and confidentiality (Article 5(1)(f)), security of processing (Article 32(1)) and safeguards relating to processing for scientific research (Article 89(1) GDPR). The data controller is also responsible for a Data Protection Impact Assessment (DPIA).
Maximum data storage periods
Storage periods (timelines) must be set and must be proportionate. In order to define such storage periods, criteria such as the length and the purpose of the research should be taken into account. National provisions may also lay down rules on storage periods and must therefore be considered.
Contact us
Data protection rules do not hinder measures taken in the fight against the COVID-19 pandemic. The data controller must take into account 1) the legal basis for the processing, and 2) the data protection principles for processing health data for the purpose of scientific research in the context of the COVID-19 outbreak.
Do you need support with implementing the complex privacy rules on the processing of health data for the purpose mentioned above? Or do you need support with a Data Protection Impact Assessment? Feel free to contact us.