This article was published in 2020. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
Every week, tens of thousands of people get tested for the coronavirus at test centres. In recent weeks, more than 180,000 people were tested, and the week before that over 163,000. When carrying out coronavirus tests, laboratories process the personal data of the people being tested. What happens to my data after a coronavirus test? This is one of the questions we are hearing more and more often. In this article, we answer the question of what happens to your data after a coronavirus test. In doing so, we also refer to the privacy statement of GGD GHOR, the umbrella organisation of the Dutch regional public health services (GGDs).
The General Data Protection Regulation (GDPR) applies
Like GPs, dentists and other healthcare providers, the GGDs must comply with the GDPR. This means that they must properly secure personal data and that the right people have access to the right data for specified purposes. In principle, personal data may not be used for other purposes. This is also stated in the GDPR.
Laboratories may retain the DNA material collected during a coronavirus test for several weeks to months. This can be read in the privacy statement on the website of GGD GHOR. The personal data that must be provided for a test may be retained by the GGDs for a maximum of five years under the Public Health Act (Wet publieke gezondheid, Wpg). This is laid down in Article 29 of the Wpg.
Types of personal data processed
To carry out the coronavirus tests and communicate the results, the GGD processes various personal data, such as ordinary and special categories of personal data. These include, among other things, name, address, date of birth, gender and citizen service number (BSN). They also include the telephone number, email address, symptoms and the barcode of the test tube. In addition, the GGD processes the answer to the question of whether there has been direct contact with others, and the occupational group in which the person has worked. The GGDs retain these data for a maximum of five years.
Legal basis for processing the citizen service number
GGDs may only process the citizen service number (BSN) if there is a legal basis for doing so. This follows from Article 1 of the General Provisions Citizen Service Number Act (Wet algemene bepalingen burgerservicenummer, Wabb). The legal basis for the use of the BSN by the GGDs can be found in Article 24 of the Wpg.
(Un)clear arrangements between the parties involved
The privacy statement of GGD GHOR shows that the personal data processed may be exchanged between various parties. This is not prohibited in itself. In fact, the GDPR leaves room for organisations to exchange personal data internally or externally, provided there are sufficient safeguards. The exchange of sensitive data between several parties is best organised by agreeing contractual provisions with one another. Examples include the agreement between GGD GHOR and the executing parties and the purchasing conditions of GGD GHOR. The arrangements can be set out in a more specific document, namely separate data processing agreements between these parties. However, we see no provisions in the privacy statement about whether or not a data processing agreement exists. This raises the question of what arrangements have been made between the parties to protect the privacy of the data subjects. After all, these are privacy-sensitive personal data of people who come forward with health complaints.
How do you handle (special categories of) personal data?
What happens to my data if I let your organisation process it? How do you, as a company or organisation, handle privacy-sensitive (special categories of) personal data? Have you considered a data processing agreement, for example? Do you have clear arrangements with the parties that process personal data on your behalf? We recommend that you take the right measures in good time. This prevents data breaches and hefty fines.
Do you have any questions? Please feel free to contact us, so that we can help you in good time.