Processing personal data: COVID-19 guidance

The Chair of the European Data Protection Board (EDPB) has issued EU level guidance on processing personal data in the context of the COVID-19 outbreak, assuring processors that the GDPR provides legal grounds to enable employers and competent public health authorities to process personal data in the context of epidemics without the need to obtain the consent of data subjects.

The EDPB cites reasons of public interest in the area of public health, protection of vital interests, and compliance with other legal obligations as appropriate legal grounds to rely on to ensure personal data is processed lawfully.

The guidance also covers the use of mobile location data my Member State governments and the ways in which an employer can process its employees’ personal data in the context of the COVID-19 outbreak.  However, the EDPB emphasises that “even in these exceptional times, the data controller must ensure the protection of the personal data of the data subjects".  For more information and to read the guidance, please click here.