German watchdog hits back at coronavirus draft law

Germany’s federal data regulator has warned against proposed powers to combat the spread of covid-19 – saying the amendments to the country’s emergency health law curtail fundamental rights. 

Federal data commissioner Ulrich Kelber released an opinion on Monday condemning a series of proposed amendments to the country’s emergency health law, which contain measures to increase the collection and processing of personal health data. Kelber said the new measures do not do enough to protect personal data.

“The draft contains major encroachments on fundamental rights of citizens. Given the threat we all face and the hurry to change the law, the proposed measures cannot be adequately examined for their compatibility with [German law] and European law, in particular the GDPR,” Kelber said. 

Kelber said that when examining the proposed measures, the fundamental right to data protection must be observed and that such examinations have not been achieved in the current draft of the law.

Bijan Moini of German civil rights group Gesellschaft für Freiheitsrecht told GDR that the powers the amendments grant are worrying, highlighting that it “grants the ministry of health vast authorities to ignore legal provisions of various health laws”.

One such provision gives the ministry of health the power to issue orders to identify people from high-risk areas entering the country and force them to undergo medical examinations.

Kelber said that the amendments fail to stipulate when the data collected on travellers will be deleted, and proposed adding a rule that requires health data to be permanently deleted once it is no longer being used or when the pandemic is over. The draft law also contained provisions that allowed location tracking through mobile phones, but were subsequently removed. 

Flemming Moos, a partner at Osborne Clarke in Hamburg, said that when two or more fundamental rights conflict, such as health and data privacy, lawmakers must weigh up the measures in such a way that all affected rights are taken into account.

“As things currently stand in Germany, the belief is that such tracking would have been unproportionate because the [currently] adopted measures are considered sufficient to overcome the pandemic,” he said. 

But Moos said he believes the new measures are a good compromise. “On the one hand it allows necessary measures to prevent and control the further spread of coronavirus; on the other hand, it balances the new powers with requirements stemming from data privacy.” 

Other observers questioned the necessity of the amendments at all.

Philip Kempermann, a partner at Heuking Kühn Lüer Wojtek in Düsseldorf, said EU law already has measures in place to allow protected sharing of data in special circumstances. “The GDPR offers a wide range of legal grounds for using personal data, even special categories of personal data for public interests already, So it is questionable whether there actually was the need for these changes,” he said.