Jelinek: data protection doesn’t hinder covid-19 fight

Andrea Jelinek, who heads the EDPB and Austria’s data watchdog, tells GDR how the covid-19 crisis has affected the organisation and data protection across Europe.  

We have been busier than usual during the past five weeks. More work has been added to our schedule as an immediate result of the covid-19 outbreak.

We were one of the first institutions to speak out on the data protection implications for data that is being gathered and shared in the fight against covid-19. We published a statement immediately followed by a more in-depth statement a few days later. We were consulted last week by the European Commission on draft guidance on apps supporting the fight against the covid-19 pandemic. 

In addition, we have decided on our own initiative to develop guidance on different aspects of data use in the context of covid-19 including geolocation and tracing tools and the processing of health data for scientific purposes. I hope we can adopt the guidance regarding health data for scientific purposes at the plenary tomorrow [16 April]. We really did speed up because we already had a plenary this week and we will have another plenary tomorrow.

In addition, we have increased the frequency of our meetings. Next week we will have the next plenary where we will discuss guidance regarding geolocation and tracing tools and hopefully adopt it next week – I can’t promise that it will be next week but it looks like it. 

The covid-19 pandemic doesn’t hinder our work, we are working remotely quite successfully.

We haven’t stopped ordinary work. For example, we’re working on eight consistency opinions that are being discussed at the moment at subgroup levels. These are subject to strict deadlines – but as far as I see we will have no problem adopting them within the deadline. The absence of physical plenary meetings in the next month, maybe the next two months, will probably lead to more written procedures for the adoption of certain documents, but we will see. 

Other than apps, the idea of immunity passports have come up time and again as a potential way out of the current crisis. Is this something you’ve been working on at all? 

Generally speaking, data protection law doesn’t stand in the way of developing innovative and efficient tools to fight this crisis, provided that fundamental principles including data minimisation are complied with. This also applies to immunity passports. We haven’t yet addressed the specific issue of immunity passports so I can’t speak on this until more detailed analysis has been carried out and the EDPB is informed of the details of the envisaged processing activity. 

And is there anything you’re being consulted on or working on at the moment?

I think it is really important that DPAs at the national level are involved in the development of apps. All of these apps have to have a data protection impact assessment, and it will be necessary that the measures taken are proportionate, necessary, and appropriate. 

It’s an extraordinary situation and extraordinary situations sometimes need extraordinary measures – but we need to have a close look at these extraordinary measures, and they have to have an end. It’s really important. 

And data protection doesn’t hinder the fight against the covid-19 pandemic. It’s really important to state this. Data protection doesn’t hinder the fight. If we work closely together we will succeed, and also democracy is going to succeed. 

There’s a lot of talk about exit strategies. How do we go about getting things back to normal?

Any collection and processing of data aimed at containing the spread of the virus has to stop once the crisis is over. An emergency is a legal condition which may legitimise restrictions of freedoms, provided these restrictions are proportionate and limited to the emergency period; that’s a quote from the EDPB statement from 19 March and I think this is a core requirement for any initiative involving personal data in this context. 

The Dutch DPA recently issued guidance and a decision on legitimate interests. It seems to depart from lot of existing experiences. Do you have a position on this?

I’m sure you’ve seen our two-year working plan: the EDPB will start work on guidance on legitimate interest as indicated in this plan, and we will most likely organise a stakeholder event on the topic – but the exact timing of the event will depend on the timing of the coronavirus pandemic. 

I’m interested to know if the EDPB is working beyond Europe on this – perhaps consulting the US CDC or the WHO?

At the moment we are trying to spread our work out into the world, but it’s not very easy at the moment. At the moment we’re working on the European level, and if we’re going to be asked we’re going to work on a global level. But the commission is just revising the already existing adequacy decisions and is negotiating new adequacy decisions, and if we’re going to be asked to provide our input on that we’re ready to do that. 

Do you believe responses during the pandemic might affect adequacy decisions?

I think you’ll have to ask the negotiators. 

What measures are you reviewing in Austria?

The government hasn’t introduced an app or anything like that. The Red Cross introduced an app – as you know the Red Cross is a private institution. But one never knows what’s going to happen. It will depend on what happens next week. I hope for the best. 

[GDR has learned that following today’s plenary session, the EDPB feels further work is required on guidelines for both geolocation and tracing data and the use of health data for research purposes. A source says both guidelines will “hopefully” be adopted on 21 April.]