The European Data Protection Supervisor has backed the European Commission's plans to collect anonymised data from telecom operators to help track developments in the coronavirus crisis. The EDPS said the plans do not violate EU data protection laws. The EDPB earlier expressed a similar stance, saying national legislation on the matter is also possible.
Thierry Breton, the Commissioner for the internal market and former Orange CEO, held a conference call with major European operators and the GSMA this week to discuss the plans. He said the metadata from telecom networks would help EU officials assess whether confinement measures in many countries were helping to stem the spread of the disease, Euractiv reports.
Wojciech Wiewiorowski, the EU's Data Protection Supervisor, said in a letter to Commission officials that the plans as presented would not violate EU privacy laws. This is based on the assumption that the data is effectively anonymised, meaning it no longer has a personal character. The supervisor also underlined the need for security provisions to extend to any third parties handling the data and welcomed the fact that the data would be deleted as soon the emergency is over. He also called for transparency to the public on how the data would be used.
The European Data Protection Board, which unites the EU's national privacy regulators, issued a similar assessment earlier, after several countries said they would be using telecom data to track the virus. The EDPB noted the EU's General Data Protection Regulation allows public health authorities to process personal data in the context of epidemics, without the need to obtain the consent of the data subject, in order to protect the public health or vital public interests.
ePrivacy laws
Telecom networks face additional requirements on data processing under the EU's ePrivacy directive, which covers the relevant network location data. This states that the location data can only be used by the operator when they are made anonymous, or with the consent of the individuals. The public authorities should first aim for the processing of location data in an anonymous way, and if this is not possible, the ePrivay directive allows the member states to introduce legislative measures in the name of national and public security, the EDPB said.
Such emergency legislation is possible only if it constitutes "a necessary, appropriate and proportionate measure within a democratic society", the regulators noted. If such measures are introduced, the government is obliged to put in place adequate safeguards, such as granting individuals the right to judicial remedy if they feel their data has been misused.
Matts Branryd, CEO of the GSMA, said the association and its members were committed to working with European authorities "to use data in the fight against COVID-19 crisis, while complying with European privacy standards".
