Privacy & Cybersecurity Law Blog

On March 31, 2020, the Belgian Data Protection Authority (the “Belgian DPA”) published a short statement on its website (the “Statement”) regarding health-related apps. The Belgian DPA indicated that the Statement is in response to numerous questions regarding the use of personal data in the context of the COVID-19 pandemic.

The Belgian DPA noted that several health-related apps fail to comply with applicable data protection requirements (while acknowledging that public health and the fight against COVID-19 are critically important). The Belgian DPA underlined several points:

• Anonymity. To the extent anonymous data is sufficient for the purpose(s) of the app, personal data (including identification data) should not be collected. Similarly, apps should not collect data that, in combination with other information, can indirectly identify a patient. Truly anonymous data does not allow for re-identification.
• Patient-Doctor Relationship. It should be clear if the app is used in the context of an existing patient-doctor relationship. (Ideally, the healthcare provider should invite the patient to use the app.) In this context, personal data should only be collected to ensure the continuity and quality of care for the patient.
• Other Scenarios. If the two scenarios above are inapplicable—in other words, the app does not use anonymous data or operates outside the patient-doctor relationship—an app processing personal data must provide, on the very first screen accessed by users and prior to any data collection, information about how data will be processed (including the data controller’s identity, the processing purposes, whether cookies are used, etc.). Personal data cannot be collected before a user may use the app. In addition, the app can use personal data only to achieve the processing purpose(s) communicated to users, and only under the direction of the identified data controller. When users stops using the app, they should be provided the option to have their personal data transmitted to another healthcare provider. If a user refuses, that individual’s personal data should be deleted and should no longer be used.