Privacy & Information Security Law Blog

The Spanish Data Protection Authority (the “AEPD”) recently published a report on data processing activities carried out by data controllers in the private and public sectors as a result of the spread of the COVID-19 virus (the “Report”).

The Report first notes that the EU General Data Protection Regulation (“GDPR”) contains necessary safeguards and rules with respect to personal data processing in a general health emergency. Accordingly, data protection considerations should not be used to hinder or limit measures authorities adopt in their fight against the pandemic.

The Report then turns to legal bases for processing personal data in the COVID-19 context. According to the Report, businesses and public administrations may process personal data without seeking the individual’s consent based on one of the following legal bases:

• Compliance with a legal obligation: Article 6(1)(c) of the GDPR provides a legal basis for processing personal data when the processing is necessary for the controller to comply with a legal obligation under EU or Member State law. To this end, the Report underlines that employers are subject to Spanish regulations related to preventing occupational risks. In particular, pursuant to Article 14 of Spanish Law 31/1995 of November 8, 1995 on the Prevention of Occupational Risks, employers have a duty to protect employees against occupational risks, and to guarantee the safety and health of all their employees in work-related aspects. Employers thus may rely on Article 6(1)(c) when processing their employees’ personal data to comply with such obligations. The Report also notes that employees themselves have obligations related to risk prevention: employees must ensure their own safety and health at work, as well as the safety and health of individuals who may be affected by the employees’ acts and omissions at work. In practice, this means that employees must inform their employer if the employees were potentially exposed to the virus—to safeguard not only their own health, but also that of other employees.
• Protecting the vital interests of the data subject or other individuals: Article 6(1)(d) of the GDPR provides a legal basis where data processing is necessary to protect the vital interests of the individual to whom the personal data relates (i.e., the data subject) or other individuals. The Report stresses that these other individuals do not need to be identified or identifiable. According to the Report, this legal basis could justify processing personal data in order to protect all potentially infected individuals.
• Performing a task carried out in the public interest: Article 6(1)(e) of the GDPR may also provide a legal basis where data processing is necessary to perform a task carried out in the public interest or in the course of exercising official authority vested in the data controller.

Additionally, to the extent health-related personal data is at issue, businesses and public administrations must ensure that such data is processed in accordance with one of the conditions laid down in Article 9(2) of the GDPR, such as:

• Necessity to carry out obligations and exercise specific rights of the employer or the employee in the field of employment and social security and social protection law (Article 9(2)(b) of the GDPR): employers may rely on this condition to process employees’ health-related personal data to the extent necessary to comply their obligations with respect to preventing occupational risks.
• Reasons of substantial public interest or public interest in the area of public health (Article 9(2)(g) and Article 9(2)(i) respectively): businesses and public administrations may rely on this provision to the extent the data processing is performed pursuant to EU or Member State law establishing adequate and specific measures to protect the rights and liberties of individuals.
• Necessity to carry out a medical diagnosis (Article 9(2)(h) of the GDPR): health-related personal data may be processed on this basis to the extent that the data processing is necessary to provide a medical diagnosis, to assess an employee’s ability to work, to provide any other type of medical care, or to manage health-related systems and services on the basis of EU or Member State law or pursuant to a contract with a health professional.
• Protecting the vital interests of the data subject or of other individuals, when the data subject is not capable of giving consent (Article 9(2)(c) of the GDPR): this basis is available only when the data subject is not physically or legally capable of giving consent.

In all cases, data controllers must follow national authorities’ instructions. The Report emphasizes that existing law—including the Spanish Organic Law 3/1986 of April 14 1986 on Special Measures in Public Health Matters (as modified by Spanish Royal Decree-Law 6/2020, of March 10, 2020) or Spanish General Public Health Law 33/2011 of October 4, 2011—provides necessary legal measures to deal with health risk situations. Ultimately, the Report stresses, it is up to the relevant Spanish health authorities to make the necessary decisions. Data controllers should follow the health authorities’ instructions, including if such instructions implicate processing health-related personal data.

The Report concludes that personal data processing should be consistent with all basic data protection principles, including data minimization and purpose limitation principles. According to these principles, the personal data collected and further processed must be strictly limited to what is necessary for the intended purpose, and must not be processed for other purposes. “Such processing of data concerning health for reasons of public interest,” GDPR Recital 54 states, “should not result in personal data being processed for other purposes by third parties such as employers or insurance and banking companies.”