Processing personal data in connection with COVID-19
Statement by the Executive Committee of the Global Privacy Assembly declaring that the processing of personal data in connection with fighting the spread of COVID-19 requires a coordinated response at both national and global levels
1 The Executive Committee of the Global Privacy Assembly (a supra national entity representing accredited data protection and privacy authorities across the world) has called for the sharing of health data to help combat the COVID-19 virus. This is not surprising for two reasons : first, the GPA is constituted by public authorities in different countries who might be expected to be sensitive to their governments’ public health initiatives; and, second, the GDPR (EU) while protecting individuals in Europe from the processing of personal health data which is normally prohibited, provides exceptions to this protection where the processing or sharing of data is in the public interest or where it is necessary to protect against threats to health, or for preventive medicine or for the provision of healthcare. It is thus anticipated that data protection legislation, worldwide, will present no bar to the processing and sharing of personal health data of individuals.
2 But what of those jurisdictions where there are also different laws protecting privacy or at least private information? In Europe, Article 8(1) of the Convention provides for a right to “private … life” and this is, at present, UK law as well. In England and Wales, the damages award in Campbell v MGN was, amongst other things, for disclosure of the model’s treatment for drug addiction which is, of course, a health issue and this indicates that details of treatment for COVID-19 would be similarly protected. In the US, privacy actions relating to the disclosure of such health issues as involuntary sterilisation and sex change surgery failed, but because of “newsworthiness” defences, not because such issues were not private. The South African courts have routinely protected health information as private, but a defence of public interest is always available. The conclusion is that these non-data protection rules will not operate to prevent the processing and sharing of otherwise private, COVID-19 health-related data because of the pressing public health imperative in using such information to defeat the virus.
- John Campbell QC