COVID-19. GDPR IMPLICATIONS

Dr. Nicole Cannataci [Associate FSGM.Partners] 

Article 8 of the European Convention on Human Rights dictates the fundamental human right of respect for private and family life i.e. the right to privacy. Given the technological and medical advances in our global society, many have seen the increase in exercise of this human right, as the greater the steps in technology, unfortunately the greater the potential breaches to privacy.
 
Article 8 states that “everyone has the right to respect for his private and family life, his home and his correspondence”. This being a fundamental human right, it carries immense weight and is indeed one of the first provisions of law resorted to, worldwide, in cases of breaches of privacy. Furthermore, with the introduction of the General Data Protection Regulation in May of 2018, a greater emphasis has been made onto the privacy and data protection rights of the individual, resulting in individuals or data subjects in the European Union and their rights being protected from a wide variety of potential data attacks. But, despite the great importance of the existence of such rights, including fundamental human rights, they are not absolute.
 
The world is currently amidst the COVID-19 pandemic. With numerous governments around the globe implementing safety measures and procedures to counteract such a pandemic, such as the urge from governments to disclose potential patients of the virus, one may state that individuals’ personal data is at stake. And they would be right.
 
The crux of the matter is this: when one is aware of an individual who has (unfortunately) contracted COVID-19, are you bound by law to respect that individual’s right to privacy and keep silent? Or are you, on the other hand, bound by law to disclose such information to the relevant authorities?
 
As stated above, human rights are not absolute and here’s why. The same Article 8 of the European Convention on Human Rights goes on to state that “there shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”. This means that whenever the interests of national security, public safety, the protection of health, and the protection of the rights and freedoms of others supersede the right to privacy of the infected individual, as is the current case in Malta with COVID-19, where the prevention of the spread of the pandemic is of higher importance than the right of privacy of the infected individual, then yes, the law allows for the disclosure of such patient information.
 
The General Data Protection Regulation further supports this argument, as Article 9 of the same prohibits the processing of special categories of an individual’s personal data, including health data. Yet, once again, this right is not absolute as Article 9 goes on to list the exceptions of such right, more specifically Article 9(2)(g),(h) and (i), which state that the processing, which includes the disclosure, of such health data pertaining to COVID-19 patients, is not prohibited where:
 
“processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”;
 
“processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3”;
 
“processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy”;
 
Therefore, even the General Data Protection Regulation caters for such instances such as the current one present in Malta due to COVID-19. Normally, the individual or data subject cannot have its health data disclosed by other individuals or entities, yet in exceptional cases such as the present one due to COVID-19, “for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health”, the disclosure of such health data pertaining to affected individuals to the relevant authorities once again supersedes the right of the COVID patient to privacy. 

Please direct all your queries to [email protected] 

This Article is made available by FSGM.Partners for educational purposes. It provides general information and a general understanding of the law, but does not provide specific legal advice. By using this site, commenting on posts, or sending inquiries through the site or contact email, you confirm that there is no attorney-client relationship between you and the Blog/Web Site publisher. The Blog/Web Site should not be used as a substitute for competent legal advice from your legal adviser.