Broad Chief Sanitary Inspector’s rights as regards processing data in connection with coronavirus
The Chief Sanitary Inspector’s (GIS) recommendations issued on the basis of the Special Act on preventing COVID-19 may constitute a legal basis for processing personal data. The President of the UODO recommends that GIS and the State Inspection authorities use the support of their data protection officers (DPO) and declares full readiness to cooperate in this regard.
Given the seriousness of the situation, the multitude of tasks and the need to take a number of actions related to counteracting COVID-19, the President of the UODO in a letter to the Chief Sanitary Inspector declares full readiness to cooperate and support so that the actions taken simultaneously serve to prevent and combat epidemics and do not violate the right to privacy and personal data protection regulations.
The President of the Personal Data Protection Office, in response to the Chief Sanitary Inspector’s letter on the grounds for processing personal data in connection with the fight against coronavirus, also indicated that sanitary inspections should be guided by regulations which regard the activities of these institutions. In addition, taking into account Article 17 of the Special Act on preventing, counteracting and fighting COVID-19 all decisions, guidelines and recommendations of GIS issued to various entities based on this Special Act will constitute the legal basis for their processing of personal data.
However, the President of the UODO recommends that GIS, as well as the State Sanitary Inspection authorities, when making decisions regarding their activities related to the processing of personal data, use the support of their data protection officers (DPO). This is important, among others because when developing new regulations, guidelines and recommendations they should be guided by the principles set out in the GDPR, i.e. the purpose limitation principle or the storage limitation principle.
While undertaking all activities, sanitary inspections should bear in mind that personal data that are processed in connection with these tasks are adequately protected.
In the letter to GIS, the President of the UODO also emphasized that special attention should be paid to the scope of information provided, e.g. during interviews or press conferences regarding persons affected by coronavirus. At the same time, the scope of disclosed data should be minimized and, for example, the occurrence of comorbidities should be indicated in these persons, without mentioning specific disease classification.
The content of the entire letter of the President of the UODO to GIS is available below (in Polish).