In the light of this severe situation, on March 19th, the European Data Protection Board adopted a formal Statement that includes a number of clarifications and recommendations that need to be observed by every state to make sure that the processing of personal data during the state of emergency remains lawful as per the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the Regulation).
In this Statement, the European Data Protection Board has specifically underlined that the rules and the principles on data protection included in the Regulation shall not hinder in any way the taking of measures for the fight against this worldwide pandemic, and that even during these exceptional times, the protection of the personal data of data subjects and the general processing principles must be ensured at all times.
One of the areas in which the Board brought some clarifications is the processing of telecom data.
In order to prevent the spread of an epidemic, as per article 15 of the Directive on privacy and electronic communications, member states are entitled to introduce exceptional measures that regard the processing of telecom data to protect public security, even if the rule, according to the Regulation, is that telecom data (such as the location of the data subject) can be used only when made anonymous or with the consent of the individuals.
However, it is recommended that the preliminary measures introduced by member states include an anonymous processing of the data regarding the location of the data subject, in order to prevent its re-identification.
In case an anonymous processing proves to be insufficient so as to safeguard public security, exceptional legislative measures can be introduced regarding the monitoring and geo-localization of the data subjects by processing their telecom data. However, these measures must be in accordance with the Charter of Fundamental Rights and the European Convention for the Protection of Human Rights, and States must provide appropriate measures, such as the right of data subjects to legal remedies.
Measures that regard the processing of telecom data in a non-anonymous way, must be at the same time necessary, appropriate and limited in time, strictly for the period of the state of emergency, must respect the proportionality principle that is to introduce the least harmful measures.
According to Article 11 of the Military Ordinance no. 3 of March 24, 2020 on measures to prevent the spread of COVID-19, Romania’s authorities have introduced several measures regarding the use of mobile location data in order to monitor and verify compliance with the conditions of quarantine or home isolation of the data subjects, but also in order to communicate in real time with these individuals.