Data sharing by providers of electronic communications services with public authorities to fight COVID-19 03 May 20

News from Cullen International's COVID-19 Update no. 2 (3 May 2020)

Governments across the world are looking into different technological data-driven solutions to contain and manage the spread of coronavirus (COVID-19).

Some countries have already imposed data sharing obligations on private actors and are introducing surveillance measures relying on data collection and processing. In some instances, providers of electronic communication services have voluntarily shared anonymised location data with public authorities.

European governments are increasingly exploring – with some already launched - contact tracing and symptom-checking mobile apps in an attempt to control the spread of the virus as they prepare to start to phase out their lockdown restrictions.

In reaction, data protection authorities are issuing statements and guidance on data processing in the context of the pandemic and the conformity of such initiatives with existing data protection rules.

These new findings by Cullen International reflect the data sharing and data processing practices and requirements imposed by European governments on providers of electronic communication services (ECS) as well as the use of mobile applications by public authorities to collect and process data in 14 European countries in an attempt to control the spread of COVID-19.

The update shows that:

  • In Austria, the Czech Republic, Poland and Slovakia voluntary contact tracing mobile apps have already been launched, while Belgium has abandoned its initial plan to develop one for considerations of effectiveness. France, Germany, Ireland, Italy, the Netherlands and the UK are currently developing voluntary contact tracing apps. In Poland a mandatory app was introduced for quarantine enforcement using geolocalisation data and a face recognition system.
  • Bulgaria, the Czech Republic, Poland, Slovakia and Spain have adopted specific legislation obliging ECS providers to share location data with public authorities for different purposes. In Poland and Spain the legal acts foresee location data to be shared in an anonymised and aggregated form.
  • In most surveyed countries official announcements have been made that ECS providers are sharing voluntarily aggregated and anonymised location data with public authorities.
  • Data protection authorities (DPAs) in most countries have issued statements or guidance on data processing and sharing in the context of the pandemic. The Austrian, Czech and Italian DPAs have in general recommended the processing of anonymised location data. By contrast, according to the Dutch DPA anonymising location data is not really possible as it is highly likely individuals can be reidentified. The French DPA advised that public interest would be the best legal basis for processing health data, and this would require the adoption of a law, but it did not rule out explicit consent as a basis for a contact tracing app. 

To access the full benchmark, please click on “Access the full content” - or on “Request Access”, in case you are not subscribed to our European Digital Economy service.

Stay in touch

Subscribe to our newsletter for a free weekly summary of the latest regulatory news and analysis from the communications world.