Supervisory Authorities Issue a Statement/Guidance on Data Protection and Coronavirus

guest · Mar 14, 2020

UK Supervisory Authority Issues Statement on Data Protection and Coronavirus
March 13, 2020
https://www.insideprivacy.com/covid...statement-on-data-protection-and-coronavirus/

On March 12, 2020, the UK Supervisory Authority (“ICO”) issued a statement on data protection and coronavirus (“COVID-19”). The statement makes clear that the ICO will take a “reasonable and pragmatic” approach regarding compliance with the GDPR in light of the current health emergency.

Similar to the Irish Supervisory Authority (see our previous blog here), the ICO stressed that data protection law does not stand in the way of addressing the challenges posed by the COVID-19 pandemic.
Security of personal data and homeworking: The ICO made clear that data protection law does not prevent homeworking, and it advised that companies consider the same kinds of security measures for homeworking that they would use in normal circumstances.

Collection of health data about employees or visitors: According to the ICO, it is reasonable to ask people whether they have visited a particular country, or are experiencing COVID-19 symptoms. This is a frequently raised concern for many organizations intending to protect the health and safety of their staff.
Sharing employees’ health information with public authorities: The ICO held that, while it is unlikely that companies will be asked to share information about specific individuals with public authorities, data protection law would not prevent that. [...]
Click to expand...

As we have previously reported (see our blogs here, here, here, here, and here), numerous other EU supervisory authorities have published similar guidance, but have sometimes taken an approach that is stricter than the ICO’s. This might call for the intervention of the European Data Protection Board (“EDPB”) at some point.
Click to expand...

Irish Supervisory Authority Issues Guidance on Data Protection and COVID-19
Norwegian Supervisory Authority Issues COVID-19 Guidance
French Supervisory Authority issues COVID-19 Guidance
Danish Supervisory Authority Issues COVID-19 Guidance
Italian Supervisory Authority Publishes COVID-19 Guidance
Spanish Supervisory Authority Issues Statement on Data Protection and Coronavirus
Hungarian Supervisory Authority Issues Guidance on Data Protection and Coronavirus

guest · Mar 16, 2020

EDPB Chair Issues Statement on Data Protection and COVID-19
March 16, 2020
https://www.insideprivacy.com/covid-19/edpb-chair-issues-statement-on-data-protection-and-covid-19/

On March 16, 2020, the Chair of the European Data Protection Board (“EDPB”), Andrea Jelinek, issued a statement on the processing of personal data in the context of the COVID-19 outbreak.

The statement made clear that EU data protection law does not stand in the way of the adoption of measures to fight against the Coronavirus pandemic. However, it stressed that controllers (including employers), as well as governments, should be mindful of a number considerations when adopting measures to fight the pandemic that involve the processing of personal data. [...]
Click to expand...

The publication of the EDPB statement follows the publication of similar statements by several other European regulators, including those of Belgium, Czech Republic, Denmark, Finland, France, Germany, Hungary, Iceland, Ireland, Lichtenstein, Lithuania, Luxembourg, the Netherlands, Norway, Slovakia, Slovenia, Spain, Sweden, Poland and the UK. Covington will continue to monitor developments in this area.
Click to expand...

Hungary (PDF): https://www.naih.hu/files/NAIH_2020_2586_EN.pdf

guest · Mar 17, 2020

Coronavirus and Data Protection: Europe’s Data Protection Authorities’ Views
March 16, 2020
https://www.hldataprotection.com/20...on-europes-data-protection-authorities-views/

Data protection authorities from around the world are stepping in to provide their input and guidance on the matter of data processing activities and the fight against the coronavirus. Hogan Lovells’ global Privacy and Cybersecurity team has compiled the guidance from various European authorities, which is available here.

The different emphasis among the data protection authorities’ views – which can be categorized as restrictive, neutral or permissible – suggests that the right approach must lie in finding a balanced middle ground which does not ignore the application of essential privacy principles.

This is also in line with the statement published by the European Data Protection Board (EDPB) on March 16 highlighting that data protection rules (such as GDPR) do not hinder measures taken in the fight against the coronavirus pandemic.
Click to expand...

Hogan Lovells: "Coronavirus and data protection – Guidance by data protection authorities" (PDF):

https://www.hldataprotection.com/2020/03/articles/international-eu-privacy/coronavirus-and-data-protection-europes-data-protection-authorities-views/attachment/coronavirus-and-data-protection-guidance-by-dpas-hogan-lovells-1/

The table below sets out the guidance provided by data protection authorities in relation to the processing of personal data in the context of the fight against the coronavirus (COVID-19) across various jurisdictions. The table is colour-coded by reference to the position expressed by each data protection authority.

Restrictive approach to data processing activities
Neutral approach to data processing activities
Permissive approach to data processing activities
Click to expand...

guest · Mar 18, 2020

Privacy and COVID-19: New Zealand guidance
FAQ from the office of the privacy commissioner of New Zealand
March 13, 2020

Covid-19 and privacy FAQs
These frequently asked questions can help you navigate privacy considerations where there may be a risk of exposure to the Covid-19 virus.
Click to expand...

guest · Mar 19, 2020

Global Privacy Assembly Issues Statement on COVID-19
March 18, 2020
https://www.insideprivacy.com/covid-19/global-privacy-assembly-issues-statement-on-covid-19/

On March 17, 2020, the Executive Committee of the Global Privacy Assembly (“GPA”) issued a statement on data protection in the context of the COVID-19 pandemic. The GPA is an entity representing data protection and privacy regulators around the globe, formerly known as the International Conference of Data Protection and Privacy Commissioners (“ICDPPC”).

The GPA recognizes the unprecedented challenges being faced to address the spread of COVID-19, and acknowledges that data protection requirements do not stand in the way of tackling such challenges.
According to the GPA, the data protection principles enshrined in virtually all countries with data privacy laws “enable the use of data in the public interest and still provide the protections the public expects” in the context of the COVID-19 outbreak.

The GPA’s statement shows how data privacy regulators are trying to coordinate their guidance at global level, and address the privacy concerns linked with the adoption of measures against the spread of the virus.
Click to expand...

Covington continues to track EU and global regulatory statements and guidance concerning COVID-19, and readers are invited to view Covington’s COVID-19 resources, available here.
Click to expand...

GPA: Statement by the GPA Executive Committee on the Coronavirus (COVID-19) pandemic

[...]
Our data protection and COVID-19 resources page provides the latest guidance and information from GPA members.
Click to expand...

guest · Mar 19, 2020

Australian Privacy Commissioner offers advice on staff privacy amid COVID-19
March 19, 2020
https://www.zdnet.com/article/austr...offers-advice-on-staff-privacy-amid-covid-19/

The Office of the Australian Information Commissioner (OAIC) has asked employers across the country to be mindful of their obligations under the Privacy Act 1988 when handling information related to the COVID-19 coronavirus outbreak.

The OAIC said that while it appreciates the unprecedented challenges employers are facing to address the spread of the virus, they still have obligations to maintain a safe workplace for staff and visitors and handle personal information appropriately.
Personal information should be used or disclosed on a need-to-know basis, the OAIC said, adding that only the minimum amount of personal information "reasonably necessary" to prevent or manage COVID-19 should be collected, used, or disclosed.

"In order to manage the pandemic while respecting privacy, agencies and private sector employers should aim to limit the collection, use, and disclosure of personal information to what is necessary to prevent and manage COVID-19, and take reasonable steps to keep personal information secure," the OAIC wrote.
Click to expand...

OAIC: Coronavirus (COVID-19): Understanding your privacy obligations to your staff

guest · Mar 26, 2020

Dutch DPA Publishes Recommendations Regarding COVID-19 and Privacy in the Workplace
March 25, 2020
https://www.huntonprivacyblog.com/2...arding-covid-19-and-privacy-in-the-workplace/

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, the “Dutch DPA”) recently published materials regarding the COVID-19 crisis, including recommendations and FAQs for employers and recommendations for employees. In the materials, the Dutch DPA emphasizes that, while fighting the virus and saving lives is the top priority, privacy must not be overlooked and the crisis should not become a prelude to a “Big Brother” society.

While employers may want to conduct health-checks on their employees to prevent infection, the Dutch DPA notes that specific rules apply to the collection of information in the event of illness at the workplace, in particular when such information qualifies as sensitive personal data.

Employers are not allowed to process health-related data of their employees and therefore cannot ask their employees questions about their health or test their employees. [...]
Click to expand...

guest · Apr 20, 2020

ICO will Relax Enforcement of Data Protection Law in Light of COVID-19
April 16, 2020
https://www.cbronline.com/news/relax-enforcement-of-data

In light of the current pandemic the Information Commissioners Office (ICO) has announced that it will relax enforcement of data protection laws throughout the pandemic.

Information Commissioner Emily Denham explained: “Against this backdrop, it is right that we must adjust our regulatory approach.

“Our UK data protection law is not an obstacle to such flexibility. It explicitly sets out the importance of my office taking regard of the general public interest, and allows for people’s health and safety to be prioritised without the need for legislative amendment.
The European Data Protection Board (EDPB) released a statement yesterday along the same lines, outlining the fact that their approach to data protection will be eased while the virus is drastically affecting public life:
“This guidance on data protection and privacy implications complements the European Commission’s Recommendation on apps for contact tracing, setting out the process towards a common EU toolbox for the use of technology and data to combat and exit from the COVID-19 crisis.”
Click to expand...

ICO: How we will regulate during coronavirus
Blog: Combatting COVID-19 through data: some considerations for privacy
EDPB: ...Letter concerning the European Commission's draft Guidance on apps supporting the fight against the COVID-19 pandemic

guest · May 3, 2020

Albania: IDP issues guidelines on the processing of personal data within specific sectors during Coronavirus
May 1, 2020
https://www.dataguidance.com/news/a...-personal-data-within-specific-sectors-during

The Office of the Information and Data Protection Commissioner ('IDP') issued, on 6 April 2020, guidelines ('the Guidelines') on the processing of personal data within specific sectors during the COVID-19 ('Coronavirus').
In relation to the employment sector, the Guidelines clarify that employers can process personal data of employees, such as data obtained from the monitoring of their health, in a reasonable manner, and transfer such data to law enforcement authorities and bodies conducting epidemiological surveillance.

Furthermore, the Guidelines note that, in relation to the transmission of location data for tracing purposes, operators of electronic communications networks should, before transmitting such data, make an impact assessment of this type of processing.
Moreover, the Guidelines highlight that when using online platforms for teaching, it is vital to avoid the processing of personal data for purposes other than for achieving continuity of education [...]
Click to expand...

guest · May 5, 2020

Japan’s Personal Information Protection Committee releases guidance on contract tracing mobile apps to combat COVID-19
May 4, 2020
https://www.alstonprivacy.com/japan...tract-tracing-mobile-apps-to-combat-covid-19/

On May 1, the Personal Information Protection Committee in Japan (PPC) released guidance (only available in Japanese) on the use of contact tracing mobile apps (Apps) as one of the mechanisms to combat the spread of COVID-19 and highlighted five essential consideration points. Specifically, the PPC recommends that all “personal information handling business operators” carefully consider, and disclose their practices on, the following points in connection with Apps: [...]

In the guidance, the PPC acknowledges the potential benefits of Apps, if these Apps are widely adopted, as well as the role of collaboration between public and private sectors in combatting the spread of COVID-19.
However, the PPC stresses the necessity of striking the appropriate balance between the protection of individuals’ privacy rights and the value of the information for public safety purposes. To achieve this balance, the PPC recommends trust building with App users by focusing on transparency and information safeguards.

The PPC also notes that information processed by these Apps may not be necessarily subject to the Act on the Protection of Personal Information (APPI) in Japan.
Click to expand...

guest · May 8, 2020

Geolocation Data and COVID-19: Argentina’s Data Protection Authority Issues Guidance
May 7, 2020
https://www.foxrothschild.com/publi...as-data-protection-authority-issues-guidance/

Argentina's data protection authority has issued guidance on processing geolocation data in the context of the COVID-19 health emergency.

The state authorities will be authorized to carry out the monitoring as long as they do it within the scope of their specific competence. Said competence must be interpreted strictly and not broadly. When they do not have this authorization, monitoring must be based on another alternative legal basis, such as consent.

When monitoring is authorized by the consent of the owner of the data, the person responsible for the processing of personal data must give the owner the opportunity to revoke it at any time.

The data must be stored so that the principles of security and confidentiality under the law are maintained.

The person responsible for the processing of personal data carry out an evaluation of impact prior to the implementation of the tool, in order to control and mitigate its risks, as well as assess its viability.

[...]
Click to expand...

guest · May 12, 2020

mood said: ↑

French Supervisory Authority issues COVID-19 Guidance
Click to expand...

CNIL Updates Data Protection Guidance for Employers in the Context of Lifting COVID-19 Containment Measures
May 11, 2020
https://www.huntonprivacyblog.com/2...ext-of-lifting-covid-19-containment-measures/

On May 7, 2020, the French Data Protection Authority (the “CNIL”) updated its previous guidance for employers relating to the processing of employee and visitor personal data in the context of the COVID-19 outbreak, in particular, in the context of lifting containment measures (the “Updated Guidance”).

Some employers may consider implementing systematic body temperature checks at the entrance to their premises. Similarly, employers may wish to assess employees’ exposure to the virus or their health statuses when they return to work. The Updated Guidance analyzes some of these practices and outlines the principles applicable to data processing activities. [...]
Read the CNIL’s Updated Guidance (in French).
Click to expand...

guest · May 15, 2020

The Netherlands: DPA changes position – taking temperature might not be subject to GDPR
May 15, 2020
https://blogs.dlapiper.com/privacym...ing-temperature-might-not-be-subject-to-gdpr/

Since the COVID-19 outbreak, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, “Dutch DPA”) had made it clear, on several occasions, that taking temperature tests (or otherwise processing health data) as a precautionary measure in light of COVID-19 is a strict “no go”. The position of the Dutch DPA was that most individuals, in particular employees and suppliers, are in a dependent position and therefore not able to freely consent to such temperature tests given the imbalance of power. The only exception was that health data can be processed by a (company) doctor.

However, recently the Dutch DPA adjusted its guidance on temperature testing (in the form of a Q&A) which could give room for companies to engage in such temperature testing.
Nonetheless, the Dutch DPA now admits, following its Belgian colleagues, there might be situations where temperature tests are set up in such a manner that they do not fall within the scope of the GDPR.

This clarification of the Dutch DPA provides room for flexibility for companies that wish to engage in temperature tests as a protective measure in light of COVID-19. However, in order for companies to successfully carry out temperature tests outside the scope of the GDPR, they will need to carefully design their testing processes and procedures.
Click to expand...

guest · May 16, 2020

Hungarian Government Suspends GDPR Data Subjects Rights
May 15, 2020
https://www.insideprivacy.com/covid-19/hungarian-government-suspends-gdpr-data-subjects-rights/

On May 4, 2020, the Hungarian Government issued a Decree that suspends, during the COVID-19 created state of emergency, the one-month deadline that controllers have under the GDPR to reply to data subject rights requests. The Decree also allows public entities to refuse or suspend freedom of information (“FOIA”) requests in certain situations.
The Decree has been heavily criticized by civil society groups and prompted the scrutiny by the European Data Protection Board (“EDPB”).

According to the Decree, the normal one-month deadline to reply to data subject rights requests will start running once the state of emergency ends, for which there is no fixed date yet. This means that during the state of emergency, controllers are able to rely on this Decree to refuse to answer requests relating to access, correction and erasure of data, as well as requests objecting to the processing of personal data.

On May 8, 2020, the EDPB announced that it had contacted the Hungarian Supervisory Authority about the above-mentioned Decree, but that it required further information to form a view. This was one of the topics discussed by the EDPB at their plenary session of May 14, 2020, and there are likely to be further developments related to this story.
Click to expand...

guest · May 20, 2020

ICO Issues COVID-19 Guidance for Employers
May 17, 2020
https://www.insideprivacy.com/covid-19/ico-issues-covid-19-guidance-for-employers/

On May 11, 2020, the UK Information Commissioner’s Office (“ICO”) published guidance on how employers should handle data in the event they choose to test their employees for COVID-19.
The guidance provides a clear reminder that employers must comply with both the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018 (“DPA”), and that health data, in particular, attracts additional protections.

Intrusive Technology: when considering more intrusive technologies (e.g., thermal cameras and temperature checks), employers must make the case for their use, giving specific thought to their purpose and whether or not they would be necessary, proportionate, and in keeping with reasonable expectations.
Disclosure: employers are advised to take a “proportionate and sensible” approach and to keep staff informed about potential or confirmed COVID-19 cases, and care should be taken to avoid naming individuals when doing so. [...]
Click to expand...

ICO: Workplace testing – guidance for employers

guest · May 25, 2020

Italian Supervisory Authority Publishes FAQs on Data Protection and COVID-19
May 17, 2020
https://www.insideprivacy.com/covid...blishes-faqs-on-data-protection-and-covid-19/

On May 6, 2020, the Italian Supervisory Authority (“Garante”) published a list of frequently asked questions (“FAQs”) and answers on data protection and COVID-19 (see here, in English).

The FAQs build on and expand guidance previously issued by the Garante (see our blog post here), and take into account recent measures adopted by Italian authorities, such as the Protocol on Fighting COVID-19 in the Workplace that the Italian government signed with several trade unions on March 14, 2020 (see our blog post here), which was slightly amended on April 24, 2020 (see here).

Among other topics, the FAQs cover: (1) data processing by private employers in the context of the COVID-19 health emergency; and (2) data processing in clinical trials and medical research in the context of the COVID-19 health emergency. [...]
Click to expand...

guest · May 31, 2020

Belgian DPA Publishes Opinions on Draft Laws for the Creation of a Database and for the Use of Contact Tracing Apps for COVID-19 Tracking
May 29, 2020
https://www.huntonprivacyblog.com/2...f-contact-tracing-apps-for-covid-19-tracking/

On May 25 and May 26, 2020 respectively, the Belgian Data Protection Authority (the “Belgian DPA”) published two opinions on draft laws introducing COVID-19-related tracking initiatives: (1) the Opinion 42/2020 on the draft law for the creation of a database by Sciensano, a public health institution (“Opinion 42/2020”), and (2) the Opinion 43/2020 on the draft law for the use of contact tracing apps to fight the spread of COVID-19 (“Opinion 43/2020”).

The Belgian DPA had already issued critical opinions (Opinions 34/2020 and 36/2020, available in French) in April regarding draft Royal Decrees introducing similar initiatives by Sciensano that involved the use of tracing apps and the creation of a database for COVID-19 tracking.
Below is a summary of the Belgian DPA’s opinions on the two new draft laws: [...]
Click to expand...

guest · Jun 7, 2020

EDPB Releases Statement on Restrictions on Data Subject Rights in Connection with the State of Emergency in Member States
June 5, 2020
https://www.huntonprivacyblog.com/2...with-the-state-of-emergency-in-member-states/

On June 2, 2020, the European Data Protection Board (the “EDPB”) announced that it had released a statement on restrictions on data subject rights in connection with the state of emergency in EU Member States amid the COVID-19 pandemic (the “Statement”).

Under certain circumstances, Article 23 of the EU General Data Protection Regulation (the “GDPR”) allows for national derogations to data subject rights where necessary and proportionate in a democratic society to safeguard important objectives of general public interest of the EU or Member States, including public health.
The Statement is a response to the Hungarian government’s decree on May 4, 2020 suspending, until the state of emergency is revoked in Hungary, measures following data subjects’ requests to exercise their rights with respect to personal data processing for the purpose of preventing, understanding, detecting and impeding the spread of COVID-19.
Click to expand...

In the Statement, the EDPB emphasizes that the GDPR remains applicable and allows for an efficient response to the COVID-19 pandemic, while also protecting individuals’ rights and freedoms. The Statement reiterates the main principles related to the restrictions on data subject rights in connection with the state of emergency in Member States, including: [...]

The EDPB also announced that it will issue guidelines on the implementation of Article 23 of the GDPR in the coming months. Read the EDPB’s Statement.
Click to expand...

guest · Jun 12, 2020

Coronavirus recovery – data protection advice for organisations
June 12, 2020
https://ico.org.uk/global/data-prot...ery-data-protection-advice-for-organisations/

The ICO recognises the unprecedented challenges we are all facing during the Coronavirus (COVID-19) pandemic.

As lockdown restrictions start to ease and businesses begin to reopen, we know you might need to continue to share information quickly or adapt the way you work. Data protection will not stop you doing that.
It’s about being proportionate - if something feels excessive from the public’s point of view, then it probably is. Our six data protection steps for organisations sets out the key principles organisations need to consider around the use of personal information.
Click to expand...

guest · Jun 13, 2020

Belgian DPA Publishes Guidance on Temperature Checks for COVID-19 Monitoring
June 9, 2020
https://www.huntonprivacyblog.com/2...n-temperature-checks-for-covid-19-monitoring/

On June 5, 2020, the Belgian Data Protection Authority (the “Belgian DPA”) published guidance on its website (the “Guidance”) regarding temperature checks during the COVID-19 crisis. The Guidance aims to provide advice to organizations looking to control access to their premises by restricting individuals with fevers in order to prevent further spread of the virus.

Overall, the Guidance provides that organizations cannot currently conduct temperature checks to the extent they record the results of those checks, or the organization’s response to such checks, in files, nor may organizations conduct temperature checks using sophisticated means, such as thermal cameras, digital temperature scanners or other automated measuring means.
However, the simple reading of individuals’ temperatures without recording any data [...] is therefore allowed from a data protection standpoint.
Click to expand...

guest · Jun 21, 2020

EDPB Releases Statement on Interoperability of Contact Tracing Apps
June 19, 2020
https://www.huntonprivacyblog.com/2...-on-interoperability-of-contact-tracing-apps/

On June 16, 2020, the European Data Protection Board (the “EDPB”) released a statement on the data protection impact of the interoperability of contact tracing apps within the EU (the “Statement”).

The EDPB issued this Statement following the publication of “Interoperability guidelines for approved contact tracing mobile applications in the EU” by the eHealth Network on May 13, 2020. In its guidelines, the eHealth Network calls for an interoperable framework in the EU that would enable users to rely on a single contact tracing application regardless of the Member State or region in which they reside.
Click to expand...

The EDPB indicates in its Statement that contact tracing apps may be rolled out as a temporary solution to fight the further spread of COVID-19, provided that these apps are effective, proportionate and part of a comprehensive public health strategy. Furthermore, other less privacy-intrusive alternatives should be assessed and given preference if they would achieve the same purpose.

Furthermore, the EDPB considers that, in addition to the issues identified in its Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak, interoperability of contact tracing apps presents a number of key data protection challenges that require specific attention, including: [...]
Click to expand...

guest · Jun 28, 2020

UK: New COVID-19 rules for the hospitality industry on collecting visitor contact information : Data protection considerations
June 25, 2020
https://blogs.dlapiper.com/privacym...t-information-data-protection-considerations/

The hospitality industry has been hard hit by COVID-19. Measures introduced this week by the UK government to ease restrictions for the sector come with a condition – if you open a pub, restaurant or other hospitality venue for business you must keep a record of patrons who visit and be ready to help with the national test and trace effort.

When collecting this information, it is important to understand that data protection laws still apply and operate data collection systems appropriately to comply with GDPR.
Here’s our checklist of practical steps hospitality and leisure businesses can take to stay on the right side of GDPR when complying with these new visitor record keeping obligations : [...]
Click to expand...

guest · Aug 5, 2020

Passport to Privacy: Lessons From EU Guidance on COVID-19 and Personal Data
August 3, 2020
https://www.dwt.com/blogs/privacy--...u-guidance-covid-19-personal-data-and-privacy

Attempts by U.S. legislators to address the privacy issues raised by the ongoing COVID-19 pandemic have stalled. But for companies seeking to balance the goals of furthering public health and protecting individuals' privacy, the European Union is providing policy guidance that may be exportable.

Guidance from the European Data Protection Board (EDPB) has made clear that rights to privacy and to data protection persist, even—or especially—during a pandemic. For public authorities, this means balancing public health concerns against individuals' rights and freedoms. For private entities, this means conducting screening or requesting that individuals provide health information only when permitted by national or local employment laws.
Click to expand...

guest · Sep 12, 2020

Gov't to enhance virus-related privacy protection amid concerns over data breach
September 11, 2020
https://en.yna.co.kr/view/AEN20200911004400315

The South Korean government on Friday announced additional measures to protect personal information, as the prolonged fight against the coronavirus pandemic has led to excessive data disclosures.

The Personal Information Protection Commission (PIPC) released the measures to protect privacy amid the COVID-19 pandemic, aimed at minimizing harnessing private information.
Under the measures, businesses cannot demand the names of customers on handwritten entry logs but only part of their home addresses and phone numbers.

The move came as the PIPC concluded that there was a high risk of data breach, after inspecting how personal information was gathered and managed during the quarantine process.
Click to expand...

High-risk facilities and most business establishments, like cinemas, cafes and restaurants, require visitors to submit either a QR-code based entry log or a handwritten one. But privacy concerns have been raised with the latter, as people are often required to write down their personal information -- a name and a phone number -- on the same sheet of paper.
Information gathered through smartphone QR codes was found to be safe, as they are automatically deleted after four weeks, the commission said.

The commission said it will mandate the central government's guidelines on personal data, citing 435 cases in which regional governments failed to follow the state recommendations to protect the privacy of coronavirus patients.
The guidelines, however, allow the disclosure of such private information when a patient may have infected a large number of colleagues at work.
Click to expand...

"We will use private information only when it is absolutely necessary for quarantine efforts, and ensure their safe use," Yoon Jong-in, chairman of the commission, said. "We seek public cooperation in the government's push to use the relatively safe QR-code entry log."
Click to expand...

Log in or Sign up

Supervisory Authorities Issue a Statement/Guidance on Data Protection and Coronavirus

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Supervisory Authorities Issue a Statement/Guidance on Data Protection and Coronavirus

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches