The “Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak” have been adopted by the European Data Protection Board (EDPB) on April 21st 2020, with minor corrections made on April 30th. 

The Guidelines have been adopted having regard to: 

- Article 70 (1) (e) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter GDPR), 

- the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018, 

- Article 12 and Article 22 of its Rules of Procedure. 

Because of the outbreak of the novel coronavirus, and in the lights of the current worldwide pandemic, great scientific research efforts are being conducted internationally in order to fight against SARS-CoV-2 and produce conclusive research results as soon as possible. 

At the same time, legal questions arise in regards to the use of health data pursuant for Article 4 (15) GDPR for such research purposes. Within their guidelines, the EDPB aims to address the most urgent of these issues, such as the legal basis, the implementation of adequate safeguards for such processing of health data and the exercise of the data subject rights. The development of a further and more detailed guidance for the processing of health data for the purpose of scientific research is part of the annual work plan of the EDPB. 

It is important to know that data protection rules (such as the GDPR) do not hinder measures taken in the fight against the COVID19 pandemic. The GDPR is a broad piece of legislation and provides for several provisions that allow handling the processing of personal data for the purpose of scientific research connected to the COVID-19 pandemic in compliance with the fundamental rights to privacy and personal data protection. Furthermore, the GDPR foresees a specific derogation to the prohibition of processing of certain special categories of personal data, such as health data, where it is necessary for these purposes of scientific research. 

When processing health data for the purpose of scientific research connected to the COVID-19 pandemic, fundamental Rights of the EU must be applied.  Neither the Data Protection Rules nor the Freedom of Science pursuant to Article 13 of the Charter of Fundamental Rights of the EU has precedence over the other. Rather, these rights and freedoms must be carefully assessed and balanced, resulting in an outcome which respects the essence of both.

Please follow the adherent link in order to view the complete EDPB guidelines: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202003_healthdatascientificresearchcovid19_en.pdf