4.2 PRIVACY AND DATA PROTECTION “Asking people to choose between privacy and health is, in fact, the very root of the problem. Because this is a false choice. We can and should enjoy both privacy and health.” Harari, Y. N., The world after coronavirus, Financial Times, 22 March 2020 “We are confident that data protection requirements will not stop the critical sharing of information to support efforts to tackle this global pandemic. The universal data protection principles in all our laws will enable the use of data in the public interest and still provide the protections the public expects.” Global Privacy Assembly, Statement by the GPA Executive Committee on the Coronavirus (COVID-19) pandemic, 17 March 2020 In the fight against COVID-19, data can save lives. This puts data protection issues at the forefront of responses to the pandemic. It is important to highlight that data protection standards are not hindering the fight against COVID-19. International institutions, such as the Global Privacy Assembly,249 the European Data Protection Board,250 the Council of Europe251 and national data protection regulators published statements affirming that data protection requirements ensure the safe and trustworthy collection and processing of data. The evidence collected by FRA shows that nearly all EU data protection authorities (DPAs) issued guidelines related to the pandemic (see Table 1 in the Annex). These statements reaffirm that the rights to health and protection of personal data go hand in hand. They also underline that any measure which would infringe the rights to private life and data protection should be grounded in law, necessary, and proportionate. Several of these statements coincided with the adoption of extraordinary measures or emergency acts, for example in Czechia, Italy and Poland. In Italy, the DPA (Garante) issued an Opinion on the government Decision252 declaring a six-month state of emergency, which included a provision on the collection and treatment of personal data by civil protection authorities. The Garante stressed that the Decision was in line with the rights and guarantees envisaged by existing legislation, and underlined that – after the emergency ends – all public administrations involved in civil protection must ensure that data collected during the emergency is treated according to ordinary procedures. 4.2.1 Data processing by employers The potential for COVID-19 to be transmitted in workplaces prompted some employers to consider whether to collect and process staff personal data, including health data. This could include data on experiences of symptoms or cases of the virus among their workforce, as well as information on employees’ recent travel or contact with confirmed sufferers. This in turn raises questions about the permissibility of employers disclosing the health data of some employees to other staff members. 41