On 19 March 2020, the European Data Protection Board
("EDPB") issued a statement concerning
the lawfulness of personal data processing resulting from the
emergency measures taken by governments, public and private
organisations throughout the European Union to contain and mitigate
COVID-19.
It clarifies that the EU General Data Protection Regulation
("GDPR")1 does not hinder the
implementation of special measures to fight the pandemic. The
protection of personal data must be considered where adopting such
measures though. Any restriction on the freedom of individuals
caused by emergency measures must remain proportionate and limited
in time.
The EDPB reiterates that the GDPR provides specific legal bases
for competent public health authorities and employers to process
personal data, including special categories of data (such as health
data), in exceptional circumstances, such as in the context of an
epidemic. It is also important to take measures in accordance
