Data protection in times of COVID-19 – Brief remarks

Abstract

The COVID-19 pandemic, as a public calamity situation, motivated not only the first state of emergency declaration under the 1976 Constitution, but it also posed some challenges to personal data protection. However, unlike other rights suspended during the state of emergency or restricted during the state of calamity, the regime in question is primarily a result of European – not national – law.

Thus, the processing of personal data carried out by the Public Administration must be based, even in a state of exception (should it be constitutional or administrative), on the lawfulness of processing reasons provided for in the GDPR. The problem of the limits on data processing by the Public Administration will be analyzed based on the guidelines published by the CNPD on the disclosure of information by local authorities regarding people infected with Covid-19, so as to confirm that the state of exception does not erase the requirements imposed by the GDPR.