Fighting Virus Is About Processing Big Data - Special Categories

Fighting global pandemic is impossible without collecting and processing special categories of personal data. The core of this fight is collecting and processing data about patients’ locations, movement, health conditions and personal habits (i.e. hygiene, food etc.) as well as contact with other people and type of interaction. All this information and much more is carefully analysed so patterns can identify, conclusions made and used to protect human race.

GDPR proposes legal means for such sensitive data processing

Rarely used legal basis for personal data processing is when processing is necessary in order to protect the vital interests of the data subject or of another natural person as well as the one where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, but... we are discussing special categories of personal data and

Special categories of personal data shouldn’t be processed at all except with the special consent of the data subject and in few special cases specifically outlined in GDPR. One of these exceptions is situation where processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health, which is exactly the case with fighting Corona outbreak. It is simply amazing how detailed GDPR is.

Special categories - special protection

GDPR also requires additional protection measures when processing special categories of personal data. “Adequate technical and organisational measures“ in this particular case should, without any doubt include use of anonymisation each and every time personal data is used for statistical purposes, use of pseudonymisation when personal data has to be processed by processors who don’t really need to know who this data belong to. On top of all that, encryption should be used to protect both, the confidentiality and integrity of the personal data as well as the results of processing. According to latest information collected from European supervisory bodies (study is scheduled for release in Friday, March 13th), health sector cybersecurity is one of the biggest concerns. It’s not the best time for interrupting WHO and numerous national crisis teams to ask questions about cybersecurity and measures they use to protect all this data. They have more important things to focus on.

We’ll survive - what then?

Majority of people whose data is processed for mentioned purposes will survive this pandemic and return to normal life at the end. Are we about to witness major data branches involving special categories of personal data in following months? Let’s hope, not. However, we should at least learn something. Medical crisis tams should be prepared for such situation. This means educated and equipped. Or... we should simply focus to improving data protection in health sector overall, although we were supposed to do this already.