The EDPS (the independent authority in charge of verifying compliance with privacy legislation in relation to the processing activities carried out by European institutions) has expressed its opinion on an initiative, promoted by the Commission, concerning the processing of telecommunications data for the monitoring of the spread of COVID-19.

In a letter to the Director General of the European Commission, Roberto Viola (Directorate General for Communication Networks, Content and Technologies), dated March 25, 2020 (click here to view the letter), the EDPS confirmed that the legislation on the protection of personal data is flexible enough to allow processing activities aimed at preventing contagion and, recalling the initiatives that some member states are implementing at national level, shared the need for an approach at European level.

With regard to the Commission's initiative, the EDPS particularly appreciated the intention to process anonymous and aggregated data. In the presence of effective anonymization (which is more than simply removing an identifier such as a telephone number), this would fall outside the scope of the privacy legislation, but the obligations to ensure the confidentiality and security of that data would still apply.

The EDPS also recommended that the data retention period should in any case be limited to the duration of the emergency, and underlined the importance of ensuring that the characteristics of the initiative are transparent to the public, which shall therefore be duly informed in advance.