CIVIL LIBERTIES EXPERTS have warned people to be vigilant about their privacy rights even as concerns grow about the coronavirus Covid-19.

Yesterday, the first death from the coronavirus was confirmed in Ireland. The country is now ramping up preparations to deal with a major outbreak – some colleges have cancelled lectures and graduation, while on Tuesday Aer Lingus and Ryanair suspended all Italian flights. 

There are over 100,000 confirmed cases of Covid-19 around the world. Over 4,000 people have died from the virus so far, according to the European Centre for Disease Prevention and Control. 

However, the privacy experts have warned that there is a balance to be struck between protecting public health and ensuring privacy rights aren’t infringed as both the government and employers take efforts to tackle Covid-19. 

The Data Protection Commission, the independent body in Ireland for safeguarding personal data, confirmed to TheJournal.ie that it had received “a few dozen” inquiries – mainly from employers – about how to combine personal privacy and protecting health. 

GDPR rules do allow organisations to process personal data when it is “necessary for reasons of public interest in the area of public health”. 

The EU’s data protection law states that processing someone’s data to identify them can be justified if it is is necessary for “protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care”.

“We’re dealing with a health crisis. It is significant. We have to make big decisions as a society,” Elizabeth Farries from the Irish Council for Civil Liberties, told TheJournal.ie. 

“In times of health crisis, special efforts are warranted to put in protections,” she said. 

But, she warned, any measures need to be “necessary and proportionate”. 

Employers, in particular, have been cautioned to keep in mind data protection rules when dealing with employees. 

Legally, data protection is complex and often contextual. In this particular scenario – not faced before by the vast majority of Irish businesses – difficult questions are being asked about what is or is not justified on public health grounds. 

Related Reads

First death in Ireland confirmed as coronavirus declared a pandemic: Today's main Covid-19 points

Pay workers who have to take time off due to Covid-19 illness or self-isolation, Donohoe says

Indeed, different employers may need different standards when it comes to maintaining the confidentiality of any patients diagnosed with coronavirus – there is a much greater need, for instance, to know the identity of an individual with the coronavirus if they work in a nursing home than if they work in a large office. 

The Data Protection Commission last week issued advice stating that “data protection law does not stand in the way of the provision of healthcare and the management of public health issues”. 

And with a legal requirement for employers to protect the safety of their staff, the Data Protection Commission advises that any decisions on the use of personal data “should be informed by the guidance and/or directions of public health authorities”. 

On the issue of naming an employee who has the virus to other staff, the commission warns that “this should be avoided”. 

An employer would be justified in informing staff that there has been a case, or suspected case, of COVID 19 in the organisation and requesting them to work from home. This communication should not name the affected individual. Disclosure of this information may be required by the public health authorities in order to carry out their functions.

When it comes to cataloging information from staff in the coming weeks – such as travel or health details – Farries said that information should be “collected based on science, not the biases of individuals”. 

“Crises precipitate change. But they don’t eliminate our human rights,” Farries said.