Data Privacy - updated on Mar 19 at 11:53 pm
DATA PROCESSING AND THE COVID-19
Upon the scenario of the global pandemic led by coronavirus, a new set of concerns rises in the operation of various public and private entities. In that sense, preventive measures such as the mapping of potential positively diagnosed employees has become a recurrent practice when it comes to facing the highly contagious traits of the virus. Such analysis cannot be made, however, without the processing of these individuals’ health conditions’ data, a set of information classified as “sensitive personal data” in the Brazilian General Data Protection Law (LGPD), which will come into effect in August 2020).
LGPD grants special protection for the data framed under the category of “sensitive personal data” (including information about health or sex life and also genetic or biometric data, when related to a natural person) due to recognition of a potential discrimination that arises with the processing of such types of data.
In spite of the noted need of a higher level of special protection to be upheld by controllers, it is clear that those preventive operations can indeed be rendered, especially in the current pandemic scenario, as long as they are grounded on the normative legal basis foreseen in the LGPD. Still, considering the specific characteristic of this type of data, it should not be used for any other purpose other than the implementation of preventive measures against COVID-19, and should be excluded after this situation has been solved.
Concerning the ulterior measures to be adopted with the collected data, it is important to note that no illicit or discriminatory abuse means can guide those operations. For that reason, the controller’s usage of its employees’ or visitors’ health data for the maintenance of a safe environment meets the Brazilian normative framework when facing the dispositions of the Law No. 13,979/2020. Note that this regulation was incorporated in the Brazilian legal system as a response to the recommendations established by the World Health Organization, establishing the necessary measures set to deal with the public health emergency derived from the coronavirus outbreak.
In response to the pressing matters, public and private sectors should indeed be increasingly prepared to respond to this issue, with due regard to the Brazilian data protection legislation.
