The EDPS calls for effective data anonymisation, and urges the EC to roll back the measure as soon as practical.
Background: As governments battle to contain the coronavirus outbreak, they are looking at ways to track and predict the spread of the virus. In some European countries there is an ongoing conversation with MNOs. On 23 March 2020, the European Commissioner for the Internal Market, Thierry Breton had a conference call with executives from some of Europe’s largest operators to explore the possibility of handing over anonymised and aggregated data from people’s mobile phones. This also raised privacy concerns, since there is a risk to expose users’ personal information. The EC’s Directorate-General for Communications Networks, Content and Technology (DG CONNECT) sought the view of the European Data Protection Supervisor (EDPS) on this point.
Anonymisation should be effective: On 25 March 2020, the EDPS set out its position on the matter, noting that, if the data is “effectively anonymised”, it will fall outside the scope of data protection rules. However, anonymisation should go beyond simply removing the most obvious identifiers such as IMEI and phone numbers. Aggregation of data will provide an additional safeguard, and the EC should clearly define the dataset it wants to obtain and be transparent towards the public. Access to the data should also be safeguarded: security obligations would still apply to anonymised data, as would confidentiality and prohibitions on further use, especially for third parties.
The measure should be rolled back ASAP: With regard to data retention, the EDPS welcomes that the data obtained from MNOs would be deleted as soon as the pandemic comes to an end. The EC should make clear that these special services are deployed because of this specific crisis and are temporary in nature, since similar measures can be difficult to roll back once the situation is over. Finally, the EDPS calls on the EC to be fully transparent to the public, and to consult the EDPS again for any change it will make in the future.
