The European Data Protection Board said Tuesday that it would be creating guidelines for collecting data for surveillance tied to, including geolocation, contact tracing and health information.
Governments around the world are relying on phone location data to help track the coronavirus outbreak, without any formal restrictions or mandates on how that data can be used. Countries including Singapore, the United Kingdom and Israel have developed their own apps for tracking people's movements and examining how COVID-19 spreads, and the only privacy protections are based on trusting the government's promises.
Across Europe, mobile phone companies, such as Vodafone, have also agreed to share the location data they've collected, offering it to governments to track social distancing efforts and help develop public health policies.
The uncertainty over such programs has left privacy advocates concerned that the surveillance powers afforded during the pandemic will outlast the crisis. The EDPB said on Tuesday that it has assigned its expert subgroups to develop guidelines for how geolocation data can and can't be used during the COVID-19 crisis. The group didn't provide a deadline for when those guidelines will be made available.
"The EDPB will move swiftly to issue guidance on these topics within the shortest possible notice to help make sure that technology is used in a responsible way to support and hopefully win the battle against the corona pandemic," EDPB Chairwoman Andrea Jelinek said in a statement. "I strongly believe data protection and public health go hand in hand."
Europe's General Data Protection Regulation doesn't have geolocation data guidelines for a pandemic like COVID-19, and many data protection commissioners, including in Ireland, Germany and Italy, have said that they're prioritizing saving lives over privacy during the outbreak.
The GDPR does address what privacy restrictions there are during a health crisis, including allowing for public health officials to gather personal data without consent during a pandemic. But it doesn't have specific rules regarding geolocation data tracking during a pandemic, which the EDPB is looking to quickly establish. On March 16, Jelinek issued a statement that location data should be used only when it's anonymized or with people's consent.
The EDPB noted that establishing its COVID-19 location data guidelines was its highest priority and that it's delayed working on its mandates for remote working tools because of it.