Are you concerned that measures aimed at protecting your health during the coronavirus pandemic may compromise your fundamental rights to data protection and privacy? The European Union is committed to ensuring that they are strongly protected. In the face of the coronavirus pandemic, digital technologies became crucial for maintaining a functioning EU society and economy. Apart from the surge in communication applications, the crisis provoked the development of digital tools to fight the pandemic, such as contact tracing apps and the EU Digital COVID Certificate.

While these tools present challenges to the EU data privacy framework, they also present an opportunity to test the framework's resilience. The European Data Protection Board (EDPB) considers that there is no need to lift GDPR provisions but to observe them. Consequently, pandemic response technologies must comply with EU data protection law whose main principles include lawfulness, fairness and transparency, data minimisation, data security and accountability (for more see Article 5 GDPR). The European Commission and the EDPB highlight that contact tracing and warning apps should only be voluntarily installed and used; only data that are strictly necessary for the running of the service are collected; apps should use proximity data based on Bluetooth instead of location data; the data apps collect should not be stored longer than necessary (14 days); data should be protected through state-of-the art techniques, including encryption; the applications should be de-activated as soon as the pandemic is over.