This is not the time for strict enforcement of data protection. We are showing agility during this crisis.
- Information that someone is infected with coronavirus is health information.
- Information that someone has been quarantined or returned from a so-called “risk area” is not health information.
- Employers should not disclose information that individual employees are infected or quarantined.
- For medical care by video, you must have a data processing agreement in place and conduct a DPIA. To this end, choose a video service which is recognized and can demonstrate that it will adequately protect your privacy.
- The special regulations that apply to health personnel and protection against infection most likely provide sufficient legal basis under Art. 6 and 9 GDPR . To process health data under Art 9.2(g) [public interest], (h) [preventive or occupational medicine] or (i) [public health per state law] GDPR + additional provision in Norwegian law.
- Try to ask before using solutions not previously approved by the school.
- When use is done – delete all unnecessary information.
Read the full text of the guidance.