The AEDP affirms that adequate monitoring of the evolution of infections and the obligation to collect data and transfer it to the health authorities is based on the guarantee of a public interest in controlling the pandemic. Therefore, it is covered by article 6.1.e of the RGPD, which states that “the treatment is necessary for the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the person responsible for the treatment.” In addition, protected by the current state of alarm, it is not necessary for the norm to have the force of law (that of the Canary Islands is a resolution). Of course, once it culminates – predictably on May 9 – for the Canary Islands to continue with this measure, it would have to rely on a law.
The sector denounces the vague wording of the regulation and the lack of information from the Government
Canary Islands regulations now comply with most of the precepts referred to by the Agency, such as making it compulsory to collect data and transfer it by establishments or include a period for their conservation (one month). However, it limps in others. The regional administration has not established “criteria on the way in which these personal data are collected and communicated to the health administration”, the main reason for the sector’s complaint. The hospitality industry has denounced the vague wording of the resolution and the lack of information by the Administration, despite the fact that the measure has had to be applied in the islands at levels 1 and 2 (all except for the capital cities) since the same Friday that the BOC was published.
In addition, the Canary Islands have exceeded the amount of data requested since, since the creation of the Radar Covid app, the European Data Protection Committee has established the principle of minimization, by virtue of which “it could be sufficient to obtain a number telephone number, along with the day and time of attendance at the site ”. And this has been reflected in the Recommendation on the use of location data and contact tracking applications in the context of the pandemic, which, according to the AEPD, can be extrapolated to this situation. Finally, the Agency understands that what cannot be done in any case is to force the population to give up this data. “To be able to appreciate a free consent, it would be necessary that no negative consequence be derived, that is, that the entrance to the establishment not be prevented” in the event that the person finally refuses to consent to the transfer of personal data to the premises in question.