EDPS publishes guidance on manual contact tracing by EU institutions

The European Data Protection Supervisor (EDPS) has published guidance on manual contact tracing by EU institutions for COVID-19 purposes. The EDPS considers that manual contact tracing is compatible with EU law as long as European institutions put in place comprehensive data protection measures. The collection and use of public health information requires that privacy considerations are thoroughly addressed at all levels of contact tracing activities. In view of the high sensitivity of the data in question, and the high risk of privacy violations, institutions need to conduct a Data protection impact assessment (DPIA) when developing and implementing a manual contact tracing operation.