Covid self-tests and data processing

Jun 9, 2021

After the Greek DPA received a series of questions regarding performing self-tests in the context of managing the pandemic coronavirus crisis and reopening country’s activities, submitted by parents of pupils, as exercising parental responsibility of their minor children, adult students, teachers, employees (of the private and public sector), acting as data subjects, and given that the personal data processing issues while performing self-tests have been regulated by relevant Common Ministerial Decisions, the DP Authority, within its competence under the Regulation (EU) 2016/679 and law 4624/2019, points out the following:

1. GDPR adopts a new compliance model based on the accountability principle, in the context of which the data controller is obliged to design, implement and generally take the necessary measures and policies so as to ensure that data processing will be in accordance with relevant legislative provisions. In addition, the controller is burdened with the task of personally demonstrating at any time his compliance with the principles of article 5 par. (1) (2) GDPR.

2. Under the GDPR and national law 4624/2019, in order for the data subject to effectively exercise their rights, they must know the identity of the controller and their contact details. Furthermore, when processing personal data, information should be provided regarding key elements of the processing, such as the purposes, the legal basis and the recipients of the processing. 

3. The responsibilities of the Authority are explicitly defined in the provisions of articles 57 GDPR and 13 of law 4624/2019. Besides, the Authority has already pointed out through its decision no. 52/2018 that it has no competence to answer questions concerning the processing of personal data, as data subjects shall submit relevant requests before the responsible controller. 

Therefore, regarding the self-test results personal data processing that takes place through the .gov services in the online platform www.self-testing.gov.gr, the data subjects should be addressed to the data controllers for the exercise of their rights provided by GDPR and law 4624/2019. It is further clarified that the demonstration of negative self-test results by the students and teachers, to the extent that these results are neither included in a filing system nor subject to processing by automated means, does not in principle constitute personal data processing that falls within the regulatory scope of the GDPR (article 2) and law 4624/2019 (article 2).

Get all latest news at www.dataprotection.gr.

Recent news

National Insights: Digital and Data Strategies & Data Protection

National Insights: Digital and Data Strategies & Data Protection

Information Review of the Statement (Statement on the Digital Services Package and Data Strategy) of the EDPB (European Data Protection Board) of 18 November 2021 regarding concerns in relation to proposals for digital and data strategies and recommendations for data protection under the General

read more
“Networking again at last”

“Networking again at last”

Conflicting views and long-awaited personal conversations marked BvD fall conference and Authorities Day in Munich It was a nail-biter until the very end. First, the hotel booked in Nuremberg for the BvD autumn conference had become too small because the demand for a...

read more