This is not the time for strict enforcement of data protection. We are showing agility during this crisis.

  • Information that someone is infected with coronavirus is health information.
  • Information that someone has been quarantined or returned from a so-called “risk area” is not health information.
  • Employers should not disclose information that individual employees are infected or quarantined.
  •  For medical care by video, you must have a data processing agreement in place and conduct a DPIA. To this end, choose a video service which is recognized and can demonstrate that it will adequately protect your privacy.
  • The special regulations that apply to health personnel and protection against infection most likely provide sufficient legal basis under Art. 6 and 9 GDPR . To process health data under Art 9.2(g) [public interest], (h) [preventive or occupational medicine] or (i) [public health per state law] GDPR + additional provision in Norwegian law.
  • Try to ask before using solutions not previously approved by the school.
  • When use is done – delete all unnecessary information.

Read the full text of the guidance.