Privacy implications hinder the expansion of Dutch laboratory capacity for COVID-19 tests
The past few weeks, there has been a lot of attention for the increased number of covid-19 tests being performed in the Netherlands and the lack of laboratory capacity to have these tests analysed within our country. Life Sciences Team members Celine van Waesberge and Jacobine van Beijeren wrote a blog on this matter.
The past few weeks, there has been a lot of attention for the increased number of covid-19 tests being performed in the Netherlands and the lack of laboratory capacity to have these tests analysed within our country. Due to this insufficient capacity, the Dutch government was required to seek for alternatives abroad. In this respect, a deal was almost reached with a Dutch company that offered to have samples analysed by the laboratory of its group company in Abu Dhabi, United Arab Emirates. Privacy concerns seem to have prevented this deal from being closed.
Having the samples analysed in Abu Dhabi would not only require the samples being shipped there, but would also require the transfer of health data from the Netherlands to the laboratory in Abu Dhabi. Such international transfer of personal data is generally allowed, provided that appropriate safeguards are in place to ensure an adequate level of protection of the data equivalent to that guaranteed by the GDPR in the EU. Whether this is the case, requires an in-depth assessment following the recent and much debated judgment of the European Court of Justice (ECJ) in the Schrems-II case (please click here for more information on this judgment).
The potential engagement of the laboratory in Abu Dhabi was criticized in the media and the Dutch Data Protection Authority (DPA) got involved. The DPA raised some questions on what appropriate safeguards were taken or intended by the Dutch government and the Abu Dhabi laboratory to ensure the adequate protection of any data exchanged. Apparently, the protection offered by the laboratory was not deemed appropriate (or not further assessed) by the Dutch government as it announced that the laboratory in Abu Dhabi will not be engaged to analyse covid-19 test samples. While both Spain and the UK (both also – still – subject to the GDPR) actually have engaged the same laboratory in Abu Dhabi, the Dutch government is now looking for alternative laboratory capacity within the EU to avoid any hurdles from a GDPR perspective. It would be interesting to know the outcome of the assessments of Spain and the UK as they are apparently of the opinion that the level of protection of the personal data is sufficient.
Considering the above we wonder whether an actual assessment of the safeguards was performed and turned out that an adequate level of protection was impossible or it is due to the public opinion and media attention that the Dutch government decided not to pursue the engagement of the laboratory in Abu Dhabi. In any case, it is important to realize that an international transfer of personal data to a country outside the EU is still not prohibited under the GDPR, but is subject to additional requirements and may require some time and efforts.
Céline van WaesbergeSenior Associate Attorney at law
Céline van Waesberge, attorney at law, works for the Competition & Regulatory practice group and is member of the Life Sciences Team and Data Protection & Privacy Team of Loyens & Loeff.T: +31 20 578 52 25 M: +31 6 11 44 26 95 E: firstname.lastname@example.org