On February 7, 2020, Law 13.979/2020, better known as the "Coronavirus Law," was published. This law addresses measures to confront the public health emergency of international concern arising from the coronavirus. The legislation establishes measures that underpin government actions to address a potential public health emergency caused by the novel coronavirus. 

Among the measures foreseen is the sharing of personal data with the public administration. According to Article 6 of Law 13.979/2020, the sharing of data essential for identifying people infected or suspected of being infected by the virus is mandatory, with the sole purpose of preventing its spread. But in light of this, what about the rights of the data subject?

Law 13.979/202 establishes the duty of sharing essential data for identifying people infected with or suspected of having coronavirus among federal, state, district, and municipal public administration bodies and entities.

Nevertheless, such sharing extends to all private legal entities when the data is requested by any health authority. The sole purpose is to prevent the spread of the virus. The Ministry of Health is the authority responsible for issuing the administrative acts that will regulate the norm and for guaranteeing the confidentiality of personal information.

Therefore, the main focus of attention amidst the COVID-19 crisis is the massive use of personal data of those under investigation for the disease or with a confirmed diagnosis. When it comes to personal health data, the issue becomes even more sensitive, mainly due to the potential discrimination that infected patients could suffer in the event of unauthorized disclosure of their personal information. 

In this same vein, even though the Brazilian General Data Protection Law – LGPD (Law No. 13.709/18) only comes into effect in August of this year, it is worth noting that its application would be extremely relevant in the event of sharing sensitive health data about those infected or suspected of being infected with the coronavirus. 

This is because, according to Article 11 of the LGPD (Brazilian General Data Protection Law), the processing of sensitive personal data may occur when it is indispensable for the protection of the life or physical integrity of the data subject or a third party – which, given the threat posed by the coronavirus, is the case here. Furthermore, indicating a specific purpose for processing this information (namely, preventing the spread of the disease) aligns with the principle of purpose limitation, as stipulated in Article 6, item I, of the legal instrument.

Many countries, in addition to offering emergency medical support to people affected by the virus, imposed quarantines and restricted travel and outdoor activities for their citizens. All in order to control and track the spread of the virus, health authorities and other stakeholders – ranging from airlines to companies managing goods and services, for example – collected a large amount of personal data. As a result, concerns about privacy and potential discrimination against those infected began to emerge.

Technology is also being widely used to monitor the progression of the disease and identify infected patients. An example of this is in China, where private companies have contributed to mapping cases of the disease through the use of Big Data. The Chinese competitor to Google in search, the Chinese company... Baidu[The organization] released an epidemic map showing the location of infected people and suspected cases, all in real time so that people can avoid these places. Qihoo 360, China's largest cybersecurity company is offering an app that allows users to check if they were on the same train or plane as someone who contracted the virus. 

In the cities most affected by the virus in China, disinfectant spraying is being carried out using drones in certain areas, public gatherings are being dispersed, and warnings are being issued advising people to wear masks. Similarly, in Moscow, Russia, facial recognition technology is being used to monitor and ensure that infected patients remain in quarantine, allowing authorities to track those who violate it. 

Amid concerns that the mapping of infected or suspected cases of coronavirus infection has caused regarding the protection of personal data of the world's population in the face of the disease, some measures, as we have already seen, have been taken by the authorities. 

In this regard, in addition to the LGPD (Brazilian General Data Protection Law), it is also possible to cite the initiatives of the National Health Commission of China, which issued a notice describing the requirements for the protection of personal data in the context of the prevention and control of the coronavirus. Similarly, the Cyberspace Administration of China (CAC), the main Chinese regulator of cybersecurity and data privacy, issued a…Circular to Ensure Protection and Effective Use of Personal Information and the Use of Big Data to Support Joint Epidemic Prevention and Control Efforts (CAC Circular), to provide detailed guidance on the protection of personal data in the current circumstances.

There is still a long and delicate path ahead regarding the challenges of the indiscriminate collection, use, and sharing of citizens' personal data under the justification of combating the spread of the coronavirus. For the present moment, it is expected that authorities, and private and public entities, both national and international, will begin to consider guidelines for the protection of personal data in their processing of information related to monitoring the coronavirus, ensuring an adequate level of protection for citizens' privacy, even amidst a global epidemic.

In the future, it is expected that the recommendation to adopt best practices for handling personal data when creating technological innovations – such as the creation of technologies – will be adopted. privacy by design...who consider data protection from the product design stage—but even if that is done, the following question remains: what will happen to the gigantic database of personal data collected during the global coronavirus outbreak?