By Mariana Núñez Soto - Student of Law

Due to COVID-19, the world has experienced a dramatic change and a legal unsolved problem, we had to quickly adapt to this new virus that threatens everyone’s lives, and in which been in contact with other human being is dangerous. The law and the processes, from paperwork to trials, have changed, and thanks of the era that we live we could adjust everything from physical to digital. However, some things started to have more importance than others, the access that the Health Minister needed had overpass the “privacy” of someone and everyone, tracing a line between before and after this virus.

SARS-CoV-2 (COVID-19) have affected the free transit, patient medical confidentiality, the violation of the Constitution in the legal systems, and created a disinformation gap. The Continental Law and the Common Law have managed the pandemic situation in a very similar/different way, based on their principles, however they have been affected by the same problem to the same subjects. The controversial subject now days is how the sensitive data have been managed by the governments around the world. But when it comes to public health, and with well bases and justifications, it is considered that the governors can do some “adjustments” (others may consider it “violation”) to the rules. In both legal systems it can be considered that the free transit is being violated, nevertheless, there is a large gap of misinformation about who should and who should not or even can go out and have contact with society

The GDPR applies to the European Union and stablish the rights of been informed, access, ratification, right to be erased, right of data portability, right to opposition and right on decision making of profiling. Another definition and limits that the GDPR gives us about sensitive data is on their 9 article.

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. (European Union, 2018).

The section (i) of this same article explains everything about health data, but with the specific mention that when it comes to public health the Union or the Member State law provides specific measures to safe rights and freedoms of data subject.

But, also, Costa Rica mentions on their Law No. 8968 Protection of the Person Against the Processing of their Personal Data, Article No. 9, section 1, about when the prohibitions of this article are not relevant, being that voluntarily provided this information or that is necessary for the prevention or for medical diagnosis. Section 2, Personal data with restricted access: Restricted access personal data are those that, even forming part of public access records, are not un restricted access because they are of interest only to the owner or to the Public Administration. Its treatment will be allowed only for public purposes or if it has the express consent of the owner. (Asamblea Legislativa, 2011).Both legislations before mention leave us where we started, no individual has the power to keep their health information privately on this pandemic.

To summarize everything that we have analyze, the sensitive data can be considered as personal medical information which has suffered some alterations for the “good” of the public health. Leaving us and both legal systems in a limb and a misinformation gap of how and when to act in a pandemic situation. Even though the European Union with their new GDPR has a greater rich, the restrictions and the greater good still leave the gap to the subject (B) that deserves to know if he/she is been exposed. Because what you can perceive from all these regulations and laws is that your personal data is public when it comes to public health, but it does not protect you completely as an individual, leaving the subject (B) vulnerable. Restrictions such as travel bans, sanitary orders, curfews, among other measures are just band-aid to the great wound (understand great wound as the legal gap). The world has not enough legal tools to fight this. I here present would like to ask all the competent national and international authorities solve the problem to this legal gap for this and upcoming pandemics.


MOXIE es el Canal de ULACIT (, producido por y para los estudiantes universitarios, en alianza con el medio periodístico independiente, con el propósito de brindarles un espacio para generar y difundir sus ideas.  Se llama Moxie - que en inglés urbano significa tener la capacidad de enfrentar las dificultades con inteligencia, audacia y valentía - en honor a nuestros alumnos, cuyo “moxie” los caracteriza.

Bibliographic references:
• Asamblea Legislativa de Costa Rica. (2011). Law No. 8968 Protection of the Person Against the Processing of their Personal Data. San José, Costa Rica.
• European Union. (2018). General Data Protection Regulation (GDPR).