Wastewater surveillance of coronavirus SARS-CoV-2 and the GDPR

Abbreviations

1. Introduction
1.1 Rationale
1.2 Problem statement
1.3 Objective
1.4 Research questions
1.5 Definitions
1.6 Research methodology
1.7 Reading guide

2. Principles for the applicability of the GDPR
2.1 Introduction
2.2 Privacy and the protection of personal data
2.3 Scope of the GDPR
2.4 Personal data under the GDPR
2.5 Sensitive personal data under the GDPR
2.5.1 Introduction
2.5.2 Data concerning health
2.5.3 Biometric data
2.5.4 Genetic data
2.6 Identifiability of persons
2.6.1 Introduction
2.6.2 Direct and indirect identifying data
2.6.3 When is a natural person identifiable?
2.6.4 Similarities and differences between IP addresses and DNA profiles
2.7 Processing under the GDPR
2.8 Interim conclusion

3. Wastewater surveillance in the Netherlands
3.1 Introduction
3.2 The history of wastewater surveillance
3.3 How the coronavirus gets into wastewater
3.4 Collection of sewage samples
3.5 Examination of wastewater samples
3.5.1 Introduction
3.5.2 Examining sewage samples by PCR
3.5.3 Examining wastewater samples by sequencing
3.5.4 Identification of persons through wastewater surveillance
3.5.4.1 Introduction
3.5.4.2 Direct identification of persons through wastewater surveillance
3.5.4.3 Indirect identification of persons through wastewater surveillance
3.5.4.4 Reverse identification of persons through wastewater surveillance
3.5.4.5 Other information on persons
3.5.4.6 Interim conclusion
3.6 How the Dutch government plans to expand wastewater surveillance in the future
3.7 How new technologies will change wastewater surveillance
3.7.1 Introduction
3.7.2 Next Generation Sequencing
3.7.3 Realtime and Rapid DNA
3.7.4 Sewage sampling robots
3.7.5 Research using a unique combination of bacteria and viruses
3.8 Interim conclusion

4. Wastewater surveillance in relation to GDPR
4.1 Introduction
4.2 Organisations in the Netherlands involved in combating SARS-CoV-2
4.2.1 Introduction
4.2.2 Ministry of Health, Welfare and Sport
4.2.3 National Institute of Public Health and the Environment
4.2.4 GGDs
4.2.5 Water boards
4.3 Wastewater research data and potential GDPR controllers
4.4 Datasets present at potential controllers
4.4.1 Introduction
4.4.2 Datasets present at RIVM
4.4.3 Datasets present at GGDs
4.5 Direct identifiability of wastewater survey data
4.6 Indirect identifiability of wastewater survey data
4.7 Parameters for possible indirect identifiability
4.7.1 Introduction
4.7.2 Number of sites
4.7.3 Population size
4.7.4 Frequency and scope of corona testing
4.7.5 Prevalence of COVID-19
4.7.6 Travel movements
4.7.7 Vaccination coverage and vaccination effectiveness
4.7.8 Frequency of wastewater measurements
4.7.9 Turnaround time of a wastewater measurement
4.7.10 Number and size of datasets
4.8 Shifting parameters during the course of the pandemic
4.8.1 Introduction
4.8.2 Development of the number of sites
4.8.3 Evolution of population size
4.8.5 Development of the prevalence of COVID-19
4.8.6 Development of vaccination coverage and vaccination effectiveness
4.8.7 Development of travel movements
4.8.8 Development of frequency of wastewater measurements
4.8.9 Development of wastewater measurement lead time
4.8.10 Development of dataset size
4.8.11 Shifting parameters from start of corona pandemic to end September 2021
4.9 Wastewater survey data and possible indirect identification
4.9.1 Introduction
4.9.2 Potential indirect identification by the RIVM
4.9.3 Potential indirect identification by GGDs
4.9.4 How indirect identification by GGDs and RIVM could take place
4.9.5 Interim conclusion
4.10 Specific conditions at Schiphol, Schiermonnikoog and Vlieland
4.10.1 Introduction
4.10.2 Situation at Schiphol
4.10.3 Situation on Schiermonnikoog
4.10.4 Situation on Vlieland
4.11 Identifiability on Schiermonnikoog and Vlieland
4.11.1 Introduction
4.11.2 Identifiability on Schiermonnikoog and Vlieland by GGD Fryslân
4.11.3 Identifiability on Schiermonnikoog and Vlieland by RIVM
4.11.4 Interim conclusion
4.12 Do RIVM and GGD Fryslân process wastewater research-related personal data?
4.13 What kind of wastewater surveillance-related personal data is processed?
4.14 Future wastewater developments and the GDPR
4.14.1 Introduction
4.14.2 GDPR and expansion the of scope of wastewater surveillance
4.14.3 The GDPR and Next Generation Sequencing and Rapid DNA
4.14.4 The GDPR and wastewater sampling robots
4.14.5 The GDPR and research using a unique combination of bacteria and viruses
4.15 Interim conclusion

5. Conclusion and recommendations
5.1 Introduction
5.2 Conclusion
5.3 Recommendations

Bibliography
Laws and regulations
Parliamentary papers