On Wednesday, April 8, 2020, the CNIL's President appeared and was heard before the Law Commission of the French National Assembly about the French Government's work on the use of location-based tracking technologies.
During this hearing, the CNIL's President indicated that the CNIL has been monitoring continuously the various tools and technologies used around the world in connection with the health crisis since mid-March.
She specified that these tools and technologies are used or considered by the States for three categories of purposes:
- Mapping the spread of the virus and predicting the future high-risk areas or otherwise helping authorities predict the future urgent medical needs of individuals;
- Enforcing the measures taken by governments, including containment;
- Implementing contact tracing, i.e. identifying the contacts of potentially exposed people in order to warn them and possibly encourage them to get tested for the virus. To this end, some countries even go so far as to cross-check the location data with other data (data held by customs and immigration services for the purpose of retracing the travel history of persons with suspected infection, etc.) and, in some cases, take individual measures.
The CNIL's President noted that, basically, two techniques may be used in order to achieve these purposes: (i) individual location tracking and (ii) collective location tracking.
She also specified that some States have imposed these tools and technologies on their citizens while others have chosen to implement them on a voluntary basis.
Regarding the use of such tools and technologies in France, the CNIL's President provided, essentially, the following recommendations:
- if individual tracking was implemented, it should first be on a voluntary basis, as a matter of law. The consent of individuals should then be truly free and informed. If a person refuses the use of the app, this should not entail any negative consequences for him or her;
- if a mandatory tracking system for individuals was implemented, then it would require a legislative provision with important safeguards for individuals. In particular, this system should be truly necessary to address the health crisis and proportionate. It could only be implemented for a limited period of time and the data could be retained for no longer than is necessary to manage the health crisis.
In any case, such a system would need to be implemented in a way that is consistent with the principles and safeguards provided by the GDPR. In particular, individuals would need to be given prior and sufficient information regarding the use of their data.
The CNIL's President concluded her hearing by stating that the CNIL would ensure the full effectiveness of its support missions and controls in the event that the public authorities decided to effectively implement such a tracking system.
Useful links
Crise sanitaire : audition de Marie-Laure DENIS, Présidente de la CNIL, devant la commission des lois (in French)
Covid-19 : L'Europe du numérique à l'assaut du virus (in French)
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
