The European Data Protection Board ('EDPB') has adopted a letter relating to the draft Guidance on apps supporting the fight against the Covid-19 pandemic developed by the European Commission.
The EDPB stressed the concept of accountability in the development of any apps for contact tracing, highlighting the need for the implementation of measures reinforcing privacy by design and by default. In an effort to allow transparency and subsequent scrutiny, the EDPB also stipulated that the source code for any such applications should be made publicly available.
Supporting the Commission's proposal regarding the use of such apps, the EDPB stated that the adoption of the same should be voluntary, noting also that such voluntary use of contact tracing does not equate to the legal ground for the processing of the personal data by public authorities to be that of consent of the data subject. Without pushing for compulsory adoption, the implementation of national legislation promoting the use of such applications could serve as a legal basis for the processing, along with the necessity for the performance of task for public interest where the service is being provided by public authorities based on a mandate laid out in the law.
Of utmost interest, the EDPB highlighted that any applications for contact tracing would not specifically require location tracking as the same would not only present unnecessary risks to security, but also violate the principle of data minimisation. In line with the latter, the EDPB also stipulated that storage of any events ideally would be decentralised.
The EDPB stressed that the implementation of pseudonymisation techniques, algorithms and technical and organisational measures can be crucial to the achieving the balance required between the processing of personal data with the goal of preserving public health and the minimisation of any interferences with the private life of the data subject.
The EDPB's letter can be found here: https://edpb.europa.eu/sites/edpb/files/files/file1/edpbletterecadvisecodiv-appguidance_final.pdf
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
