As the European Commission prepares to publish its toolkit on the use of mobile data to fight the COVID-19 pandemic, the European Data Protection Board (EDPB) adopted on Wednesday 15 April its position on the compliance of future applications with privacy rules (see EUROPE 12464/7).
Voluntary and time-limited participation
In its letter, the EDPB - which consists of national authorities and the European Data Protection Supervisor - welcomes the initiative of the European Commission to develop a pan-European and coordinated approach.
The Board stresses, however, that the development of applications must be carried out in a responsible manner, based on an assessment of the impact on data protection of all confidentiality by design and by default mechanisms. The EDPB also stresses that the source code should be made public so that it can be evaluated as widely as possible by the scientific community. It also supports the Commission’s proposal for the voluntary adoption of these applications, a choice that should be made by individuals as a sign of collective responsibility.
On the specific issue of traceability, the Board, which will issue guidance on the issue next week, stresses that the purpose of geolocation applications is not to know the exact location of individuals, but to know whether they have been in contact with infected individuals. On the issue of data storage, the EDPB stresses that both on-device storage and centralised storage are valid provided that adequate security measures and controllers are in place.
Finally, the Board supports the Commission’s approach that these emergency systems should not be maintained once the crisis is over, while the data collected should be “erased or anonymised”.
The European Toolkit presented on 16 April
Looking back to 8 April, the European Commission issued a recommendation to develop a toolkit on the use of mobile data during the pandemic.
This recommendation will be followed on 16 April by the publication of two documents: - first, the toolbox, which will include, among other things, specifications to ensure the effectiveness of these applications from a medical and technical point of view, support for the interoperability of applications, governance mechanisms for public health authorities and data sharing mechanisms; - second, guidance on data protection and privacy implications.
In its roadmap on lifting the containment measures (see EUROPE 12467/2), the Commission recalls the usefulness of the data: “Social and mobile network operators can offer a multitude of data on mobility, social interactions, as well as voluntary reports of moderate cases and/or indirect early signals of disease spread”.
See the recommendation: https://bit.ly/2V9BJLB and the EDPB position: https://bit.ly/2VaueUV (Original version in French by Sophie Petitjean)