The European Commission published on Thursday 16 April a toolkit listing a set of requirements for mobile applications to fight the coronavirus pandemic and guidance on how these applications should respect privacy.
These documents provide in particular that contact tracing and alert applications should be voluntary, interoperable and validated by public health authorities. “In these documents, we also make it clear that geolocation data is not necessary and should not be used for this purpose”, a European Commission spokesperson told the press. The toolbox seems to be less clear about this.
A concept that’s on the rise
While Singapore was one of the first countries to use it, mobile tracking or warning applications have since multiplied around the world. The toolbox lists some 15 applications developed or under development by public authorities in the EU. It also refers to this private partnership of 130 researchers called PEPP-PT for Pan-European Privacy Preserving Proximity Tracing (see EUROPE 12459/4) and to the joint initiative launched by Google and Apple.
All these projects are based on the principle, also shared by the European Commission, that contact tracing applications can play a key role at each stage of crisis management, in particular in the gradual lifting of social distancing measures.
Follow-up to the 8 April recommendation
The toolkit and guidelines are a follow-up to the recommendation issued by the European Commission on 8 April on the use of data and technologies to combat and recover from the COVID-19 pandemic (see EUROPE 12464/7) and the opinion of the European Data Protection Board (see EUROPE 12467/13).
“We want to make sure that all applications comply with the strict EU data protection rules, that all applications are secure and efficient. Because these applications can only show their full potential if many people use them. This is why we want to provide Europeans with applications that they trust and will therefore use”, said the Commission spokesman.
This was the message conveyed by Internal Market Commissioner Thierry Breton on Wednesday 15 April during his discussion with the heads of Google and YouTube.
EU-wide minimum standards
The toolkit, of around 50 pages, was developed urgently by Member States (in the framework of the ‘eHealth Network’) with the support of the European Commission. In particular, it states that contact tracing and alert applications must be interoperable and implemented in close coordination with and approved by public health authorities. Applications must be installed on a voluntary basis and be based on anonymised data.
As for the technology to be used, the document recommends exploiting the latest technological solutions for protecting privacy. “These applications, which will probably be based on Bluetooth technology, do not allow the geolocation of people”, notes the press release.
The toolbox follows the timetable set out in the Recommendation, namely an evaluation of the effectiveness of the applications by public health authorities by 30 April, a compilation by Member States of the measures taken by 31 May and a periodic evaluation by the Commission from June onwards and throughout the crisis. This is in the knowledge that the Commission’s assessment could recommend adopting or phasing measures that no longer appear to be necessary.
Parliament makes its voice heard
The development of tracing and warning applications is also of great concern to MEPs, who included the issue in their resolution on coordinated EU action to combat the pandemic, put to the vote on 16-17 April (see EUROPE 12468/2).
In particular, the draft text calls for maximum transparency regarding the operation of these applications, “so that citizens can check the underlying security and privacy protocol and monitor the code to determine whether the application works as claimed by the authorities”.
An amendment tabled by the EPP group, which was rejected at the end of the day, also proposed setting up a European Data Centre to allow for comparisons and the use of artificial intelligence solutions to speed up the search for treatments and medicines.
Finally, it should be noted that the Renew Europe group will organise a video conference on the subject next week and, according to our information, will argue for the organisation of a plenary debate in May.
See the presentation of the toolbox: https://bit.ly/2z79zbN and the Commission guidelines: https://bit.ly/2RHCSbg (Original version in French by Sophie Petitjean, with the help of Damien Genicot)