Privacy continues to be a concern in the context of the tracing applications debate. After a letter signed earlier this week by 300 concerned researchers, it is now the European Data Protection Board’s (EDPB) turn to publish, on Wednesday 22 April, its guidelines, which warn against any “ratchet effect”.
Guidelines 04/2020 were adopted at the Board’s plenary session the day before, along with guidelines on the processing of health data for research purposes in the context of the COVID-19 outbreak (https://bit.ly/2VR4dJ8 ). They also include a guide for contact tracing applications, which is a non-exhaustive guide intended to provide general guidance to developers and implementers of contact tracing applications.
Voluntary and anonymised data sharing
As it had already stated in a letter to the European Commission, the European Board advocates an approach that is as respectful as possible of privacy (see EUROPE 12467/13). “The EDPB underlines that there should be no choice between an effective response to the current crisis and the protection of our fundamental rights: we can achieve both”, the Board points out. It focuses on two uses: the collection of mobile data to support propagation modelling to assess the overall effectiveness of containment measures and to search for contacts to break the chain of transmission as early as possible.
The document broadly supports the approach of the European Commission (see EUROPE 12468/5). It recalls the general principles of effectiveness, necessity and proportionality as well as the importance of anonymisation. It recommends publishing the source code for greater transparency and calls for impact assessments. Finally, the EDPB stressed that these applications should not be based on the tracking of individual movements, but rather on proximity information about users, and recalled the criteria to be met in order to introduce anonymisation.
Centralised or decentralised storage?
In view of the ongoing debate (notably on whether the storage of such data should be centralised or decentralised), it should be noted that the Board accepts both approaches, while noting at the bottom of the page that “in general, the decentralised solution is more in line with the minimisation principle”.
As far as private initiatives are concerned, several Swiss researchers seem to have distanced themselves from the PEPP-PT partnership to launch a similar project, which they nevertheless consider “more respectful of privacy” and which they have named DP-3T, for Decentralised Privacy-Preserving Proximity Tracing.
It should also be noted that the European Parliamentary Research Service has also published a document on tracing applications, listing the rules in force and the public/private initiatives under development.
See application guidelines: https://bit.ly/2VuzZNj and the parliamentary briefing: https://bit.ly/34VPkJJ (Original version in French by Sophie Petitjean)