Author: Sarah Cannataci, Associate

15th April 2020

The European Data Protection Board (‘EDPB’) has adopted a letter relating to the draft Guidance on apps supporting the fight against the Covid-19 pandemic developed by the European Commission.

The EDPB stressed the concept of accountability in the development of any apps for contact tracing, highlighting the need for the implementation of measures reinforcing privacy by design and by default. In an effort to allow transparency and subsequent scrutiny, the EDPB also stipulated that the source code for any such applications should be made publicly available.

Supporting the Commission’s proposal regarding the use of such apps, the EDPB stated that the adoption of the same should be voluntary, noting also that such voluntary use of contact tracing does not equate to the legal ground for the processing of the personal data by public authorities to be that of consent of the data subject. Without pushing for compulsory adoption, the implementation of national legislation promoting the use of such applications could serve as a legal basis for the processing, along with the necessity for the performance of task for public interest where the service is being provided by public authorities  based on a mandate laid out in the law.

Of utmost interest, the EDPB highlighted that any applications for contact tracing would not specifically require location tracking as the same would not only present unnecessary risks to security, but also violate the principle of data minimisation. In line with the latter, the EDPB also stipulated that storage of any events ideally would be decentralised.

The EDPB stressed that the implementation of pseudonymisation techniques, algorithms and technical and organisational measures can be crucial to the achieving the balance required between the processing of personal data with the goal of preserving public health and the minimisation of any interferences with the private life of the data subject.

The EDPB’s letter can be found here: https://edpb.europa.eu/sites/edpb/files/files/file1/edpbletterecadvisecodiv-appguidance_final.pdf

Should you require any further information or assistance on the matter, please do not hesitate to reach out to us personally on antonio.ghio@fenlex.com and sarah.cannataci@fenlex.com.

©Fenech & Fenech Advocates 2020

Disclaimer │ The information provided on this Update does not, and is not intended to, constitute legal advice. All information, content, and materials available are for general informational purposes only.  This Update may not constitute the most up-to-date legal or other information and you are advised to seek updated advice