April 20, 2020

The Commission’s Guidance on data protection and privacy implications complements the its Recommendation on apps for contact tracing, published on 8 April, which sets out the process towards a common EU toolbox for the use of technology and data to combat and exit from the COVID-19 crisis (see items under “Internet”).

In its letter, adopted at its 21^st Plenary Session, the EDPB specifically addresses the use of apps for the contact tracing and warning functionality, because it says ‘this is where increased attention must be paid in order to minimise interferences with private life while still allowing data processing with the goal of preserving public health”. The EDPB considers that the development of the apps should be made “in an accountable way”, documenting with a data protection impact assessment all the implemented privacy by design and privacy by default mechanisms. In addition, the source code should be made publicly available “for the widest possible scrutiny by the scientific community”.

The EDPB strongly supports the Commission’s proposal for the voluntary adoption of such apps, a choice that should be made by individuals as “a token of collective responsibility”.

Finally, the EDPB underlines the need for the Board and its Members, in charge of advising and ensuring the correct application of the GDPR and the E-Privacy Directive, to be fully involved in the whole process of elaboration and implementation of these measures. The EDPB intends to publish Guidelines in the upcoming days on geolocation and tracing tools in the context of the COVID-19 outbreak. To read the EDPB’s press release in full and for a link to the letter, click here.