The current European and Italian approach in the context of “phase 2” of the COVID-19 crisis

Most European member states are taking steps to deal with the so-called “phase 2” of the COVID-19 crisis and, to this aim, they are converging towards the use of effective contact-tracing app solutions to support public health authorities, understand the spread of the disease and exit from the crisis. In this context, on April 16, 2020, the European Commission issued its Guidance to support member state governments and app developers in the implementation of apps to fight the COVID-19 pandemic (“Guidance”, see here for more information). The Guidance included the wider contribution made by the Recommendation on a common Union toolbox for the use of technology and data to combat and exit from the COVID-19 crisis, issued by the European Commission on April 8, 2020. This Recommendation stressed the importance of adopting a common approach and parameters throughout Europe for the use of mobile applications. At the same time, the Guidance followed the eHealth Network's study, issued, on the same matter, on April 15, 2020, and providing a more technical approach to the issue.

What about Italy? With specific respect to the matter at issue, on April 8, 2020, the Italian Parliament’s Transport Commission held hearings, which included that of the President of the Italian Data Protection Authority, Antonello Soro, on the use of new technologies and the Internet to fight the COVID-19 epidemiological emergency. The comments made at the hearings confirmed the approach adopted by the European Commission with the abovementioned Guidance, in particular concerning mobile applications and the use of anonymized mobility data (see here for more information).

Given that the widespread adoption of data-driven solutions (such as contact-tracing applications) by public and private actors could lead to significant privacy concerns, on April 21, 2020, the European Data Protection Board (“EDPB”), in the last of a series of interventions aimed at clarifying the use of personal data in the context of the emergency COVID-19, issued its Guidelines on the use of location data and contact-tracing tools in the context of the COVID-19 outbreak (“Guidelines”) to develop a common European approach capable of gaining citizens’ trust. The EDPB generally considers that contact-tracing applications should be used to empower, rather than to control, stigmatize, or repress individuals, and aims at clarifying the conditions and principles for the proportionate use of location data and contact-tracing tools.

The main takeaways from the EDPB’s Guidelines

1. Location data. The EDPB reiterates that, for the processing of location data collected by electronic communication service providers and by information society service providers’ applications, the provisions of Directive 2002/58/EC (e-privacy Directive) shall apply. Nonetheless, public authorities may rely on derogations provided by Article 15 of the e-Privacy Directive, as long as they constitute a necessary, appropriate and proportion measure within a democratic society for certain objectives.
2. Anonymized data. Notwithstanding the above, preference shall be given to the use of anonymized data. In such respect, the EDPB encourages data controllers to adopt transparency policies regarding the anonymization methodology and to monitor the development in the available anonymization solutions, as with respect to location data anonymization may easily be confused with pseudonymization. Indeed, “mobility traces of individuals are inherently highly correlated and unique. Therefore, they can be vulnerable to re-identification attempts under certain circumstances”.
3. Contact-tracing applications – practical guidance. In addition to several clarifications regarding compliance with the data protection legislation (e.g. data controllership, legal basis for the processing, minimization principle, retention of personal data), the EDPB provided some useful operational guidance by recommending that:

• as already clarified in previous statements, the adoption of the app must be voluntary. Therefore, no disadvantage may be suffered by individuals who decide not to use such an app;
• in compliance to the data protection by default principle, proximity data should be used, instead of tracking the location of individuals. In addition, the collected information should reside on the terminal equipment of the user;
• in order to ensure fairness and accountability, algorithms must be subject to audits and should be regularly reviewed by independent experts. In addition, the application’s source code should be made publicly available to allow public scrutiny;
• considering the high risks that such processing activities may imply for the rights and freedoms of the data subjects, a data protection impact assessment pursuant to Article 35 of the GDPR must be carried out;
• data transmitted by the app must only include some unique and pseudonymous identifiers, which must be renewed regularly;
• most recent cryptographic techniques must be implemented in order to ensure that the data collected is safe.

Although stressing that each evaluation must be carried out on a case-by-case basis, the EDPB attached to the Guidelines the Annex “Contact-tracing applications analysis guide”, in order to provide designers and implementers of contact-tracing applications with useful general guidance.

Final remarks

The EDPB stands by and underlines that the use of contact-tracing apps should be voluntary; indeed, people should not have to choose between an efficient response to the crisis and the protection of fundamental rights. It is essential to bear in mind that data and technology can be useful tools to fight COVID-19 but their implementations need a case-by-case assessment and should be operated under the control of the relevant public health authorities. Indeed, the large volume and sensitivity of the data that will be processed require robust privacy and cybersecurity measures to mitigate the risk of security and data breaches, with obvious negative effects on the trust of the public in the use of these emerging data-driven solutions.

Do you have more questions, or do you want to share your thoughts on this article? Contact our Dentons Italy TMT Team at tmtbites.italy@dentons.com, and do not forget to sign up to our TMT Bites Newsletter!

This article has been co-authored Claudio Orlando Miele (Claudio.orlandomiele@dentons.com).