Here's the hypothetical scenario, which in some countries might not be hypothetical after all:
- The app. Because of Covid-19, the government decides that some citizens must install an app on their smartphones to track the spread of the virus. It might not really be mandatory for everybody, however there will certainly be some citizens that will be required to have the app installed on their phones.
- The security. The app relies on bluetooth connections to be able to detect another person when a citizen is close to them. A lot of people own smartphones that are insecure because they are not up-to-date. In many cases they cannot even be updated because the vendor doesn't release the security patches on time, or the vendor only provides support for a few months after the purchase. Bluetooth is known to have had vulnerabilities in the past, and the latest one was fixed a couple of months ago. Examples: December 2017, billions of devices imperiled by new clickless bluetooth attack, and February 2020, Google fixes no-user-interaction bug in Android's Bluetooth component. They can be pretty serious, and citing the last article, "if left unpatched, the vulnerability can be exploited without any user interaction and can even be used to create self-spreading Bluetooth worms, experts said." Yes, it is very ironic: an app developed to control the spread of a biological virus might lead to the spread of a software virus, by proximity! Very ironic.
- The precautions. The goverment and the app developers take no precautions to avoid the above-mentioned risks. The app will install and run without any warnings if the device is not up-to-date. The government doesn't warn the citizens that such application must only be installed if the device is up-to-date, and doesn't require citizens to buy a new smartphone if the current one cannot be considered secure. So unless a citizen is particularly tech-savvy, they won't have a clue they are exposing their personal data to a risk when they turn bluetooth on. On the other hand, a lot of people are clueless anyway and probably already have bluetooth on right now.
The question is: is this legal? I'm not sure how much the GDPR is relevant here, because the app might not process much personal data. These kinds of apps might just exchange pseudonymous IDs, and might not record much data other than that. However the app will be installed in a system that is full of personal data (the smartphone), even sensitive personal data (think of emails, messages, social media), so it definitely has an impact on the overall security.
Jurisdictions: EU (but I'm also curious about the US, for comparison).