1

Here's the hypothetical scenario, which in some countries might not be hypothetical after all:

  • The app. Because of Covid-19, the government decides that some citizens must install an app on their smartphones to track the spread of the virus. It might not really be mandatory for everybody, however there will certainly be some citizens that will be required to have the app installed on their phones.
  • The security. The app relies on bluetooth connections to be able to detect another person when a citizen is close to them. A lot of people own smartphones that are insecure because they are not up-to-date. In many cases they cannot even be updated because the vendor doesn't release the security patches on time, or the vendor only provides support for a few months after the purchase. Bluetooth is known to have had vulnerabilities in the past, and the latest one was fixed a couple of months ago. Examples: December 2017, billions of devices imperiled by new clickless bluetooth attack, and February 2020, Google fixes no-user-interaction bug in Android's Bluetooth component. They can be pretty serious, and citing the last article, "if left unpatched, the vulnerability can be exploited without any user interaction and can even be used to create self-spreading Bluetooth worms, experts said." Yes, it is very ironic: an app developed to control the spread of a biological virus might lead to the spread of a software virus, by proximity! Very ironic.
  • The precautions. The goverment and the app developers take no precautions to avoid the above-mentioned risks. The app will install and run without any warnings if the device is not up-to-date. The government doesn't warn the citizens that such application must only be installed if the device is up-to-date, and doesn't require citizens to buy a new smartphone if the current one cannot be considered secure. So unless a citizen is particularly tech-savvy, they won't have a clue they are exposing their personal data to a risk when they turn bluetooth on. On the other hand, a lot of people are clueless anyway and probably already have bluetooth on right now.

The question is: is this legal? I'm not sure how much the GDPR is relevant here, because the app might not process much personal data. These kinds of apps might just exchange pseudonymous IDs, and might not record much data other than that. However the app will be installed in a system that is full of personal data (the smartphone), even sensitive personal data (think of emails, messages, social media), so it definitely has an impact on the overall security.

Jurisdictions: EU (but I'm also curious about the US, for comparison).

Improve this question
6
  • 5
    Your stated premise is that some people will be forced to install an app. In an EU legal context this is exceedingly unlikely as such requirements would clash with fundamental rights and freedoms – and would be pretty ineffective. Since the premise is so unlikely I'm not sure whether the rest is worth discussing. GDPR would definitely apply, but would either forbid this processing (special categories of data per Art 9) or require appropriate safety measures (e.g. compare Art 25 “data protection by design and by default”).
    – amon
    Apr 21, 2020 at 14:49
  • 1
    How does an app track the spread of a virus? It seems you would still need a test, the user would have to input the test data into the app, which requires voluntary disclosure. Most states/countries track test results directly, so I'm wondering what the app is for?
    – Ron Beyer
    Apr 21, 2020 at 16:57
  • @RonBeyer If person A is discovered to be infected, then you trace persons B, C, D etc with whom A came into contact and test them (contact tracing). If they are infected, you then trace the people who they came into contact with and test them. And so on. The mobile phone app with locational data would also facilitate investigators to discover where the person had been. And facilitate discovery of what locations in common they had. E.g. there were lots of infected at a sports event. Then you might consider contacting everyone who attended or worked at the event.
    – Lag
    Apr 21, 2020 at 17:14
  • 2
    The proposed Apple/Google app would anonymously track proximity history so that if someone tested positive the people they had been in proximity to (in the last 14 days) can be automatically notified. No information goes to any authority, only to those with proximity history so they can take whatever action they choose.
    – George White
    Apr 21, 2020 at 17:16
  • Some other concerns summarised in this thread: twitter.com/Tom___Scott/status/1256978338033422338
    – Lag
    May 7, 2020 at 12:15

1 Answer 1

Reset to default
2

If and when some sort of contract tracing app becomes a key public health tool and is made mandatory in an EU member state, it would almost certainly be through some ad hoc law, possibly using emergency powers that parliaments have granted to the executive in several countries. That would set aside most existing legal hurdles and makes it difficult to think about the legality of such an app in advance.

Of course, even a very broad national mandate would still formally need to comply with EU law and possibly be open to some constitutional or ECHR challenge. But it's difficult to see how these could be invoked based on a theoretical impact on a limited number of phones. It should also be possible to dispose of many human rights objections with a proportionality argument and I suspect most courts would be happy to accept it.

Interestingly, article 23(1)(e) of the GDPR empowers national governments to set aside many obligations in the name of, inter alia, public health so the possibility to redefine what's legal or not at the national level is baked in. These restrictions are not absolute however and, in particular, do not cover articles 24, 25, 32 and 33 (which all have to do with data protection and security). Several governments could also seek some changes or a temporary regime at the EU level, as they are currently trying regarding Regulation 261/2004 on flight compensation.

Improve this answer
1
  • 1
    Just to add that Article 15 of the ECHR provides for derogation from the ECHR in time of "war or other public emergency threatening the life of the nation"
    – Lag
    May 6, 2020 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.