- The government is considering setting up a digital tracking system for French citizens, which could potentially use location and health data.
- In this period of global pandemic, the exceptions provided by the GDPR could allow this illegal collection in "normal" times.
- Several European and Asian countries have started this digital tracking in various forms, while France has not yet chosen its option.
Personal data of the French exploited legally? For a little over 24 hours, a new committee of twelve researchers and doctors has been installed by the Elysée. In addition to advising the government on treatments and tests against the coronavirus, it must give its opinion on "the advisability of setting up a digital strategy for identifying people who have been in contact with infected people".
Contacted by 20 Minutes , the State Secretariat in charge of Digital responded that it was not able for the moment to give more details on the contours of this "backtracking", as the Elysée called it. However, France is not the first to address the need for digital tracing, a quick glance at what is done in some countries gives us a little idea.
Lightened protection rules
In Germany, Austria, Italy and Spain, mobile operators have agreed, with the arrival of the coronavirus, to share user location data with the authorities. A possible practice in particular thanks to the telephone line-up, which makes it possible to indicate the presence of a telephone at a given time near a relay antenna. This anonymized data is supposed to help governments to observe whether the population respects confinement or even to map the concentrations and movements of customers in risk areas for example.
Tracing openly accepted by the European Data Protection Board (EDPS). In a press release dated March 19, he said that "the GDPR allows the competent health authorities to process personal data in the context of an epidemic". It is therefore possible to process anonymized information related to the rental of telephones, for example.
Bonus health data analysis
In the case of France, it is not only a question of analyzing flow data. The Elysée think about the opportunity "to identify people in contact with those infected with the Covid-19 virus" using digital technology. "But if we have to know who has been in contact with people carrying the virus, that necessarily implies that we use, in addition to geolocation data, health data", indicates to 20 Minutes Zoé Vilain, lawyer at the bar of Paris and expert in personal data law.
The method is already applied in China where, to circulate in certain places, citizens must present their “medical QR Code” via the Alipay Health Code application. The platform uses user data to assess, via a color code, the risk that an individual is carrying the virus. In Israel, the internal security service has been authorized since March 16 to track for 30 days the geolocation of the phones of infected people.
The exceptions to the GDPR
In France, this practice is far from being unanimous among the defenders of fundamental rights. Health data is protected by the law known as "data processing and freedom" of 1978, which lays down a very strict framework. However, the situation of global pandemic could allow to break down some barriers.
Regarding health data, article 9 of the GDPR prohibits their processing. A second paragraph, however, lists the situations in which this rule does not apply, such as when “processing is necessary for reasons of public interest in the field of public health, such as protection against serious cross-border threats to health. "
"We open the pandora box"
"With the current pandemic, we easily enter these exceptions provided by the RGPD, so it's possible that it will pass," says lawyer Zoé Vilain, who recalls that France is now in a "state of emergency "which restricts fundamental freedoms. And to continue: "The problem is that from the moment we authorize the authorities to look at health data, we open Pandora's box, in the sense that we do not know how they will be used those data. What will be imposed on people who have been in contact with sick people? How long will we keep this data and use it? "
The expert, who is not against analyzing data to fight the pandemic, believes that a crisis context does not justify flouting the fundamental rights of citizens. “Each article of the GDPR clearly specifies that the planned measure must be proportionate to the aim and limited in time. "These regulations remain superior to French law, but possible appeals will take time, explains the lawyer. Zoé Vilain deplores that the scientific committee does not include, for example, a lawyer specializing in fundamental freedoms.
App or not app?
In France, the Secretary of State for Digital, Cédric O, told AFP that "contacts are underway" with "many countries" such as Germany, the United Kingdom or Singapore, which "have undertook to develop digital applications intended to combat the spread of the epidemic ", but that" no more advanced initiative has so far been taken by the government ".
Independently of the decisions of the States, certain entities have already created mobile applications combining the collection of health data and location. The French web agency ITSS has for example launched the CoronApp application, on which users can indicate, with supporting medical evidence, that they are carriers of the coronavirus. If they cross paths with other uncontaminated users, they receive a notification with the date and time when the contact took place, but not the name of the person. Contrary to what is done in China, the app is therefore based on volunteering.
Strasbourg
Coronavirus in the Bas-Rhin: Food businesses will have to close at 8 p.m.
Culture
Coronavirus: “Gestures barriers”, “Whatsappero”… New words to share our troubles
- Health
- Geolocation
- Personal data
- Covid 19
- By the Web
- Coronavirus
- GDPR