The National Data Protection Commission (CNPD) argues that the digital Stayaway application should be subject to a localized test before it can be made available to the general population.
“CNPD recognizes that conducting a pilot test, in which the application is only available to a specific and restricted group of users, can be beneficial for the identification and correction of security flaws”, can be read in the opinion released on Monday -market.
The Commission therefore points out that it agrees with the opinion of the data protection officer who recommended “conducting a pilot test in real conditions, limited to a part of the national territory, before its broader and unrestricted availability”.
On the other hand, CNPD also warns that it is necessary to regulate the doctor's intervention in the process, as it will be this specialist who will insert in the database the information that a certain patient is infected with Covid-19.
“In fact, considering the relevance, for the reliability of the information system of this medical intervention, its prediction and regulation at the legal level seems essential, not only to legitimize it, but above all to ensure that it occurs, under penalty of being in the availability of the physician, the functioning of the notification system ”, can be read in the opinion.
In its analysis, CNPD also shows its concern about the use of the Google-Apple exposure notification system (GAEN), a joint project of the two companies to “enable the operation of applications for proximity tracking via Bluetooth”. This agreement states that “only public health authorities can use this system”, with only one license allowed per country.
The Commission therefore points out that one of the “issues that raises the most reservations is related to the fact that the GAEN system can be changed, in an uncertain sense, by a unilateral decision of those companies, which could put the interface's behavior in crisis, with possible consequences negative effects for the application and users ”.
"In the case of companies that already have large repositories of information and provide very varied services globally, there remains a reasonable doubt about the possible benefit (current or future) that may be taken from the availability of this platform for the tracking of contacts from proximity, through a technology that is in the ascending phase of use and that can constitute, for all purposes, a supplementary means, perhaps more granular, to the existing location methods ”, according to the document.
CNPD concludes that, “if the data processed in the context of this type of applications are in any way used for other purposes, the guarantees of the system are compromised, first of all because the pseudonymization is impaired and the risk of users' identifiability is much greater. It is admitted, however, that this is a difficult issue to overcome, and that it only accentuates the need for users to make informed choices ”.