Contact tracing in the company: this is the Privacy Guarantor

The Privacy Guarantor has recently published two important notes to the FAQ relating to the processing of personal data on the Covid-19 theme. The specifications added by the Authority are related to the case of contact tracing, an instrument that can have its importance also and above all in the company. In fact, it should be remembered that many of the main outbreaks that emerged during this summer are born precisely in the company environment, therefore tracing tools can be important to reach an easier identification of potential contacts, potential contagions and main danger centers.

Covid and contact tracing in the company: the Guarantor FAQ

Point 9 of the Guarantor FAQ: “Can applications with contact tracing functions be used in the company? ”The discussion (attention!) Is not related in this case to Immuni, a national contact tracing app (download Immuni here) and on which the Guarantor has already expressed himself (in favor) with an ad hoc analytical intervention. In this case, the reference is instead directed more specifically to other tracking solutions, for which the authority intends to identify basic principles to be followed in terms of data processing:

The contact tracing functionality, provided from some applications to the declared purpose of being able to reconstruct, in the event of contagion, the significant contacts had in a period of time commensurate with that identified by the health authorities in order to reconstruct the chain of contagions and alert people who have come into close contact with subjects tested positive, is - at present - governed solely by art. 6, legislative decree 30.4.2020, n. 28.

in Short, any activity of contact tracing must respond to the same Chapter II, “ urgent Measures for the introduction of the warning system Covid-19 ” of the Law Decree April 30, 2020 no.28 which provides “ urgent Measures for the functionality of the systems of interception of conversations and communications, more urgent measures in the field of penitentiary system, as well as supplementary provisions and coordination in the area of civil justice, administrative and accounting procedures and urgent measures for the introduction of the warning system Covid-19 “. In short: no geolocation support, you to the anonymization, the proportionality of the data collected and the limited duration of the treatment of the data .

The 10 Point poses a further question: “ in order to contain the risk of contagion in the workplace are available for applications that do not process personal data? “. In this sense, the Garante's opinion is favorable, because the very instruments of this type to interpret the law in a restrictive way, canceling the collected data and simply report the immanence of a condition of potential danger:

Yes, the employer can resort to the use of applications to the state available on the market, which do not involve the processing of personal data referring to identified or identifiable subjects. What if the device used is not associated, or associable, directly or indirectly (e.g. through a code or other information), to the person concerned, nor provide for the recording of the data processed.

think of the applications that perform the count of the number of people entering and leaving from a certain place, triggering a “red light” at the end of the pre-set number of people at the same time present; or to functions of certain wearable devices that emit an audible warning or a vibration in case of exceeding the threshold distance physical pre-set (without track the wearer of the device, and without recording any information). Think, also, to applications connected to the turnstiles of the entrance that, through a detector of images, allow access only to people wearing a mask (without recording any image or other information). In these cases, it is for the owner to verify the degree of reliability of the systems of choice, by providing for measures to be taken in the event of a malfunction of the devices or of false positive or negative.

the case of the important directions in view of a necessary accountability of the companies in the strategies of containment of the infection . With the arrival of autumn, the role of the workplace will be essential – as are the schools – and the systems of contact tracing could be very useful to quickly reconstruct the supply chain of potential infection in order to limit expansion and reduce the scope of outbreaks. All of this will not only safeguard the worker, but also of the company that – thanks to their virtuous behavior – can avoid any possible closures, or the loss of key professional figures. The intervention of the Guarantor goes in this direction: to provide a basis of interpretation on which companies can develop their strategy of containment and co-operate with the effort put in the field at the national level, both for the regulation of the school environment, as in the observation of the rules of the distancing of society in every public place.