Privacy Guarantor: new FAQs on contact tracing

Contact tracing is a completely new matter and as such it requires planning, interpretation, correction and understanding which - due to the emergency context in which everything was carried out - were developed on an ongoing basis. In the last few hours, a series of FAQs has been added to this work, signed by the Privacy Guarantor in relation both to the national app (Immuni) and to other regional apps designed for the reconstruction of contacts and the implementation of the relative contagion containment strategies.

The opinion of the Privacy Guarantor on Immuni has already been widely enlightened in recent weeks, when the Authority had given its approval while recommending maximum attention. In the last few days Antonello Soro had also returned to Immuni, once again applauding the work carried out:

in an emergency time it is also possible to use technology to limit rights but its use must be proportionate and in the long term, both the Italian Constitution and the European Regulation say so. Let's talk about democratic sustainability. It seems to me that we have succeeded

According to Soro the issue is important because it also opens up new fronts: if in emergency an action was taken with the tools available, for the future the country must work so as not to submit to other people's controls, but instead take the situation in hand in order to manage with maximum guarantees privacy, communications and data. Having full awareness of this, and thinking about future concertation tables on which to build the country's digital future, is what today authorizes a praise for what has been put in place. Space to dissent about the opportunity or not to download Immuni, in short, provided that it is informed dissent:

it Is legitimate to express critical opinions, but must be the result of detailed knowledge of the topic and on the basis of specific arguments. In a difficult time like this food distrust, and to respond to the moods negative is not needed, especially for those who have a responsibility to the Country, and this also applies to the world of information. My appeal is not to give summary judgements out of context and unfounded

Immune, and contact tracing: the FAQ of the Guarantor of Privacy

The FAQ's are designed first and foremost to confirm a perimeter which is already widely drawn around the limits of contact tracing and telemedicine, so that no one will leave to the abuse of a tool that is designed for a specific purpose, developed for the same purposes, and that in any other context would not be legitimate nor proportionate. With a principle on all of you to do it from the substrate to the principle of Immune: the app must be installed on a voluntary basis and shall not be binding elements or coercive measures that limit people's freedom on the basis of the installation of the app. The same thing goes for the app's regional or any other app that intends to pursue the same purposes.

Soro in its previous analysis has hinted as too often, the emergency may have led to situations in which the oxen had now escaped from the fence, but in this phase of apparent calm is necessary to bring each situation into the scope of legality: the contact tracing has to assert itself for as it was intended, without distortion or strain. Immune in this case, it is an ideal model for the limits imposed, the proportionality of the processing and the absence of geolocation.

in the FAQ are repeated concepts for granted, such as:

it is not compulsory to install this app (“ The accession to the alert system should in fact be the result of a choice really-free part of the person concerned who must be adequately informed and must be able to trust in the transparency of the treatment. The voluntariness of the membership of the person concerned is insured at every stage of the treatment carried out by the Ministry of health “); the non-installation must not cause restrictions of freedom (“ failure to install The App, even if it deprives the person concerned of the possibility to receive automatic alerts about possible contacts at risk, does not determine negative consequences, nor can it represent the condition for the exercise of the rights or to use certain services or goods “) no region can force the installation of an app (“ the national standard has introduced the Alert system Covid, through the tracking digital of contacts, has established that people cannot be forced to install the App and that the failure to install may not involve any prejudicial consequence for the interested parties, or affect the exercise of fundamental rights “) of Any tracking app it must in any case comply with the proportionality of the processing, and never has the founding principle that the Guarantor shall precede any other consideration:

The App should process only the data strictly necessary to achieve the purposes of treatment, avoiding to collect data in excess (e.g. relative to the location of the mobile device of the user) and limited to obtain permission for access to features or information present on the device, only if necessary. In the context of related impact assessments will also be necessary to carefully evaluate, among other things, the legality and the risks arising from the possible transfer of data to third parties (e.g. social login, push notifications, etc), especially if established outside the European Union