The European Data Protection Board weighs in on contact-tracing apps:
Use of the apps should be voluntary.
- The source code should be made public.
- Location of individual users should not be required.
- A strict necessity test should be used to assess what constitutes a “shared event.”
- Local data storage within individuals’ devices is more in line with data minimization.
- The data should be deleted as soon as the crisis is over.
EDPB will publish guidance soon on geolocation and other tracing tools.