The European Data Protection Board weighs in on contact-tracing apps:

Use of the apps should be voluntary.

  • The source code should be made public.
  • Location of individual users should not be required.
  • A strict necessity test should be used to assess what constitutes a “shared event.”
  • Local data storage within individuals’ devices is more in line with data minimization.
  • The data should be deleted as soon as the crisis is over.

EDPB will publish guidance soon on geolocation and other tracing tools.

Read my client alert for a detailed analysis.