Italy’s data protection agency, Italian Garante, has offered its opinion on a regulatory proposal for the creation of a COVID-19 tracing app.
The proposed contact tracing system does not appear to conflict with the principles of personal data protection in that it:
- Specifies in sufficient detail the type of data collected, guarantees given to the interested parties and the temporary nature of the measure
- Is voluntary
- Is intended for the pursuit of public interest purposes indicated with sufficient certainty and excluding the secondary processing of the data, except for use, anonymously or in aggregate form, for research
- Appears compliant with the principles of minimization and privacy by design and by default, insofar as it provides for the collection of only proximity data of the devices, in pseudonymous form, excluding the use of geolocation data and limiting storage what is strictly necessary
- Admits the further clarification of the detailed characteristics of the treatment and providing methods of human intervention on the algorithmic decision.