Digital contact tracing and data protection: assessing the French and Portuguese applications

Abstract

The rapid outbreak of COVID-19 has necessitated a global response to manage the transmission, spread, and impact of the virus. Many countries started developing digital contact tracing applications to contribute to the process of lifting the restrictions imposed on its citizens. Generally, the protection of personal data is a right that appears in constitutional and legal provisions, and its processing can only be performed under very restricted circumstances, the protection of health being a valid justification. This article focusses on the systems developed as digital contact tracing tools in France (StopCovid) and in Portugal (STAYAWAY COVID), presenting their characteristics and the most relevant aspects concerning the processing of personal data. The most relevant positive characteristics of these systems are their voluntary adoption, their developers’ concern with the people’s security and privacy, and the transparency of their functioning. With the negative characteristics, the most relevant are the restricted interoperability with the systems from other EU countries, and the permanent risk to people’s privacy of collecting lists of contacts and the circumstances of their interactions with other users of the systems.