Cnil gives green light to StopCovid contact tracking application

The Cnil considers that the StopCovid application respects the various legislative provisions relating to the protection of privacy. However, it recommends some adjustments so that users are fully informed of its operation. The application has yet to be validated by Parliament.

The Cnil gave the green light Tuesday to the establishment of StopCovid, the application of tracking of contacts for smartphones wanted by the government to fight against the epidemic of the coronavirus . In an official notice published Tuesday, the CNIL believes that the application respects the various legislative provisions relating to the protection of privacy, and makes some recommendations for the implementation of the system.

France's StopCovid app: What is it, how it works and why privacy ...

The Cnil generally satisfied

The StopCovid application , based solely on volunteering , will allow a user to keep track of other crossed users during the last two weeks (within 1 meter, for at least 15 minutes). If this user discovers that he is a carrier of the coronavirus, he can warn people crossed, by notifying the application of his contamination. StopCovid arouses the fears of many defenders of privacy, who fear that it marks a first step towards a surveillance society where our actions are constantly watched by automatic systems.

But in its opinion, the CNIL – which had already given a green light in principle on April 24 – notes that the developers of the application have erected a number of safeguards to prevent drifts. “The main recommendations of the CNIL have been followed. They concern in particular the responsibility for treatment entrusted to the ministry in charge of health policy, the absence of any negative legal consequence attached to the choice not to use the application, or even the implementation of certain technical security measures “, indicates the digital policeman.

But with some reservations

The Cnil nevertheless makes a few observations to further strengthen the protection of the privacy of individuals. Firstly, it claims that “the duration of implementation (of StopCovid) must be conditional on the results of a regular evaluation of the system”. In other words, once the application is no longer useful, you will have to deactivate it and permanently delete the data.

The Cnil also wants an “improvement in the information provided to users, in particular with regard to the conditions of use of the application and the procedures for erasing personal data”. Likewise, it requests “specific information for minors and parents of minors”, and confirmation in the forthcoming decree on the application “of a right of opposition and a right to erasure of data pseudonymized saved “.