DPA case 07120-1/2020/278 – Violation Found (Slovenia, 2020)

The IP received a request to issue an opinion regarding tracking individuals with a telephone application to ensure that infected individuals do not move outside their residences. The request concerned in particular the right to privacy and data protection. The proposal for the telephone application was made by a health care professional. The IP opined that such an app should fulfill certain requirements. It found that the description of the technology does not explain: - what kind of technology is going to be used (location tracking via base stations, GPS, WiFi, etc.), - the data to be processed, - whether the app would allow the individual to exchange messages or just to track their location, - the purpose of the application (to check whether an individual is taking isolation measures or to communicate with healthcare professionals). The IP stressed that a DPIA must be carried out first and that attention must be paid in particular to the transparency of the personal data that is to be processed, the purposes of the processing, the place and duration of storage, the identification of the controller, the legal basis, manner of deletion. The measure should respect the Constitution of the Republic of Slovenia, the Electronic Communications Act (ZEKom-1), the GDPR and the Data Protection Act (ZVOP-1). The principles of Article 5 of the GDPR must be followed and attention must be paid to the principles of necessity and proportionality. Safeguards for the rights of individuals before drafting the legal basis must also be implemented. The IP concluded that an assessment of the effectiveness of such a measure to achieve the objectives of epidemic containment is also necessary and that an epidemic should not be a reason to nullify constitutional principles.