DPA case 07120-1/2020/290 – Order (Slovenia, 2020)

The IP was asked about the compliance of a planned remote monitoring application for patients with SARS-CoV-2 infection confirmed. The patient would give their consent, the app would require their identification, associated diseases and daily report of body temperature, blood pressure, blood oxygen saturation, heart rate, blood sugar and other symptoms. The app would alert the patient in case of discrepancies and their data would be available to healthcare staff who could contact the patient. The Ministry of Health would decide on mandatory quarantine and notify the patient and if the patient gave their consent to the location monitoring, the application would also monitor its movement and deviations from the permitted message to the patient and medical staff. The IP advised that first and foremost a DPIA is mandatory, which would describe clearly the technical parameters in the light of the purpose pursued and the principle of proportionality. The IP drew also attention to the principle of transparency. It found that the proposed app would most likely require an adequate legal basis in the national law. It strongly recommended the Slovenian legislator take specific measures about such apps, following the development at EU level and coordinating with other member states.