DPA case Délibération 2020-056 – Violation Found (France, 2020)

The French government was considering to implement an application called "StopCovid" in the context of the fight against COVID-19, and more particularly, the progressive "lockdown exit strategy". The "StopCovid" app is a contact tracing app whose objective is to alert the users that they have been in close proximity with other people that have been diagnosed or tested positive to COVID-19 and use the same app. It aims to achieve faster information and alert of contacts who have been exposed to COVID-19 even if they are not aware of it. The use of the app is voluntary and the contact tracing is achieved through the use of bluetooth instead of geolocation technology. The data is pseudonymised and no database of infected people is created. Following CNIL's opinion on the general compliance of the app with GDPR and the national law on 24 April 2020, the Ministry of Solidarity and Health urgently requested the Commission to deliver an opinion on the Draft Decree relating to "StopCovid" app and examine the specific conditions for its implementation. CNIL acknowledged the necessity, the usefulness and the proportionality of the “StopCovid” app. Although it recognised that the proposed app contributes to faster information and alert of contact cases, it stressed that its impact should be assessed regularly during its operation in order to ensure its usefulness. Furthermore, it held that “StopCovid” is proportionate as the rights to privacy and protection of personal data will be affected only for the strictly necessary time and substantial safeguards have been guaranteed. In that context, CNIL welcomed among others the precise determination of the purposes of the processing and the fact that the Ministry of Solidarity and Health will undertake the data controllership. The Commission also embraced the decision of the government not to attach any adverse legal consequences to the individuals that choose not to use the app. It stressed though that the six-month duration s