INSERT INTO `wp_3_posts` (`ID`, `post_author`, `post_date`, `post_date_gmt`, `post_content`, `post_title`, `post_excerpt`, `post_status`, `comment_status`, `ping_status`, `post_password`, `post_name`, `to_ping`, `pinged`, `post_modified`, `post_modified_gmt`, `post_content_filtered`, `post_parent`, `guid`, `menu_order`, `post_type`, `post_mime_type`, `comment_count`) VALUES (937,5,'2020-05-08 11:13:23','2020-05-08 10:13:23','<!-- wp:paragraph -->\n<p>In UK, like in many countries a contract tracing app act is presented as the solution to get out of lockdown, is technology the right solution?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been written and the debate is still ongoing. We have published an article on <a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">the French government project of STOPCOVID. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK NHSX project is another centralised contact tracing App. A first tryout has started on the Isle of Wight since Tuesday May 2nd.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">I - </a>A<strong>nalysing the data protection compliance aspects of the project, from&nbsp;</strong><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\"><strong>Chris Pounder of Amber-walk has published his&nbsp;views</strong></a><strong> </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">COVID-19: how the GDPR applies to trace and track.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Emphasis is put in the voluntary adoption of the measure as requested by most EU Data Protection Authorties.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Chris Pounder develops, ‘<em>NHSX claim that every operation related to the APP is voluntary (e.g. to download, to communicate to a central database if need be). Users can choose to delete the APP at any time; this would also delete the data on the phone but not any data previously uploaded to NHSX’s central database.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data is pseudonymised more than anonymised as it can be re-identifiable, therefore it will be the GDPR and not the ePrivacy Directive that will apply</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a published DPIA, Chris reminds the government promise that ‘T<em>he APP does not use any identifier already on the phone (e.g. phone number, SIM card identifier) or location details.’ The APP generates a random ID number exchanged with other phones that have also downloaded the APP. This record will remain on both phones for 14 days. When someone is COVID+ this record will trace back the contacts with a warning message for the user</em> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- The APP should not keep any personal information and no location data. Only the first half of the postcode is collected from APP users to alert local hospitals.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, for <a href=\"https://tech.newstatesman.com/coronavirus/uncertainty-over-who-could-access-nhsx-contact-tracing-app-data-as-pilot-goes-live\">Laurie Clarke reporter</a>, remains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Uncertainty over who could access NHSX contact tracing app data as Isle of White pilot goes live’. ‘The NHSX coronavirus contact tracing app is being rolled out on the Isle of Wight this week, but major question marks still hang over the app. Matthew Gould, CEO of NHSX, told parliament today that the data collected by the app would be accessible to unspecified organisations as long as it was used for public health purposes. ‘</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>3- For Chris Pounder, ‘</strong><em><strong>there are three definitional issues:</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>(<em>a) is personal data processed? </em></li><li><em>b) if so, who is the controller processing personal data? and </em></li><li><em>(c) if there is a controller, does the voluntary nature of the APP equate to “data subject consent”?</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject is identifiable and the data related to medical health. He is therefore ‘<em>pretty sure the APP is processing personal data and special category of personal data</em>’, subject to the Article 6  lawful basis and a condition that overcomes the prohibition in Article 9(1) from processing health personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Controller, there would be joint controllers as he points to the NHSX website stating that “<em>NHS England and NHS Improvement and the Department of Health and Social Care are delivering NHSX together” This bring to the Article 26 that requires any processing of personal data “shall in a transparent manner determine their respective responsibilities</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the emphasis is on the voluntary adoption of the App, the next question  is on ”<em>data subject consent</em>”. Chris points out that <em>‘the NHS text on the website is very careful to avoid the use of the “C word” and it is easy to see why</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 states that with respect to consent: “<em>consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller</em>” This will be the case where the controller is a public authority or an employer. It will be unlikely for that consent to be considered as ‘<em>freely given</em>’. Therefore voluntary adoption does not refer the character of legitimate basis on consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The limit of the ‘<em>voluntary</em>’ adoption he sees is that it could lead to a denial of a service as previously for the ‘<em>ID Card holders refused to “volunteer” making it a requirement to interact with any public service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The first comment is that any interference by a public authority (NHSX) is unlikely to infringe Article 8(1) [_<a href=\"https://awallon.com:15001/oo/r/546619490369058645\">GDPR08</a>_]&nbsp;of the European Convention on Human Rights; This is because Article 8(2) permits legislation to be enacted by a Parliament process (e.g. in the Coronavirus 2 which sets aside the A.8(1) right in limited circumstances (e.g. any interference deemed&nbsp;<strong><em>necessary</em></strong>&nbsp; “<em>for the protection of health</em>”).&nbsp; It all hangs on the word “<em>necessary</em>”; it is either necessary or it isn’t. If there is reliance on data subject consent (which we think is unreliable), then there is also no A.8 breach (so long consent is properly formed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the GDPR/DPA2018,  <em>‘if the processing is “necessary” it will have Article 6 lawful basis (e.g. candidates are A.6(1)(c) or A.6(1)(e); A.6(1)(d) could be used in a case-by-case emergency). If there is need for an A.9 condition that lifts the prohibition on processing of health personal data the candidates are A.9(2)(c), A.9(2)(g), A.9(1)(i), Schedule 1, paragraphs2, 3 or 6 of the DPA2018</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>If there is reliance on consent or necessary or public task (or even necessary legitimate interests of controller/Third Party), the controller has to specify publicly (A.13; A.14) what happens to the personal data if there withdrawal of consent or exercise of the exercise of the right to object to the processing.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in he concludes ‘<em>the ICO should take up Article 8 ECHR cases on the grounds that necessary as used in the GDPR has the same meaning as in Article 8.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>II - The UK like France has opted for the centralised model </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The App is encountering technical issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.iacr.org/misc/statement-May2014.html\">UK ICO</a> like the <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">French CNIL</a> have expressed their preference for the decentralised model for a decentralised model. Chris Pounder sees further vulnerability of the centralised approach  with a ‘<em>future legislative mood of Government</em>’. He believes ‘<em>It could be tempting (e.g. to reduce the pressures on the public purse) for Government to enact legislation that makes certain processing of personal data compulsory. For instance, to prove entitlement to a COVID related benefit</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> <em>\'Considering to revert to a decentralised model to resolve their Bluetooth issues. ‘Covidsafe app is not working properly on iPhones, authorities admit’ ‘Australians running the Covidsafe contact tracing app on iPhones may not be recording all the data required if they don’t have the app running in the foreground or they are using an older model phone, the government has admitted.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://uk.reuters.com/article/us-health-coronavirus-france-tech/france-accuses-apple-of-refusing-help-with-stopcovid-app-idUKKBN22H0LX\">France is struggling to find an agreement with Apple and Google</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theguardian.com/world/2020/may/06/covidsafe-app-is-not-working-properly-on-iphones-authorities-admit\">Australia who has already deployed the App has been struggling technically </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/\">The Register</a> wrote: ‘<em>UK finds itself almost alone with centralized virus contact-tracing app that probably won\'t work well, asks for your location, may be illegal’. ‘On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in the Isle of Wight – will work, and why it is a better solution to the one by Apple and Google that other nations have decided to adopt. It has also released a more technical explanation</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Running the Bluetooth connection in the back has several inconvenience such as draining the battery and opening security vulnerabilities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, the Bluetooth distance measurement is unreliable <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">according to its own inventor</a>. Bluetooth signals can pierce obstacles the virus hopefully cannot such as a wall or vehicle bodies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The margin of error has caused a return to lock down in Singapore, one of the first nations after China to deploy TraceTogether App. Less than 20% of the population actually downloaded the App It is suspected that Bluetooth works through glass and even some walls and may even be triggered by reflection in windows in buildings. Jason Bay Senior Director (Government Digital Services) at the Government Technology Agency, Singapore&nbsp;<a href=\"https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98\">wrote</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain ? (throw whatever buzzword you want), not for the foreseeabl</em>e future.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The amount of <strong>false alerts</strong> will cause major distress and reduce trust on the App. When someone receives the warning SMS that they have been in contact with someone COVID+, that doesn\'t mean the NHS can test them immediately. They might be asked to self isolate themselves which is not always technically possibly. It has been suggested in France that they would be hotels dedicated to quarantine. That means 14 days of accommodation, food and entertainment. During which time the person and his family or network will be under distress, maybe unnecessarily isolated causing loss of revenues. Should the government be liable for all that ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- These Apps are source of security issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The well known and security expert Bruce Schneier has expressed his concerns about the issues of using Bluetooth Technology <a href=\"https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"My problem with contact tracing apps is that they have absolutely no value,\" Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet &amp; Society at Harvard University, told BuzzFeed News. \"I\'m not even talking about the privacy concerns, I mean the efficacy. Does anybody think this will do something useful? ... This is just something governments want to do for the hell of it. To me, it\'s just techies doing techie things because they don\'t know what else to do.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">SecurityWeek reporter Kevin Townsend wrote</a> ‘<em>These apps could easily become subject to a high number of false positives – and false positives always lead to a rejection by users. ‘ que faire du stresse, isolation et perte de revenus consécutives au faux positives alertes? Le BT transverse les murs et un automobiliste à proximité pourrait être décelé conne en ‘contact’</em> .  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">As contact tracing gains attention, a researcher pokes a hole in Bluetooth technology</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>If someone is reluctant to self quarantine, will they ignore the warning messages ?</li><li>The most at risk populations are the over 60x, will they be willing to download the app ?</li><li>What are going the security issues of opening the Bluetooth connection be?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Any data base creates security issues. New NHS contact-tracing app vulnerable to ‘<em>malicious false alerts</em>’, warn experts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Additionaly, ‘<em>The new NHS contact-tracing app could be used to send malicious alerts causing people to isolate unnecessarily, it has been warned.</em></p><p><em>The app, which is being trialled in the Isle of Wight, tells users if someone they have been in proximity with may be suffering from coronavirus, meaning they could be exposed.</em></p><p><em>But because users can set off the warnings themselves by reporting symptoms – rather than positive Covid-19 test results – it could be used to send out false alerts.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\'Dr Michael Veale, a lecturer in digital rights and regulation at University College London who this week gave evidence to MPs on the technology, told The Independent that Britain’s tracing app had nothing to stop individuals “maliciously triggering notifications” using its normal functionality.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“People can deliberately put others into quarantine or report large areas,” he said. “A child could try to get a day off school by reporting symptoms from a parent’s phone to trigger a quarantine.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Constant Bluetooth signals in the back will drain the phone battery eventually causing over heating. Will be see a new epidemic of ‘pockets in fire’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ICAR, the Association of  experts in Cryptologic research has issued a statement against mass surveillance <a href=\"https://www.iacr.org/misc/statement-May2014.html\">\'The Copenhagen Resolution\'</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards. Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III - The balance of Proportionality requires a three party test :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Fundamental rights, enshrined in the Charter of Fundamental Rights of the European Union constitute the core values of the European Union . These rights must be respected whenever the EU institutions and bodies design and implement new policies or adopt any new legislative measure and in the ECHR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU law which requires that \"<em>the content and form of Union action shall not exceed what is necessary to achieve the objectives of the treaties\"</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives\" . It therefore \"restricts the authorities in the exercise of their powers by requiring a balance to be struck between the means used and the intended aim (or Under Article 52(1) of the Charter, \"subject to the principle of proportionality, limitations </em><a href=\"#\"><em>onresult reached)\" the exercise of fundamental rights</em></a><em> may be made only if they are necessary (...</em>)\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The necessity</strong>, Something needs to be done to end this national confinement killing the country’s economy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the Data Protection Impact Assessment published by <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e. V. .</a> They recommend that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> An appropriate legal basis must be established and in this respect responsibilities have to be defined. </li><li>Reinforcing the measures of pseudonymisation \'when creating the TempIDs in the app, it must be ensured that there is no connection between TempIDs and it must never be possible to make one. ...The server(s)’ operator must employ an effective separation method...\'</li><li>Accompanying the publication of the app it must be ensured in law and in fact that users have to disclose neither the status of the app nor the mere existence on a device to third parties. </li><li>Before the app gets published, a comprehensive investigation of the software and the overall system must be conducted and published by an independent body. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2- Could the same result be achieved in a less intrusive way?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I would argue providing tests,, masks, ventilators and resources to over loaded NHS staff will bring a serious improvement with any inconvenient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The cost of the deployment of the NHSX App is unknown. The Australian Government would have allegedly spend 700.000 AUD just to host the data in Amazon AWS clouds. This is how much less resource the NHS will receive.<a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">h</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://martinralbrecht.wordpress.com/2020/05/03/open-letters-v-surveillance/﻿\">A letter, signed by 177 scientists and researchers working in the UK in the fields of information security and privacy, reads: </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<em>Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified.1 Such invasive information can include the ‘social graph’ of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens’ real-world activities.</em>”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.wired.co.uk/article/contact-tracing-apps-coronavirus\"><strong>IV - Coronavirus contact tracing apps were meant to save us</strong></a><strong>. They won’t. ‘With little evidence to show how effective such apps are and growing privacy concerns, there’s a risk they could do more harm than good‘ </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>From Iceland to Israel,&nbsp;</em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\"><em>more than 30 systems</em></a><em>&nbsp;are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>False alerts might loose users trust. An Oxford research said that the probability of seeing any result from the tracing Apps requires that at least 60% of the population use the App. Will the most vulnerable population of over 60% be willing to download and use it ? Will the government be liable for the false alters causing distress, unnecessary isolation and loss of revenues? France is talking of self isolating in hotels, where and how feed and entertain these people? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Elsewhere projects using personal data to combat SARS-CoV-2 </a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://tracetogether.zendesk.com/hc/en-sg/articles/360046475654-20-April-2020-One-Month-On\"><em>Singapour’s TraceTogether App</em></a><em> moved to the The Apple and Google collaboration on digital contact tracing solutions, is a game-changer, as we said previously. It will significantly improve the contact tracing capability available to governments and public health authorities over what is available through public APIs on either Android or iOS platforms. We are glad that Apple and Google are engaging governments and public health authorities around the world, including us, to incorporate feedback as the specifications for their contract tracing protocol and private APIs.  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=e6e61ca3-45ae-49a0-b6f1-5fd4adf11291\">In Poland</a>, Although initially voluntary in nature, it has become mandatory for all those under obligatory quarantine or epidemiological surveillance, as a tool to confirm compliance with quarantine obligations (e.g. whether the ban on leaving the quarantine location is observed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Contact tracing apps in Austria: a Red Cross initiative |Has been launched In March 2020 in co-operation with Accenture. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The first published version of the Stopp Corona app required users to log their contacts via a \'manual\' handshake. In the current version, however, the app already allows contacts to be traced automatically, depending on the device and its configuration.&nbsp;</em></p><p><em>The automatic handshake functionality is based on the discovery and messaging functionality of the p2pkit developed by the Swiss company Uepaa, which uses Bluetooth and Wifi-direct techniques to determine the distance between the users.&nbsp;</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Switzerland: \"WeTrace\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>This project is ready to be deployed. It is open source. All data remains locally on the devices. Packaged information encrypted asymmetrically. The sole information a potential malfeasor on the central server would see is the fact _that_ an infected person has actually pushed a status update, but on the core server it is not visible \"what\" the person has broadcasted. The broadcasting user can determine the details of what should be broadcasted aside from status (location of contact, time of contact, etc.). Packages will be sent not to everyone but only to those that need to know.</em></p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Spain: \"Open Coronavirus\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The Spanish medical investigator Aurelia Bustos has released Open Coronavirus, an open-source app with the aim to copy the advantages of the South-Korean app: in the end, serving as an individual-validation-method in order to allow free movement of the citizens. This tool can be used by any public institution as a basis for its own apps on tracking citizens due to the coronavirus emergency, and it offers a modular design: three levels of management (mobile phone, central management of data by the competent authority and checking of the control points by the competent authority too) with different options of geolocation (GPS, bluetooth, positioning by mobile operators cells) that could be implemented or not by the corresponding institution. Its use would be voluntary for the citizen (although, in words of the medical investigator, \"it would be probably very advantageous for the user, as it would allow him/her to have the possibility to finish an eventually longer quarantine\"), and it would necessarily depend on the realization of any kind of coronavirus detection tests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>As this is an open-source app, that it will not be officially published in its current status, and any use of the same by any institutons must be always in line with GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, it can be said of the NHSX Tracing App, similar to the French STOPCOVID, that <a href=\"https://www.lemonde.fr/idees/article/2020/04/25/stopcovid-est-un-projet-desastreux-pilote-par-des-apprentis-sorciers_6037721_3232.html\">«&nbsp;StopCovid est un projet désastreux piloté par des apprentis sorciers&nbsp;»</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>UPDATE 8th May, The Financial Times reveals \'<a href=\"https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b\">UK starts to build second contact tracing app</a>\' going for a decentralised model in collaboration with Apple and Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The different existing systems&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">The Chinese System based on geolocation</a></li><li><a href=\"https://github.com/DP-3T/documents\">The DP3T</a> Protocol&nbsp;(sous diverses variantes), sa déclinaison par l’alliance&nbsp;</li><li><a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a>&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\"> PACT- Est</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://pact.mit.edu/\">PACT-Ouest</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://github.com/TCNCoalition/TCN\">TCN</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">ROBERT</a> Protocol&nbsp;.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Liste of <a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Projects using personal data to combat SARS-CoV-2</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDRI <a href=\"https://edri.org/covid-19-digital-rights-document-pool/\">COVID-19 &amp; Digital Rights: Document Pool</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/sites/edp/files/publication/20-05-08_techdispatch-tracing_en.pdf\">Techdispatch&nbsp;\'</a>Contact Tracing with Mobile Applications\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:gallery {\"ids\":[930,931,932]} -->\n<ul class=\"wp-block-gallery columns-3 is-cropped\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQe2X0AE1.png\" alt=\"\" data-id=\"930\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqe2x0ae1/\" class=\"wp-image-930\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQexXQAYJ2.png\" alt=\"\" data-id=\"931\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqexxqayj2/\" class=\"wp-image-931\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQfQX0AEk3.png\" alt=\"\" data-id=\"932\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqfqx0aek3/\" class=\"wp-image-932\" /></figure></li></ul>\n<!-- /wp:gallery -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">Privacy International : A technical deep-dive into the NHS COVID-19 contact tracing app</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":933} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/EXethgcXgAAF4.jpeg\" alt=\"\" class=\"wp-image-933\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.privacyinternational.org/long-read/3752/coronavirus-tracking-uk-what-we-know-so-far\">UK government Covid tracking app: what you need to know!</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A SPECIAL THANK YOU TO GRAEME McGOWAN for allowing me to use his beautiful photography.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','NHSX Contacts Tracing App','Is NHSX UK centralised Tracing APP capable of best combat the COVID19 propagation? the Balance of proportionality looks rather weak. ','inherit','closed','closed','','898-revision-v1','','','2020-05-08 11:13:23','2020-05-08 10:13:23','',898,'https://datarainbow.eu/2020/05/08/898-revision-v1/',0,'revision','',0),(938,5,'2020-05-08 11:14:46','2020-05-08 10:14:46','<!-- wp:paragraph -->\n<p>In UK, like in many countries a contract tracing app act is presented as the solution to get out of lockdown, is technology the right solution?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been written and the debate is still ongoing. We have published an article on <a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">the French government project of STOPCOVID. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK NHSX project is another centralised contact tracing App. A first tryout has started on the Isle of Wight since Tuesday May 2nd.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">I - </a>A<strong>nalysing the data protection compliance aspects of the project, from&nbsp;</strong><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\"><strong>Chris Pounder of Amber-walk has published his&nbsp;views</strong></a><strong> </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">COVID-19: how the GDPR applies to trace and track.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Emphasis is put in the voluntary adoption of the measure as requested by most EU Data Protection Authorties.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Chris Pounder develops, ‘<em>NHSX claim that every operation related to the APP is voluntary (e.g. to download, to communicate to a central database if need be). Users can choose to delete the APP at any time; this would also delete the data on the phone but not any data previously uploaded to NHSX’s central database.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data is pseudonymised more than anonymised as it can be re-identifiable, therefore it will be the GDPR and not the ePrivacy Directive that will apply</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a published DPIA, Chris reminds the government promise that ‘T<em>he APP does not use any identifier already on the phone (e.g. phone number, SIM card identifier) or location details.’ The APP generates a random ID number exchanged with other phones that have also downloaded the APP. This record will remain on both phones for 14 days. When someone is COVID+ this record will trace back the contacts with a warning message for the user</em> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- The APP should not keep any personal information and no location data. Only the first half of the postcode is collected from APP users to alert local hospitals.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, for <a href=\"https://tech.newstatesman.com/coronavirus/uncertainty-over-who-could-access-nhsx-contact-tracing-app-data-as-pilot-goes-live\">Laurie Clarke reporter</a>, remains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Uncertainty over who could access NHSX contact tracing app data as Isle of White pilot goes live’. ‘The NHSX coronavirus contact tracing app is being rolled out on the Isle of Wight this week, but major question marks still hang over the app. Matthew Gould, CEO of NHSX, told parliament today that the data collected by the app would be accessible to unspecified organisations as long as it was used for public health purposes. ‘</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>3- For Chris Pounder, ‘</strong><em><strong>there are three definitional issues:</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>(<em>a) is personal data processed? </em></li><li><em>b) if so, who is the controller processing personal data? and </em></li><li><em>(c) if there is a controller, does the voluntary nature of the APP equate to “data subject consent”?</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject is identifiable and the data related to medical health. He is therefore ‘<em>pretty sure the APP is processing personal data and special category of personal data</em>’, subject to the Article 6  lawful basis and a condition that overcomes the prohibition in Article 9(1) from processing health personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Controller, there would be joint controllers as he points to the NHSX website stating that “<em>NHS England and NHS Improvement and the Department of Health and Social Care are delivering NHSX together” This bring to the Article 26 that requires any processing of personal data “shall in a transparent manner determine their respective responsibilities</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the emphasis is on the voluntary adoption of the App, the next question  is on ”<em>data subject consent</em>”. Chris points out that <em>‘the NHS text on the website is very careful to avoid the use of the “C word” and it is easy to see why</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 states that with respect to consent: “<em>consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller</em>” This will be the case where the controller is a public authority or an employer. It will be unlikely for that consent to be considered as ‘<em>freely given</em>’. Therefore voluntary adoption does not refer the character of legitimate basis on consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The limit of the ‘<em>voluntary</em>’ adoption he sees is that it could lead to a denial of a service as previously for the ‘<em>ID Card holders refused to “volunteer” making it a requirement to interact with any public service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The first comment is that any interference by a public authority (NHSX) is unlikely to infringe Article 8(1) [_<a href=\"https://awallon.com:15001/oo/r/546619490369058645\">GDPR08</a>_]&nbsp;of the European Convention on Human Rights; This is because Article 8(2) permits legislation to be enacted by a Parliament process (e.g. in the Coronavirus 2 which sets aside the A.8(1) right in limited circumstances (e.g. any interference deemed&nbsp;<strong><em>necessary</em></strong>&nbsp; “<em>for the protection of health</em>”).&nbsp; It all hangs on the word “<em>necessary</em>”; it is either necessary or it isn’t. If there is reliance on data subject consent (which we think is unreliable), then there is also no A.8 breach (so long consent is properly formed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the GDPR/DPA2018,  <em>‘if the processing is “necessary” it will have Article 6 lawful basis (e.g. candidates are A.6(1)(c) or A.6(1)(e); A.6(1)(d) could be used in a case-by-case emergency). If there is need for an A.9 condition that lifts the prohibition on processing of health personal data the candidates are A.9(2)(c), A.9(2)(g), A.9(1)(i), Schedule 1, paragraphs2, 3 or 6 of the DPA2018</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>If there is reliance on consent or necessary or public task (or even necessary legitimate interests of controller/Third Party), the controller has to specify publicly (A.13; A.14) what happens to the personal data if there withdrawal of consent or exercise of the exercise of the right to object to the processing.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in he concludes ‘<em>the ICO should take up Article 8 ECHR cases on the grounds that necessary as used in the GDPR has the same meaning as in Article 8.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>II - The UK like France has opted for the centralised model </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The App is encountering technical issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.iacr.org/misc/statement-May2014.html\">UK ICO</a> like the <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">French CNIL</a> have expressed their preference for the decentralised model for a decentralised model. Chris Pounder sees further vulnerability of the centralised approach  with a ‘<em>future legislative mood of Government</em>’. He believes ‘<em>It could be tempting (e.g. to reduce the pressures on the public purse) for Government to enact legislation that makes certain processing of personal data compulsory. For instance, to prove entitlement to a COVID related benefit</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> <em>\'Considering to revert to a decentralised model to resolve their Bluetooth issues. ‘Covidsafe app is not working properly on iPhones, authorities admit’ ‘Australians running the Covidsafe contact tracing app on iPhones may not be recording all the data required if they don’t have the app running in the foreground or they are using an older model phone, the government has admitted.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://uk.reuters.com/article/us-health-coronavirus-france-tech/france-accuses-apple-of-refusing-help-with-stopcovid-app-idUKKBN22H0LX\">France is struggling to find an agreement with Apple and Google</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theguardian.com/world/2020/may/06/covidsafe-app-is-not-working-properly-on-iphones-authorities-admit\">Australia who has already deployed the App has been struggling technically </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/\">The Register</a> wrote: ‘<em>UK finds itself almost alone with centralized virus contact-tracing app that probably won\'t work well, asks for your location, may be illegal’. ‘On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in the Isle of Wight – will work, and why it is a better solution to the one by Apple and Google that other nations have decided to adopt. It has also released a more technical explanation</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Running the Bluetooth connection in the back has several inconvenience such as draining the battery and opening security vulnerabilities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, the Bluetooth distance measurement is unreliable <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">according to its own inventor</a>. Bluetooth signals can pierce obstacles the virus hopefully cannot such as a wall or vehicle bodies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The margin of error has caused a return to lock down in Singapore, one of the first nations after China to deploy TraceTogether App. Less than 20% of the population actually downloaded the App It is suspected that Bluetooth works through glass and even some walls and may even be triggered by reflection in windows in buildings. Jason Bay Senior Director (Government Digital Services) at the Government Technology Agency, Singapore&nbsp;<a href=\"https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98\">wrote</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain ? (throw whatever buzzword you want), not for the foreseeabl</em>e future.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The amount of <strong>false alerts</strong> will cause major distress and reduce trust on the App. When someone receives the warning SMS that they have been in contact with someone COVID+, that doesn\'t mean the NHS can test them immediately. They might be asked to self isolate themselves which is not always technically possibly. It has been suggested in France that they would be hotels dedicated to quarantine. That means 14 days of accommodation, food and entertainment. During which time the person and his family or network will be under distress, maybe unnecessarily isolated causing loss of revenues. Should the government be liable for all that ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- These Apps are source of security issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The well known and security expert Bruce Schneier has expressed his concerns about the issues of using Bluetooth Technology <a href=\"https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"My problem with contact tracing apps is that they have absolutely no value,\" Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet &amp; Society at Harvard University, told BuzzFeed News. \"I\'m not even talking about the privacy concerns, I mean the efficacy. Does anybody think this will do something useful? ... This is just something governments want to do for the hell of it. To me, it\'s just techies doing techie things because they don\'t know what else to do.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">SecurityWeek reporter Kevin Townsend wrote</a> ‘<em>These apps could easily become subject to a high number of false positives – and false positives always lead to a rejection by users. ‘ que faire du stresse, isolation et perte de revenus consécutives au faux positives alertes? Le BT transverse les murs et un automobiliste à proximité pourrait être décelé conne en ‘contact’</em> .  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">As contact tracing gains attention, a researcher pokes a hole in Bluetooth technology</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>If someone is reluctant to self quarantine, will they ignore the warning messages ?</li><li>The most at risk populations are the over 60x, will they be willing to download the app ?</li><li>What are going the security issues of opening the Bluetooth connection be?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Any data base creates security issues. New NHS contact-tracing app vulnerable to ‘<em>malicious false alerts</em>’, warn experts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Additionaly, ‘<em>The new NHS contact-tracing app could be used to send malicious alerts causing people to isolate unnecessarily, it has been warned.</em></p><p><em>The app, which is being trialled in the Isle of Wight, tells users if someone they have been in proximity with may be suffering from coronavirus, meaning they could be exposed.</em></p><p><em>But because users can set off the warnings themselves by reporting symptoms – rather than positive Covid-19 test results – it could be used to send out false alerts.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\'Dr Michael Veale, a lecturer in digital rights and regulation at University College London who this week gave evidence to MPs on the technology, told The Independent that Britain’s tracing app had nothing to stop individuals “maliciously triggering notifications” using its normal functionality.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“People can deliberately put others into quarantine or report large areas,” he said. “A child could try to get a day off school by reporting symptoms from a parent’s phone to trigger a quarantine.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Constant Bluetooth signals in the back will drain the phone battery eventually causing over heating. Will be see a new epidemic of ‘pockets in fire’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ICAR, the Association of  experts in Cryptologic research has issued a statement against mass surveillance <a href=\"https://www.iacr.org/misc/statement-May2014.html\">\'The Copenhagen Resolution\'</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards. Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III - The balance of Proportionality requires a three party test :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Fundamental rights, enshrined in the Charter of Fundamental Rights of the European Union constitute the core values of the European Union . These rights must be respected whenever the EU institutions and bodies design and implement new policies or adopt any new legislative measure and in the ECHR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU law which requires that \"<em>the content and form of Union action shall not exceed what is necessary to achieve the objectives of the treaties\"</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives\" . It therefore \"restricts the authorities in the exercise of their powers by requiring a balance to be struck between the means used and the intended aim (or Under Article 52(1) of the Charter, \"subject to the principle of proportionality, limitations </em><a href=\"#\"><em>onresult reached)\" the exercise of fundamental rights</em></a><em> may be made only if they are necessary (...</em>)\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The necessity</strong>, Something needs to be done to end this national confinement killing the country’s economy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the Data Protection Impact Assessment published by <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e. V. .</a> They recommend that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> An appropriate legal basis must be established and in this respect responsibilities have to be defined. </li><li>Reinforcing the measures of pseudonymisation \'when creating the TempIDs in the app, it must be ensured that there is no connection between TempIDs and it must never be possible to make one. ...The server(s)’ operator must employ an effective separation method...\'</li><li>Accompanying the publication of the app it must be ensured in law and in fact that users have to disclose neither the status of the app nor the mere existence on a device to third parties. </li><li>Before the app gets published, a comprehensive investigation of the software and the overall system must be conducted and published by an independent body. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2- Could the same result be achieved in a less intrusive way?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I would argue providing tests,, masks, ventilators and resources to over loaded NHS staff will bring a serious improvement with any inconvenient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The cost of the deployment of the NHSX App is unknown. The Australian Government would have allegedly spend 700.000 AUD just to host the data in Amazon AWS clouds. This is how much less resource the NHS will receive.<a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">h</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://martinralbrecht.wordpress.com/2020/05/03/open-letters-v-surveillance/﻿\">A letter, signed by 177 scientists and researchers working in the UK in the fields of information security and privacy, reads: </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<em>Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified.1 Such invasive information can include the ‘social graph’ of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens’ real-world activities.</em>”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.wired.co.uk/article/contact-tracing-apps-coronavirus\"><strong>IV - Coronavirus contact tracing apps were meant to save us</strong></a><strong>. They won’t. ‘With little evidence to show how effective such apps are and growing privacy concerns, there’s a risk they could do more harm than good‘ </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>From Iceland to Israel,&nbsp;</em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\"><em>more than 30 systems</em></a><em>&nbsp;are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>False alerts might loose users trust. An Oxford research said that the probability of seeing any result from the tracing Apps requires that at least 60% of the population use the App. Will the most vulnerable population of over 60% be willing to download and use it ? Will the government be liable for the false alters causing distress, unnecessary isolation and loss of revenues? France is talking of self isolating in hotels, where and how feed and entertain these people? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Elsewhere projects using personal data to combat SARS-CoV-2 </a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://tracetogether.zendesk.com/hc/en-sg/articles/360046475654-20-April-2020-One-Month-On\"><em>Singapour’s TraceTogether App</em></a><em> moved to the The Apple and Google collaboration on digital contact tracing solutions, is a game-changer, as we said previously. It will significantly improve the contact tracing capability available to governments and public health authorities over what is available through public APIs on either Android or iOS platforms. We are glad that Apple and Google are engaging governments and public health authorities around the world, including us, to incorporate feedback as the specifications for their contract tracing protocol and private APIs.  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=e6e61ca3-45ae-49a0-b6f1-5fd4adf11291\">In Poland</a>, Although initially voluntary in nature, it has become mandatory for all those under obligatory quarantine or epidemiological surveillance, as a tool to confirm compliance with quarantine obligations (e.g. whether the ban on leaving the quarantine location is observed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Contact tracing apps in Austria: a Red Cross initiative |Has been launched In March 2020 in co-operation with Accenture. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The first published version of the Stopp Corona app required users to log their contacts via a \'manual\' handshake. In the current version, however, the app already allows contacts to be traced automatically, depending on the device and its configuration.&nbsp;</em></p><p><em>The automatic handshake functionality is based on the discovery and messaging functionality of the p2pkit developed by the Swiss company Uepaa, which uses Bluetooth and Wifi-direct techniques to determine the distance between the users.&nbsp;</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Switzerland: \"WeTrace\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>This project is ready to be deployed. It is open source. All data remains locally on the devices. Packaged information encrypted asymmetrically. The sole information a potential malfeasor on the central server would see is the fact _that_ an infected person has actually pushed a status update, but on the core server it is not visible \"what\" the person has broadcasted. The broadcasting user can determine the details of what should be broadcasted aside from status (location of contact, time of contact, etc.). Packages will be sent not to everyone but only to those that need to know.</em></p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Spain: \"Open Coronavirus\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The Spanish medical investigator Aurelia Bustos has released Open Coronavirus, an open-source app with the aim to copy the advantages of the South-Korean app: in the end, serving as an individual-validation-method in order to allow free movement of the citizens. This tool can be used by any public institution as a basis for its own apps on tracking citizens due to the coronavirus emergency, and it offers a modular design: three levels of management (mobile phone, central management of data by the competent authority and checking of the control points by the competent authority too) with different options of geolocation (GPS, bluetooth, positioning by mobile operators cells) that could be implemented or not by the corresponding institution. Its use would be voluntary for the citizen (although, in words of the medical investigator, \"it would be probably very advantageous for the user, as it would allow him/her to have the possibility to finish an eventually longer quarantine\"), and it would necessarily depend on the realization of any kind of coronavirus detection tests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>As this is an open-source app, that it will not be officially published in its current status, and any use of the same by any institutons must be always in line with GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, it can be said of the NHSX Tracing App, similar to the French STOPCOVID, that <a href=\"https://www.lemonde.fr/idees/article/2020/04/25/stopcovid-est-un-projet-desastreux-pilote-par-des-apprentis-sorciers_6037721_3232.html\">«&nbsp;StopCovid est un projet désastreux piloté par des apprentis sorciers&nbsp;»</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE 8th May</strong>, The Financial Times reveals \'<a href=\"https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b\">UK starts to build second contact tracing app</a>\' going for a decentralised model in collaboration with Apple and Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The different existing systems&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">The Chinese System based on geolocation</a></li><li><a href=\"https://github.com/DP-3T/documents\">The DP3T</a> Protocol&nbsp;(sous diverses variantes), sa déclinaison par l’alliance&nbsp;</li><li><a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a>&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\"> PACT- Est</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://pact.mit.edu/\">PACT-Ouest</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://github.com/TCNCoalition/TCN\">TCN</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">ROBERT</a> Protocol&nbsp;.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Liste of <a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Projects using personal data to combat SARS-CoV-2</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDRI <a href=\"https://edri.org/covid-19-digital-rights-document-pool/\">COVID-19 &amp; Digital Rights: Document Pool</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/sites/edp/files/publication/20-05-08_techdispatch-tracing_en.pdf\">Techdispatch&nbsp;\'</a>Contact Tracing with Mobile Applications\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:gallery {\"ids\":[930,931,932]} -->\n<ul class=\"wp-block-gallery columns-3 is-cropped\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQe2X0AE1.png\" alt=\"\" data-id=\"930\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqe2x0ae1/\" class=\"wp-image-930\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQexXQAYJ2.png\" alt=\"\" data-id=\"931\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqexxqayj2/\" class=\"wp-image-931\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQfQX0AEk3.png\" alt=\"\" data-id=\"932\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqfqx0aek3/\" class=\"wp-image-932\" /></figure></li></ul>\n<!-- /wp:gallery -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">Privacy International : A technical deep-dive into the NHS COVID-19 contact tracing app</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":933} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/EXethgcXgAAF4.jpeg\" alt=\"\" class=\"wp-image-933\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.privacyinternational.org/long-read/3752/coronavirus-tracking-uk-what-we-know-so-far\">UK government Covid tracking app: what you need to know!</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A SPECIAL THANK YOU TO GRAEME McGOWAN for allowing me to use his beautiful photography.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','NHSX Contacts Tracing App','Is NHSX UK centralised Tracing APP capable of best combat the COVID19 propagation? the Balance of proportionality looks rather weak. ','inherit','closed','closed','','898-revision-v1','','','2020-05-08 11:14:46','2020-05-08 10:14:46','',898,'https://datarainbow.eu/2020/05/08/898-revision-v1/',0,'revision','',0),(940,5,'2020-05-08 11:30:17','2020-05-08 10:30:17','<!-- wp:paragraph -->\n<p>In UK, like in many countries a contract tracing app act is presented as the solution to get out of lockdown, is technology the right solution?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been written and the debate is still ongoing. We have published an article on <a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">the French government project of STOPCOVID. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK NHSX project is another centralised contact tracing App. A first tryout has started on the Isle of Wight since Tuesday May 2nd.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">I - </a>A<strong>nalysing the data protection compliance aspects of the project, from&nbsp;</strong><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\"><strong>Chris Pounder of Amber-walk has published his&nbsp;views</strong></a><strong> </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">COVID-19: how the GDPR applies to trace and track.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Emphasis is put in the voluntary adoption of the measure as requested by most EU Data Protection Authorties.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Chris Pounder develops, ‘<em>NHSX claim that every operation related to the APP is voluntary (e.g. to download, to communicate to a central database if need be). Users can choose to delete the APP at any time; this would also delete the data on the phone but not any data previously uploaded to NHSX’s central database.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data is pseudonymised more than anonymised as it can be re-identifiable, therefore it will be the GDPR and not the ePrivacy Directive that will apply</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a published DPIA, Chris reminds the government promise that ‘T<em>he APP does not use any identifier already on the phone (e.g. phone number, SIM card identifier) or location details.’ The APP generates a random ID number exchanged with other phones that have also downloaded the APP. This record will remain on both phones for 14 days. When someone is COVID+ this record will trace back the contacts with a warning message for the user</em> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- The APP should not keep any personal information and no location data. Only the first half of the postcode is collected from APP users to alert local hospitals.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, for <a href=\"https://tech.newstatesman.com/coronavirus/uncertainty-over-who-could-access-nhsx-contact-tracing-app-data-as-pilot-goes-live\">Laurie Clarke reporter</a>, remains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Uncertainty over who could access NHSX contact tracing app data as Isle of White pilot goes live’. ‘The NHSX coronavirus contact tracing app is being rolled out on the Isle of Wight this week, but major question marks still hang over the app. Matthew Gould, CEO of NHSX, told parliament today that the data collected by the app would be accessible to unspecified organisations as long as it was used for public health purposes. ‘</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>3- For Chris Pounder, ‘</strong><em><strong>there are three definitional issues:</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>(<em>a) is personal data processed? </em></li><li><em>b) if so, who is the controller processing personal data? and </em></li><li><em>(c) if there is a controller, does the voluntary nature of the APP equate to “data subject consent”?</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject is identifiable and the data related to medical health. He is therefore ‘<em>pretty sure the APP is processing personal data and special category of personal data</em>’, subject to the Article 6  lawful basis and a condition that overcomes the prohibition in Article 9(1) from processing health personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Controller, there would be joint controllers as he points to the NHSX website stating that “<em>NHS England and NHS Improvement and the Department of Health and Social Care are delivering NHSX together” This bring to the Article 26 that requires any processing of personal data “shall in a transparent manner determine their respective responsibilities</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the emphasis is on the voluntary adoption of the App, the next question  is on ”<em>data subject consent</em>”. Chris points out that <em>‘the NHS text on the website is very careful to avoid the use of the “C word” and it is easy to see why</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 states that with respect to consent: “<em>consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller</em>” This will be the case where the controller is a public authority or an employer. It will be unlikely for that consent to be considered as ‘<em>freely given</em>’. Therefore voluntary adoption does not refer the character of legitimate basis on consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The limit of the ‘<em>voluntary</em>’ adoption he sees is that it could lead to a denial of a service as previously for the ‘<em>ID Card holders refused to “volunteer” making it a requirement to interact with any public service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The first comment is that any interference by a public authority (NHSX) is unlikely to infringe Article 8(1) [_<a href=\"https://awallon.com:15001/oo/r/546619490369058645\">GDPR08</a>_]&nbsp;of the European Convention on Human Rights; This is because Article 8(2) permits legislation to be enacted by a Parliament process (e.g. in the Coronavirus 2 which sets aside the A.8(1) right in limited circumstances (e.g. any interference deemed&nbsp;<strong><em>necessary</em></strong>&nbsp; “<em>for the protection of health</em>”).&nbsp; It all hangs on the word “<em>necessary</em>”; it is either necessary or it isn’t. If there is reliance on data subject consent (which we think is unreliable), then there is also no A.8 breach (so long consent is properly formed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the GDPR/DPA2018,  <em>‘if the processing is “necessary” it will have Article 6 lawful basis (e.g. candidates are A.6(1)(c) or A.6(1)(e); A.6(1)(d) could be used in a case-by-case emergency). If there is need for an A.9 condition that lifts the prohibition on processing of health personal data the candidates are A.9(2)(c), A.9(2)(g), A.9(1)(i), Schedule 1, paragraphs2, 3 or 6 of the DPA2018</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>If there is reliance on consent or necessary or public task (or even necessary legitimate interests of controller/Third Party), the controller has to specify publicly (A.13; A.14) what happens to the personal data if there withdrawal of consent or exercise of the exercise of the right to object to the processing.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in he concludes ‘<em>the ICO should take up Article 8 ECHR cases on the grounds that necessary as used in the GDPR has the same meaning as in Article 8.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>II - The UK like France has opted for the centralised model </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The App is encountering technical issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.iacr.org/misc/statement-May2014.html\">UK ICO</a> like the <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">French CNIL</a> have expressed their preference for the decentralised model for a decentralised model. Chris Pounder sees further vulnerability of the centralised approach  with a ‘<em>future legislative mood of Government</em>’. He believes ‘<em>It could be tempting (e.g. to reduce the pressures on the public purse) for Government to enact legislation that makes certain processing of personal data compulsory. For instance, to prove entitlement to a COVID related benefit</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> <em>\'Considering to revert to a decentralised model to resolve their Bluetooth issues. ‘Covidsafe app is not working properly on iPhones, authorities admit’ ‘Australians running the Covidsafe contact tracing app on iPhones may not be recording all the data required if they don’t have the app running in the foreground or they are using an older model phone, the government has admitted.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://uk.reuters.com/article/us-health-coronavirus-france-tech/france-accuses-apple-of-refusing-help-with-stopcovid-app-idUKKBN22H0LX\">France is struggling to find an agreement with Apple and Google</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theguardian.com/world/2020/may/06/covidsafe-app-is-not-working-properly-on-iphones-authorities-admit\">Australia who has already deployed the App has been struggling technically </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/\">The Register</a> wrote: ‘<em>UK finds itself almost alone with centralized virus contact-tracing app that probably won\'t work well, asks for your location, may be illegal’. ‘On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in the Isle of Wight – will work, and why it is a better solution to the one by Apple and Google that other nations have decided to adopt. It has also released a more technical explanation</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Running the Bluetooth connection in the back has several inconvenience such as draining the battery and opening security vulnerabilities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, the Bluetooth distance measurement is unreliable <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">according to its own inventor</a>. Bluetooth signals can pierce obstacles the virus hopefully cannot such as a wall or vehicle bodies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The margin of error has caused a return to lock down in Singapore, one of the first nations after China to deploy TraceTogether App. Less than 20% of the population actually downloaded the App It is suspected that Bluetooth works through glass and even some walls and may even be triggered by reflection in windows in buildings. Jason Bay Senior Director (Government Digital Services) at the Government Technology Agency, Singapore&nbsp;<a href=\"https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98\">wrote</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain ? (throw whatever buzzword you want), not for the foreseeabl</em>e future.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The amount of <strong>false alerts</strong> will cause major distress and reduce trust on the App. When someone receives the warning SMS that they have been in contact with someone COVID+, that doesn\'t mean the NHS can test them immediately. They might be asked to self isolate themselves which is not always technically possibly. It has been suggested in France that they would be hotels dedicated to quarantine. That means 14 days of accommodation, food and entertainment. During which time the person and his family or network will be under distress, maybe unnecessarily isolated causing loss of revenues. Should the government be liable for all that ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- These Apps are source of security issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The well known and security expert Bruce Schneier has expressed his concerns about the issues of using Bluetooth Technology <a href=\"https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"My problem with contact tracing apps is that they have absolutely no value,\" Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet &amp; Society at Harvard University, told BuzzFeed News. \"I\'m not even talking about the privacy concerns, I mean the efficacy. Does anybody think this will do something useful? ... This is just something governments want to do for the hell of it. To me, it\'s just techies doing techie things because they don\'t know what else to do.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">SecurityWeek reporter Kevin Townsend wrote</a> ‘<em>These apps could easily become subject to a high number of false positives – and false positives always lead to a rejection by users. ‘ que faire du stresse, isolation et perte de revenus consécutives au faux positives alertes? Le BT transverse les murs et un automobiliste à proximité pourrait être décelé conne en ‘contact’</em> .  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">As contact tracing gains attention, a researcher pokes a hole in Bluetooth technology</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>If someone is reluctant to self quarantine, will they ignore the warning messages ?</li><li>The most at risk populations are the over 60x, will they be willing to download the app ?</li><li>What are going the security issues of opening the Bluetooth connection be?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Any data base creates security issues. New NHS contact-tracing app vulnerable to ‘<em>malicious false alerts</em>’, warn experts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Additionaly, ‘<em>The new NHS contact-tracing app could be used to send malicious alerts causing people to isolate unnecessarily, it has been warned.</em></p><p><em>The app, which is being trialled in the Isle of Wight, tells users if someone they have been in proximity with may be suffering from coronavirus, meaning they could be exposed.</em></p><p><em>But because users can set off the warnings themselves by reporting symptoms – rather than positive Covid-19 test results – it could be used to send out false alerts.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\'Dr Michael Veale, a lecturer in digital rights and regulation at University College London who this week gave evidence to MPs on the technology, told The Independent that Britain’s tracing app had nothing to stop individuals “maliciously triggering notifications” using its normal functionality.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“People can deliberately put others into quarantine or report large areas,” he said. “A child could try to get a day off school by reporting symptoms from a parent’s phone to trigger a quarantine.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Constant Bluetooth signals in the back will drain the phone battery eventually causing over heating. Will be see a new epidemic of ‘pockets in fire’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ICAR, the Association of  experts in Cryptologic research has issued a statement against mass surveillance <a href=\"https://www.iacr.org/misc/statement-May2014.html\">\'The Copenhagen Resolution\'</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards. Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> <a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">A technical deep-dive into the NHS COVID-19 contact tracing app</a> : Since \'<em>the contact tracing beta is now open source for both </em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-iOS-BETA\" target=\"_blank\"><em>iOS</em></a><em> and </em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Android-BETA\" target=\"_blank\"><em>Android</em></a><em>, along with some </em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Documentation-BETA\" target=\"_blank\"><em>documentation</em></a><em>. As a follow-up to our “</em><a href=\"https://reincubate.com/blog/staying-alive-covid-19-background-tracing/\"><em>Staying alive</em></a><em>” post, we’ve taken a deep-dive into the source code. It’s pleasantly surprising to find it licensed under MIT, indicating an NHSX commitment to transparency and quality... There have been claims that the Android app accesses location data, as the prompt for Bluetooth API access on Android devices appears to ask for location permissions. However, we debunked this yesterday: this is a consequence of how Android </em><a rel=\"noreferrer noopener\" href=\"https://developer.android.com/guide/topics/connectivity/bluetooth#Permissions\" target=\"_blank\"><em>manages requests for Bluetooth permissions</em></a><em>.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Reincubate’s CEO, Aidan Fitzpatrick, says:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, it is the case that the coming Apple&nbsp;<code>ExposureNotification</code>&nbsp;framework in iOS 13.5 obviates the need for these keepalives. However, it’s worth noting that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>iOS 13.5 has not been released, and may not be for some weeks</li><li>Prior to yesterday, the last iOS 13.5 beta had a&nbsp;<a href=\"https://siguza.github.io/psychicpaper/\" rel=\"noreferrer noopener\" target=\"_blank\">major security flaw</a>, suggesting heavy lifting is going on in Apple’s engineering teams</li><li>Once it is released, it will&nbsp;<a href=\"https://venturebeat.com/2020/01/29/as-ios-and-ipados-13-near-80-adoption-is-the-race-with-android-over/\" rel=\"noreferrer noopener\" target=\"_blank\">likely take months</a>&nbsp;for a majority of iOS users to install it (unusually, the equivalent Android adoption may be&nbsp;<a href=\"https://www.theverge.com/2020/4/13/21220033/android-covid-19-tracking-updates-google-play-contact-tracing\" rel=\"noreferrer noopener\" target=\"_blank\">more rapid</a>)</li><li>Older iOS devices — such as the iPhone 6 — cannot run iOS 13, and will not be able to use the Apple technique</li><li><em>There’s no reason why the NHS COVID-19 app won’t be able to automatically transition in future to using Apple’s framework — or even dual-running both mechanisms</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The app will become increasingly effective as more people use it, and the benefit of mass adoption will create a flywheel effect in this sense. The Australian COVIDSafe app struggled as it didn’t support detecting backgrounded iOS devices from an Android device, and it didn’t have this clever iOS-to-iOS keepalive mechanism.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to reflect on which circumstances make use of technology like this appropriate. If contact tracing is successful in saving lives, which criteria should be assessed as to whether it’s applied for future diseases? Once the precedent is set, is there an argument that this technology might be used to combat&nbsp;<em>pre-existing</em>&nbsp;infectious diseases? It’s foreseeable that different societies will evaluate the trade-offs differently.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III - The balance of Proportionality requires a three party test :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Fundamental rights, enshrined in the Charter of Fundamental Rights of the European Union constitute the core values of the European Union . These rights must be respected whenever the EU institutions and bodies design and implement new policies or adopt any new legislative measure and in the ECHR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU law which requires that \"<em>the content and form of Union action shall not exceed what is necessary to achieve the objectives of the treaties\"</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives\" . It therefore \"restricts the authorities in the exercise of their powers by requiring a balance to be struck between the means used and the intended aim (or Under Article 52(1) of the Charter, \"subject to the principle of proportionality, limitations </em><a href=\"#\"><em>onresult reached)\" the exercise of fundamental rights</em></a><em> may be made only if they are necessary (...</em>)\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The necessity</strong>, Something needs to be done to end this national confinement killing the country’s economy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the Data Protection Impact Assessment published by <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e. V. .</a> They recommend that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> An appropriate legal basis must be established and in this respect responsibilities have to be defined. </li><li>Reinforcing the measures of pseudonymisation \'when creating the TempIDs in the app, it must be ensured that there is no connection between TempIDs and it must never be possible to make one. ...The server(s)’ operator must employ an effective separation method...\'</li><li>Accompanying the publication of the app it must be ensured in law and in fact that users have to disclose neither the status of the app nor the mere existence on a device to third parties. </li><li>Before the app gets published, a comprehensive investigation of the software and the overall system must be conducted and published by an independent body. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2- Could the same result be achieved in a less intrusive way?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I would argue providing tests,, masks, ventilators and resources to over loaded NHS staff will bring a serious improvement with any inconvenient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The cost of the deployment of the NHSX App is unknown. The Australian Government would have allegedly spend 700.000 AUD just to host the data in Amazon AWS clouds. This is how much less resource the NHS will receive.<a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">h</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://martinralbrecht.wordpress.com/2020/05/03/open-letters-v-surveillance/﻿\">A letter, signed by 177 scientists and researchers working in the UK in the fields of information security and privacy, reads: </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<em>Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified.1 Such invasive information can include the ‘social graph’ of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens’ real-world activities.</em>”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.wired.co.uk/article/contact-tracing-apps-coronavirus\"><strong>IV - Coronavirus contact tracing apps were meant to save us</strong></a><strong>. They won’t. ‘With little evidence to show how effective such apps are and growing privacy concerns, there’s a risk they could do more harm than good‘ </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>From Iceland to Israel,&nbsp;</em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\"><em>more than 30 systems</em></a><em>&nbsp;are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>False alerts might loose users trust. An Oxford research said that the probability of seeing any result from the tracing Apps requires that at least 60% of the population use the App. Will the most vulnerable population of over 60% be willing to download and use it ? Will the government be liable for the false alters causing distress, unnecessary isolation and loss of revenues? France is talking of self isolating in hotels, where and how feed and entertain these people? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Elsewhere projects using personal data to combat SARS-CoV-2 </a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://tracetogether.zendesk.com/hc/en-sg/articles/360046475654-20-April-2020-One-Month-On\"><em>Singapour’s TraceTogether App</em></a><em> moved to the The Apple and Google collaboration on digital contact tracing solutions, is a game-changer, as we said previously. It will significantly improve the contact tracing capability available to governments and public health authorities over what is available through public APIs on either Android or iOS platforms. We are glad that Apple and Google are engaging governments and public health authorities around the world, including us, to incorporate feedback as the specifications for their contract tracing protocol and private APIs.  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=e6e61ca3-45ae-49a0-b6f1-5fd4adf11291\">In Poland</a>, Although initially voluntary in nature, it has become mandatory for all those under obligatory quarantine or epidemiological surveillance, as a tool to confirm compliance with quarantine obligations (e.g. whether the ban on leaving the quarantine location is observed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Contact tracing apps in Austria: a Red Cross initiative |Has been launched In March 2020 in co-operation with Accenture. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The first published version of the Stopp Corona app required users to log their contacts via a \'manual\' handshake. In the current version, however, the app already allows contacts to be traced automatically, depending on the device and its configuration.&nbsp;</em></p><p><em>The automatic handshake functionality is based on the discovery and messaging functionality of the p2pkit developed by the Swiss company Uepaa, which uses Bluetooth and Wifi-direct techniques to determine the distance between the users.&nbsp;</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Switzerland: \"WeTrace\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>This project is ready to be deployed. It is open source. All data remains locally on the devices. Packaged information encrypted asymmetrically. The sole information a potential malfeasor on the central server would see is the fact _that_ an infected person has actually pushed a status update, but on the core server it is not visible \"what\" the person has broadcasted. The broadcasting user can determine the details of what should be broadcasted aside from status (location of contact, time of contact, etc.). Packages will be sent not to everyone but only to those that need to know.</em></p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Spain: \"Open Coronavirus\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The Spanish medical investigator Aurelia Bustos has released Open Coronavirus, an open-source app with the aim to copy the advantages of the South-Korean app: in the end, serving as an individual-validation-method in order to allow free movement of the citizens. This tool can be used by any public institution as a basis for its own apps on tracking citizens due to the coronavirus emergency, and it offers a modular design: three levels of management (mobile phone, central management of data by the competent authority and checking of the control points by the competent authority too) with different options of geolocation (GPS, bluetooth, positioning by mobile operators cells) that could be implemented or not by the corresponding institution. Its use would be voluntary for the citizen (although, in words of the medical investigator, \"it would be probably very advantageous for the user, as it would allow him/her to have the possibility to finish an eventually longer quarantine\"), and it would necessarily depend on the realization of any kind of coronavirus detection tests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>As this is an open-source app, that it will not be officially published in its current status, and any use of the same by any institutons must be always in line with GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, it can be said of the NHSX Tracing App, similar to the French STOPCOVID, that <a href=\"https://www.lemonde.fr/idees/article/2020/04/25/stopcovid-est-un-projet-desastreux-pilote-par-des-apprentis-sorciers_6037721_3232.html\">«&nbsp;StopCovid est un projet désastreux piloté par des apprentis sorciers&nbsp;»</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE 8th May</strong>, The Financial Times reveals \'<a href=\"https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b\">UK starts to build second contact tracing app</a>\' going for a decentralised model in collaboration with Apple and Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The different existing systems&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">The Chinese System based on geolocation</a></li><li><a href=\"https://github.com/DP-3T/documents\">The DP3T</a> Protocol&nbsp;(sous diverses variantes), sa déclinaison par l’alliance&nbsp;</li><li><a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a>&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\"> PACT- Est</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://pact.mit.edu/\">PACT-Ouest</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://github.com/TCNCoalition/TCN\">TCN</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">ROBERT</a> Protocol&nbsp;.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Liste of <a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Projects using personal data to combat SARS-CoV-2</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDRI <a href=\"https://edri.org/covid-19-digital-rights-document-pool/\">COVID-19 &amp; Digital Rights: Document Pool</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/sites/edp/files/publication/20-05-08_techdispatch-tracing_en.pdf\">Techdispatch&nbsp;\'</a>Contact Tracing with Mobile Applications\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:gallery {\"ids\":[930,931,932]} -->\n<ul class=\"wp-block-gallery columns-3 is-cropped\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQe2X0AE1.png\" alt=\"\" data-id=\"930\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqe2x0ae1/\" class=\"wp-image-930\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQexXQAYJ2.png\" alt=\"\" data-id=\"931\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqexxqayj2/\" class=\"wp-image-931\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQfQX0AEk3.png\" alt=\"\" data-id=\"932\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqfqx0aek3/\" class=\"wp-image-932\" /></figure></li></ul>\n<!-- /wp:gallery -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">Privacy International : A technical deep-dive into the NHS COVID-19 contact tracing app</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":933} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/EXethgcXgAAF4.jpeg\" alt=\"\" class=\"wp-image-933\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.privacyinternational.org/long-read/3752/coronavirus-tracking-uk-what-we-know-so-far\">UK government Covid tracking app: what you need to know!</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A SPECIAL THANK YOU TO GRAEME McGOWAN for allowing me to use his beautiful photography.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','NHSX Contacts Tracing App','Is NHSX UK centralised Tracing APP capable of best combat the COVID19 propagation? the Balance of proportionality looks rather weak. ','inherit','closed','closed','','898-revision-v1','','','2020-05-08 11:30:17','2020-05-08 10:30:17','',898,'https://datarainbow.eu/2020/05/08/898-revision-v1/',0,'revision','',0),(941,5,'2020-05-08 11:32:17','2020-05-08 10:32:17','<!-- wp:paragraph -->\n<p>In UK, like in many countries a contract tracing app act is presented as the solution to get out of lockdown. Is technology really the right solution?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been written and the debate is still ongoing. We have published an article on <a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">the French government project of STOPCOVID. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK NHSX project is another centralised contact tracing App. A first tryout has started on the Isle of Wight since Tuesday May 2nd.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">I - </a>A<strong>nalysing the data protection compliance aspects of the project, from&nbsp;</strong><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\"><strong>Chris Pounder of Amber-walk has published his&nbsp;views</strong></a><strong> </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">COVID-19: how the GDPR applies to trace and track.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Emphasis is put in the voluntary adoption of the measure as requested by most EU Data Protection Authorties.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Chris Pounder develops, ‘<em>NHSX claim that every operation related to the APP is voluntary (e.g. to download, to communicate to a central database if need be). Users can choose to delete the APP at any time; this would also delete the data on the phone but not any data previously uploaded to NHSX’s central database.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data is pseudonymised more than anonymised as it can be re-identifiable, therefore it will be the GDPR and not the ePrivacy Directive that will apply</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a published DPIA, Chris reminds the government promise that ‘T<em>he APP does not use any identifier already on the phone (e.g. phone number, SIM card identifier) or location details.’ The APP generates a random ID number exchanged with other phones that have also downloaded the APP. This record will remain on both phones for 14 days. When someone is COVID+ this record will trace back the contacts with a warning message for the user</em> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- The APP should not keep any personal information and no location data. Only the first half of the postcode is collected from APP users to alert local hospitals.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, for <a href=\"https://tech.newstatesman.com/coronavirus/uncertainty-over-who-could-access-nhsx-contact-tracing-app-data-as-pilot-goes-live\">Laurie Clarke reporter</a>, remains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Uncertainty over who could access NHSX contact tracing app data as Isle of White pilot goes live’. ‘The NHSX coronavirus contact tracing app is being rolled out on the Isle of Wight this week, but major question marks still hang over the app. Matthew Gould, CEO of NHSX, told parliament today that the data collected by the app would be accessible to unspecified organisations as long as it was used for public health purposes. ‘</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>3- For Chris Pounder, ‘</strong><em><strong>there are three definitional issues:</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>(<em>a) is personal data processed? </em></li><li><em>b) if so, who is the controller processing personal data? and </em></li><li><em>(c) if there is a controller, does the voluntary nature of the APP equate to “data subject consent”?</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject is identifiable and the data related to medical health. He is therefore ‘<em>pretty sure the APP is processing personal data and special category of personal data</em>’, subject to the Article 6  lawful basis and a condition that overcomes the prohibition in Article 9(1) from processing health personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Controller, there would be joint controllers as he points to the NHSX website stating that “<em>NHS England and NHS Improvement and the Department of Health and Social Care are delivering NHSX together” This bring to the Article 26 that requires any processing of personal data “shall in a transparent manner determine their respective responsibilities</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the emphasis is on the voluntary adoption of the App, the next question  is on ”<em>data subject consent</em>”. Chris points out that <em>‘the NHS text on the website is very careful to avoid the use of the “C word” and it is easy to see why</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 states that with respect to consent: “<em>consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller</em>” This will be the case where the controller is a public authority or an employer. It will be unlikely for that consent to be considered as ‘<em>freely given</em>’. Therefore voluntary adoption does not refer the character of legitimate basis on consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The limit of the ‘<em>voluntary</em>’ adoption he sees is that it could lead to a denial of a service as previously for the ‘<em>ID Card holders refused to “volunteer” making it a requirement to interact with any public service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The first comment is that any interference by a public authority (NHSX) is unlikely to infringe Article 8(1) [_<a href=\"https://awallon.com:15001/oo/r/546619490369058645\">GDPR08</a>_]&nbsp;of the European Convention on Human Rights; This is because Article 8(2) permits legislation to be enacted by a Parliament process (e.g. in the Coronavirus 2 which sets aside the A.8(1) right in limited circumstances (e.g. any interference deemed&nbsp;<strong><em>necessary</em></strong>&nbsp; “<em>for the protection of health</em>”).&nbsp; It all hangs on the word “<em>necessary</em>”; it is either necessary or it isn’t. If there is reliance on data subject consent (which we think is unreliable), then there is also no A.8 breach (so long consent is properly formed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the GDPR/DPA2018,  <em>‘if the processing is “necessary” it will have Article 6 lawful basis (e.g. candidates are A.6(1)(c) or A.6(1)(e); A.6(1)(d) could be used in a case-by-case emergency). If there is need for an A.9 condition that lifts the prohibition on processing of health personal data the candidates are A.9(2)(c), A.9(2)(g), A.9(1)(i), Schedule 1, paragraphs2, 3 or 6 of the DPA2018</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>If there is reliance on consent or necessary or public task (or even necessary legitimate interests of controller/Third Party), the controller has to specify publicly (A.13; A.14) what happens to the personal data if there withdrawal of consent or exercise of the exercise of the right to object to the processing.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in he concludes ‘<em>the ICO should take up Article 8 ECHR cases on the grounds that necessary as used in the GDPR has the same meaning as in Article 8.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>II - The UK like France has opted for the centralised model </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The App is encountering technical issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.iacr.org/misc/statement-May2014.html\">UK ICO</a> like the <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">French CNIL</a> have expressed their preference for the decentralised model for a decentralised model. Chris Pounder sees further vulnerability of the centralised approach  with a ‘<em>future legislative mood of Government</em>’. He believes ‘<em>It could be tempting (e.g. to reduce the pressures on the public purse) for Government to enact legislation that makes certain processing of personal data compulsory. For instance, to prove entitlement to a COVID related benefit</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> <em>\'Considering to revert to a decentralised model to resolve their Bluetooth issues. ‘Covidsafe app is not working properly on iPhones, authorities admit’ ‘Australians running the Covidsafe contact tracing app on iPhones may not be recording all the data required if they don’t have the app running in the foreground or they are using an older model phone, the government has admitted.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://uk.reuters.com/article/us-health-coronavirus-france-tech/france-accuses-apple-of-refusing-help-with-stopcovid-app-idUKKBN22H0LX\">France is struggling to find an agreement with Apple and Google</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theguardian.com/world/2020/may/06/covidsafe-app-is-not-working-properly-on-iphones-authorities-admit\">Australia who has already deployed the App has been struggling technically </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/\">The Register</a> wrote: ‘<em>UK finds itself almost alone with centralized virus contact-tracing app that probably won\'t work well, asks for your location, may be illegal’. ‘On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in the Isle of Wight – will work, and why it is a better solution to the one by Apple and Google that other nations have decided to adopt. It has also released a more technical explanation</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Running the Bluetooth connection in the back has several inconvenience such as draining the battery and opening security vulnerabilities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, the Bluetooth distance measurement is unreliable <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">according to its own inventor</a>. Bluetooth signals can pierce obstacles the virus hopefully cannot such as a wall or vehicle bodies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The margin of error has caused a return to lock down in Singapore, one of the first nations after China to deploy TraceTogether App. Less than 20% of the population actually downloaded the App It is suspected that Bluetooth works through glass and even some walls and may even be triggered by reflection in windows in buildings. Jason Bay Senior Director (Government Digital Services) at the Government Technology Agency, Singapore&nbsp;<a href=\"https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98\">wrote</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain ? (throw whatever buzzword you want), not for the foreseeabl</em>e future.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The amount of <strong>false alerts</strong> will cause major distress and reduce trust on the App. When someone receives the warning SMS that they have been in contact with someone COVID+, that doesn\'t mean the NHS can test them immediately. They might be asked to self isolate themselves which is not always technically possibly. It has been suggested in France that they would be hotels dedicated to quarantine. That means 14 days of accommodation, food and entertainment. During which time the person and his family or network will be under distress, maybe unnecessarily isolated causing loss of revenues. Should the government be liable for all that ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- These Apps are source of security issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The well known and security expert Bruce Schneier has expressed his concerns about the issues of using Bluetooth Technology <a href=\"https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"My problem with contact tracing apps is that they have absolutely no value,\" Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet &amp; Society at Harvard University, told BuzzFeed News. \"I\'m not even talking about the privacy concerns, I mean the efficacy. Does anybody think this will do something useful? ... This is just something governments want to do for the hell of it. To me, it\'s just techies doing techie things because they don\'t know what else to do.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">SecurityWeek reporter Kevin Townsend wrote</a> ‘<em>These apps could easily become subject to a high number of false positives – and false positives always lead to a rejection by users. ‘ que faire du stresse, isolation et perte de revenus consécutives au faux positives alertes? Le BT transverse les murs et un automobiliste à proximité pourrait être décelé conne en ‘contact’</em> .  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">As contact tracing gains attention, a researcher pokes a hole in Bluetooth technology</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>If someone is reluctant to self quarantine, will they ignore the warning messages ?</li><li>The most at risk populations are the over 60x, will they be willing to download the app ?</li><li>What are going the security issues of opening the Bluetooth connection be?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Any data base creates security issues. New NHS contact-tracing app vulnerable to ‘<em>malicious false alerts</em>’, warn experts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Additionaly, ‘<em>The new NHS contact-tracing app could be used to send malicious alerts causing people to isolate unnecessarily, it has been warned.</em></p><p><em>The app, which is being trialled in the Isle of Wight, tells users if someone they have been in proximity with may be suffering from coronavirus, meaning they could be exposed.</em></p><p><em>But because users can set off the warnings themselves by reporting symptoms – rather than positive Covid-19 test results – it could be used to send out false alerts.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\'Dr Michael Veale, a lecturer in digital rights and regulation at University College London who this week gave evidence to MPs on the technology, told The Independent that Britain’s tracing app had nothing to stop individuals “maliciously triggering notifications” using its normal functionality.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“People can deliberately put others into quarantine or report large areas,” he said. “A child could try to get a day off school by reporting symptoms from a parent’s phone to trigger a quarantine.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Constant Bluetooth signals in the back will drain the phone battery eventually causing over heating. Will be see a new epidemic of ‘pockets in fire’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ICAR, the Association of  experts in Cryptologic research has issued a statement against mass surveillance <a href=\"https://www.iacr.org/misc/statement-May2014.html\">\'The Copenhagen Resolution\'</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards. Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> <a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">A technical deep-dive into the NHS COVID-19 contact tracing app</a> : Since \'<em>the contact tracing beta is now open source for both&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-iOS-BETA\" target=\"_blank\"><em>iOS</em></a><em>&nbsp;and&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Android-BETA\" target=\"_blank\"><em>Android</em></a><em>, along with some&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Documentation-BETA\" target=\"_blank\"><em>documentation</em></a><em>. As a follow-up to our “</em><a href=\"https://reincubate.com/blog/staying-alive-covid-19-background-tracing/\"><em>Staying alive</em></a><em>” post, we’ve taken a deep-dive into the source code. It’s pleasantly surprising to find it licensed under MIT, indicating an NHSX commitment to transparency and quality... There have been claims that the Android app accesses location data, as the prompt for Bluetooth API access on Android devices appears to ask for location permissions. However, we debunked this yesterday: this is a consequence of how Android&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://developer.android.com/guide/topics/connectivity/bluetooth#Permissions\" target=\"_blank\"><em>manages requests for Bluetooth permissions</em></a><em>.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Reincubate’s CEO, Aidan Fitzpatrick, says:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, it is the case that the coming Apple&nbsp;<code>ExposureNotification</code>&nbsp;framework in iOS 13.5 obviates the need for these keepalives. However, it’s worth noting that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>iOS 13.5 has not been released, and may not be for some weeks</li><li>Prior to yesterday, the last iOS 13.5 beta had a&nbsp;<a href=\"https://siguza.github.io/psychicpaper/\" rel=\"noreferrer noopener\" target=\"_blank\">major security flaw</a>, suggesting heavy lifting is going on in Apple’s engineering teams</li><li>Once it is released, it will&nbsp;<a href=\"https://venturebeat.com/2020/01/29/as-ios-and-ipados-13-near-80-adoption-is-the-race-with-android-over/\" rel=\"noreferrer noopener\" target=\"_blank\">likely take months</a>&nbsp;for a majority of iOS users to install it (unusually, the equivalent Android adoption may be&nbsp;<a href=\"https://www.theverge.com/2020/4/13/21220033/android-covid-19-tracking-updates-google-play-contact-tracing\" rel=\"noreferrer noopener\" target=\"_blank\">more rapid</a>)</li><li>Older iOS devices — such as the iPhone 6 — cannot run iOS 13, and will not be able to use the Apple technique</li><li><em>There’s no reason why the NHS COVID-19 app won’t be able to automatically transition in future to using Apple’s framework — or even dual-running both mechanisms</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The app will become increasingly effective as more people use it, and the benefit of mass adoption will create a flywheel effect in this sense. The Australian COVIDSafe app struggled as it didn’t support detecting backgrounded iOS devices from an Android device, and it didn’t have this clever iOS-to-iOS keepalive mechanism.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to reflect on which circumstances make use of technology like this appropriate. If contact tracing is successful in saving lives, which criteria should be assessed as to whether it’s applied for future diseases? Once the precedent is set, is there an argument that this technology might be used to combat&nbsp;<em>pre-existing</em>&nbsp;infectious diseases? It’s foreseeable that different societies will evaluate the trade-offs differently.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III - The balance of Proportionality requires a three party test :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Fundamental rights, enshrined in the Charter of Fundamental Rights of the European Union constitute the core values of the European Union . These rights must be respected whenever the EU institutions and bodies design and implement new policies or adopt any new legislative measure and in the ECHR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU law which requires that \"<em>the content and form of Union action shall not exceed what is necessary to achieve the objectives of the treaties\"</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives\" . It therefore \"restricts the authorities in the exercise of their powers by requiring a balance to be struck between the means used and the intended aim (or Under Article 52(1) of the Charter, \"subject to the principle of proportionality, limitations </em><a href=\"#\"><em>onresult reached)\" the exercise of fundamental rights</em></a><em> may be made only if they are necessary (...</em>)\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The necessity</strong>, Something needs to be done to end this national confinement killing the country’s economy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the Data Protection Impact Assessment published by <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e. V. .</a> They recommend that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> An appropriate legal basis must be established and in this respect responsibilities have to be defined. </li><li>Reinforcing the measures of pseudonymisation \'when creating the TempIDs in the app, it must be ensured that there is no connection between TempIDs and it must never be possible to make one. ...The server(s)’ operator must employ an effective separation method...\'</li><li>Accompanying the publication of the app it must be ensured in law and in fact that users have to disclose neither the status of the app nor the mere existence on a device to third parties. </li><li>Before the app gets published, a comprehensive investigation of the software and the overall system must be conducted and published by an independent body. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2- Could the same result be achieved in a less intrusive way?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I would argue providing tests,, masks, ventilators and resources to over loaded NHS staff will bring a serious improvement with any inconvenient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The cost of the deployment of the NHSX App is unknown. The Australian Government would have allegedly spend 700.000 AUD just to host the data in Amazon AWS clouds. This is how much less resource the NHS will receive.<a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">h</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://martinralbrecht.wordpress.com/2020/05/03/open-letters-v-surveillance/﻿\">A letter, signed by 177 scientists and researchers working in the UK in the fields of information security and privacy, reads: </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<em>Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified.1 Such invasive information can include the ‘social graph’ of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens’ real-world activities.</em>”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.wired.co.uk/article/contact-tracing-apps-coronavirus\"><strong>IV - Coronavirus contact tracing apps were meant to save us</strong></a><strong>. They won’t. ‘With little evidence to show how effective such apps are and growing privacy concerns, there’s a risk they could do more harm than good‘ </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>From Iceland to Israel,&nbsp;</em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\"><em>more than 30 systems</em></a><em>&nbsp;are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>False alerts might loose users trust. An Oxford research said that the probability of seeing any result from the tracing Apps requires that at least 60% of the population use the App. Will the most vulnerable population of over 60% be willing to download and use it ? Will the government be liable for the false alters causing distress, unnecessary isolation and loss of revenues? France is talking of self isolating in hotels, where and how feed and entertain these people? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Elsewhere projects using personal data to combat SARS-CoV-2 </a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://tracetogether.zendesk.com/hc/en-sg/articles/360046475654-20-April-2020-One-Month-On\"><em>Singapour’s TraceTogether App</em></a><em> moved to the The Apple and Google collaboration on digital contact tracing solutions, is a game-changer, as we said previously. It will significantly improve the contact tracing capability available to governments and public health authorities over what is available through public APIs on either Android or iOS platforms. We are glad that Apple and Google are engaging governments and public health authorities around the world, including us, to incorporate feedback as the specifications for their contract tracing protocol and private APIs.  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=e6e61ca3-45ae-49a0-b6f1-5fd4adf11291\">In Poland</a>, Although initially voluntary in nature, it has become mandatory for all those under obligatory quarantine or epidemiological surveillance, as a tool to confirm compliance with quarantine obligations (e.g. whether the ban on leaving the quarantine location is observed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Contact tracing apps in Austria: a Red Cross initiative |Has been launched In March 2020 in co-operation with Accenture. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The first published version of the Stopp Corona app required users to log their contacts via a \'manual\' handshake. In the current version, however, the app already allows contacts to be traced automatically, depending on the device and its configuration.&nbsp;</em></p><p><em>The automatic handshake functionality is based on the discovery and messaging functionality of the p2pkit developed by the Swiss company Uepaa, which uses Bluetooth and Wifi-direct techniques to determine the distance between the users.&nbsp;</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Switzerland: \"WeTrace\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>This project is ready to be deployed. It is open source. All data remains locally on the devices. Packaged information encrypted asymmetrically. The sole information a potential malfeasor on the central server would see is the fact _that_ an infected person has actually pushed a status update, but on the core server it is not visible \"what\" the person has broadcasted. The broadcasting user can determine the details of what should be broadcasted aside from status (location of contact, time of contact, etc.). Packages will be sent not to everyone but only to those that need to know.</em></p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Spain: \"Open Coronavirus\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The Spanish medical investigator Aurelia Bustos has released Open Coronavirus, an open-source app with the aim to copy the advantages of the South-Korean app: in the end, serving as an individual-validation-method in order to allow free movement of the citizens. This tool can be used by any public institution as a basis for its own apps on tracking citizens due to the coronavirus emergency, and it offers a modular design: three levels of management (mobile phone, central management of data by the competent authority and checking of the control points by the competent authority too) with different options of geolocation (GPS, bluetooth, positioning by mobile operators cells) that could be implemented or not by the corresponding institution. Its use would be voluntary for the citizen (although, in words of the medical investigator, \"it would be probably very advantageous for the user, as it would allow him/her to have the possibility to finish an eventually longer quarantine\"), and it would necessarily depend on the realization of any kind of coronavirus detection tests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>As this is an open-source app, that it will not be officially published in its current status, and any use of the same by any institutons must be always in line with GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, it can be said of the NHSX Tracing App, similar to the French STOPCOVID, that <a href=\"https://www.lemonde.fr/idees/article/2020/04/25/stopcovid-est-un-projet-desastreux-pilote-par-des-apprentis-sorciers_6037721_3232.html\">«&nbsp;StopCovid est un projet désastreux piloté par des apprentis sorciers&nbsp;»</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE 8th May</strong>, The Financial Times reveals \'<a href=\"https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b\">UK starts to build second contact tracing app</a>\' going for a decentralised model in collaboration with Apple and Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The different existing systems&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">The Chinese System based on geolocation</a></li><li><a href=\"https://github.com/DP-3T/documents\">The DP3T</a> Protocol&nbsp;(sous diverses variantes), sa déclinaison par l’alliance&nbsp;</li><li><a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a>&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\"> PACT- Est</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://pact.mit.edu/\">PACT-Ouest</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://github.com/TCNCoalition/TCN\">TCN</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">ROBERT</a> Protocol&nbsp;.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Liste of <a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Projects using personal data to combat SARS-CoV-2</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDRI <a href=\"https://edri.org/covid-19-digital-rights-document-pool/\">COVID-19 &amp; Digital Rights: Document Pool</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/sites/edp/files/publication/20-05-08_techdispatch-tracing_en.pdf\">Techdispatch&nbsp;\'</a>Contact Tracing with Mobile Applications\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:gallery {\"ids\":[930,931,932]} -->\n<ul class=\"wp-block-gallery columns-3 is-cropped\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQe2X0AE1.png\" alt=\"\" data-id=\"930\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqe2x0ae1/\" class=\"wp-image-930\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQexXQAYJ2.png\" alt=\"\" data-id=\"931\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqexxqayj2/\" class=\"wp-image-931\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQfQX0AEk3.png\" alt=\"\" data-id=\"932\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqfqx0aek3/\" class=\"wp-image-932\" /></figure></li></ul>\n<!-- /wp:gallery -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">Privacy International : A technical deep-dive into the NHS COVID-19 contact tracing app</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":933} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/EXethgcXgAAF4.jpeg\" alt=\"\" class=\"wp-image-933\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.privacyinternational.org/long-read/3752/coronavirus-tracking-uk-what-we-know-so-far\">UK government Covid tracking app: what you need to know!</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A SPECIAL THANK YOU TO GRAEME McGOWAN for allowing me to use his beautiful photography.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','NHSX Contacts Tracing App','Is NHSX UK centralised Tracing APP capable of best combat the COVID19 propagation? the Balance of proportionality looks rather weak. ','inherit','closed','closed','','898-revision-v1','','','2020-05-08 11:32:17','2020-05-08 10:32:17','',898,'https://datarainbow.eu/2020/05/08/898-revision-v1/',0,'revision','',0),(943,5,'2020-05-08 11:53:54','2020-05-08 10:53:54','<!-- wp:paragraph -->\n<p>In UK, like in many countries a contract tracing app act is presented as the solution to get out of lockdown. Is technology really the right solution?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been written and the debate is still ongoing. We have published an article on <a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">the French government project of STOPCOVID. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK NHSX project is another centralised contact tracing App. A first tryout has started on the Isle of Wight since Tuesday May 2nd.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">I - </a>A<strong>nalysing the data protection compliance aspects of the project, from&nbsp;</strong><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\"><strong>Chris Pounder of Amber-walk has published his&nbsp;views</strong></a><strong> </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">COVID-19: how the GDPR applies to trace and track.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Emphasis is put in the voluntary adoption of the measure as requested by most EU Data Protection Authorties.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Chris Pounder develops, ‘<em>NHSX claim that every operation related to the APP is voluntary (e.g. to download, to communicate to a central database if need be). Users can choose to delete the APP at any time; this would also delete the data on the phone but not any data previously uploaded to NHSX’s central database.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data is pseudonymised more than anonymised as it can be re-identifiable, therefore it will be the GDPR and not the ePrivacy Directive that will apply</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a published DPIA, Chris reminds the government promise that ‘T<em>he APP does not use any identifier already on the phone (e.g. phone number, SIM card identifier) or location details.’ The APP generates a random ID number exchanged with other phones that have also downloaded the APP. This record will remain on both phones for 14 days. When someone is COVID+ this record will trace back the contacts with a warning message for the user</em> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- The APP should not keep any personal information and no location data. Only the first half of the postcode is collected from APP users to alert local hospitals.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, for <a href=\"https://tech.newstatesman.com/coronavirus/uncertainty-over-who-could-access-nhsx-contact-tracing-app-data-as-pilot-goes-live\">Laurie Clarke reporter</a>, remains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Uncertainty over who could access NHSX contact tracing app data as Isle of White pilot goes live’. ‘The NHSX coronavirus contact tracing app is being rolled out on the Isle of Wight this week, but major question marks still hang over the app. Matthew Gould, CEO of NHSX, told parliament today that the data collected by the app would be accessible to unspecified organisations as long as it was used for public health purposes. ‘</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>3- For Chris Pounder, ‘</strong><em><strong>there are three definitional issues:</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>(<em>a) is personal data processed? </em></li><li><em>b) if so, who is the controller processing personal data? and </em></li><li><em>(c) if there is a controller, does the voluntary nature of the APP equate to “data subject consent”?</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject is identifiable and the data related to medical health. He is therefore ‘<em>pretty sure the APP is processing personal data and special category of personal data</em>’, subject to the Article 6  lawful basis and a condition that overcomes the prohibition in Article 9(1) from processing health personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Controller, there would be joint controllers as he points to the NHSX website stating that “<em>NHS England and NHS Improvement and the Department of Health and Social Care are delivering NHSX together” This bring to the Article 26 that requires any processing of personal data “shall in a transparent manner determine their respective responsibilities</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the emphasis is on the voluntary adoption of the App, the next question  is on ”<em>data subject consent</em>”. Chris points out that <em>‘the NHS text on the website is very careful to avoid the use of the “C word” and it is easy to see why</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 states that with respect to consent: “<em>consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller</em>” This will be the case where the controller is a public authority or an employer. It will be unlikely for that consent to be considered as ‘<em>freely given</em>’. Therefore voluntary adoption does not refer the character of legitimate basis on consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The limit of the ‘<em>voluntary</em>’ adoption he sees is that it could lead to a denial of a service as previously for the ‘<em>ID Card holders refused to “volunteer” making it a requirement to interact with any public service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The first comment is that any interference by a public authority (NHSX) is unlikely to infringe Article 8(1) [_<a href=\"https://awallon.com:15001/oo/r/546619490369058645\">GDPR08</a>_]&nbsp;of the European Convention on Human Rights; This is because Article 8(2) permits legislation to be enacted by a Parliament process (e.g. in the Coronavirus 2 which sets aside the A.8(1) right in limited circumstances (e.g. any interference deemed&nbsp;<strong><em>necessary</em></strong>&nbsp; “<em>for the protection of health</em>”).&nbsp; It all hangs on the word “<em>necessary</em>”; it is either necessary or it isn’t. If there is reliance on data subject consent (which we think is unreliable), then there is also no A.8 breach (so long consent is properly formed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the GDPR/DPA2018,  <em>‘if the processing is “necessary” it will have Article 6 lawful basis (e.g. candidates are A.6(1)(c) or A.6(1)(e); A.6(1)(d) could be used in a case-by-case emergency). If there is need for an A.9 condition that lifts the prohibition on processing of health personal data the candidates are A.9(2)(c), A.9(2)(g), A.9(1)(i), Schedule 1, paragraphs2, 3 or 6 of the DPA2018</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>If there is reliance on consent or necessary or public task (or even necessary legitimate interests of controller/Third Party), the controller has to specify publicly (A.13; A.14) what happens to the personal data if there withdrawal of consent or exercise of the exercise of the right to object to the processing.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in he concludes ‘<em>the ICO should take up Article 8 ECHR cases on the grounds that necessary as used in the GDPR has the same meaning as in Article 8.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>II - The UK like France has opted for the centralised model </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The App is encountering technical issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.iacr.org/misc/statement-May2014.html\">UK ICO</a> like the <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">French CNIL</a> have expressed their preference for the decentralised model for a decentralised model. Chris Pounder sees further vulnerability of the centralised approach  with a ‘<em>future legislative mood of Government</em>’. He believes ‘<em>It could be tempting (e.g. to reduce the pressures on the public purse) for Government to enact legislation that makes certain processing of personal data compulsory. For instance, to prove entitlement to a COVID related benefit</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> <em>\'Considering to revert to a decentralised model to resolve their Bluetooth issues. ‘Covidsafe app is not working properly on iPhones, authorities admit’ ‘Australians running the Covidsafe contact tracing app on iPhones may not be recording all the data required if they don’t have the app running in the foreground or they are using an older model phone, the government has admitted.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://uk.reuters.com/article/us-health-coronavirus-france-tech/france-accuses-apple-of-refusing-help-with-stopcovid-app-idUKKBN22H0LX\">France is struggling to find an agreement with Apple and Google</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theguardian.com/world/2020/may/06/covidsafe-app-is-not-working-properly-on-iphones-authorities-admit\">Australia who has already deployed the App has been struggling technically </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/\">The Register</a> wrote: ‘<em>UK finds itself almost alone with centralized virus contact-tracing app that probably won\'t work well, asks for your location, may be illegal’. ‘On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in the Isle of Wight – will work, and why it is a better solution to the one by Apple and Google that other nations have decided to adopt. It has also released a more technical explanation</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Running the Bluetooth connection in the back has several inconvenience such as draining the battery and opening security vulnerabilities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, the Bluetooth distance measurement is unreliable <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">according to its own inventor</a>. Bluetooth signals can pierce obstacles the virus hopefully cannot such as a wall or vehicle bodies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The margin of error has caused a return to lock down in Singapore, one of the first nations after China to deploy TraceTogether App. Less than 20% of the population actually downloaded the App It is suspected that Bluetooth works through glass and even some walls and may even be triggered by reflection in windows in buildings. Jason Bay Senior Director (Government Digital Services) at the Government Technology Agency, Singapore&nbsp;<a href=\"https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98\">wrote</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain ? (throw whatever buzzword you want), not for the foreseeabl</em>e future.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The amount of <strong>false alerts</strong> will cause major distress and reduce trust on the App. When someone receives the warning SMS that they have been in contact with someone COVID+, that doesn\'t mean the NHS can test them immediately. They might be asked to self isolate themselves which is not always technically possibly. It has been suggested in France that they would be hotels dedicated to quarantine. That means 14 days of accommodation, food and entertainment. During which time the person and his family or network will be under distress, maybe unnecessarily isolated causing loss of revenues. Should the government be liable for all that ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- These Apps are source of security issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The well known and security expert Bruce Schneier has expressed his concerns about the issues of using Bluetooth Technology <a href=\"https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"My problem with contact tracing apps is that they have absolutely no value,\" Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet &amp; Society at Harvard University, told BuzzFeed News. \"I\'m not even talking about the privacy concerns, I mean the efficacy. Does anybody think this will do something useful? ... This is just something governments want to do for the hell of it. To me, it\'s just techies doing techie things because they don\'t know what else to do.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">SecurityWeek reporter Kevin Townsend wrote</a> ‘<em>These apps could easily become subject to a high number of false positives – and false positives always lead to a rejection by users. ‘ que faire du stresse, isolation et perte de revenus consécutives au faux positives alertes? Le BT transverse les murs et un automobiliste à proximité pourrait être décelé conne en ‘contact’</em> .  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">As contact tracing gains attention, a researcher pokes a hole in Bluetooth technology</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>If someone is reluctant to self quarantine, will they ignore the warning messages ?</li><li>The most at risk populations are the over 60x, will they be willing to download the app ?</li><li>What are going the security issues of opening the Bluetooth connection be?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Any data base creates security issues. New NHS contact-tracing app vulnerable to ‘<em>malicious false alerts</em>’, warn experts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Additionaly, ‘<em>The new NHS contact-tracing app could be used to send malicious alerts causing people to isolate unnecessarily, it has been warned.</em></p><p><em>The app, which is being trialled in the Isle of Wight, tells users if someone they have been in proximity with may be suffering from coronavirus, meaning they could be exposed.</em></p><p><em>But because users can set off the warnings themselves by reporting symptoms – rather than positive Covid-19 test results – it could be used to send out false alerts.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\'Dr Michael Veale, a lecturer in digital rights and regulation at University College London who this week gave evidence to MPs on the technology, told The Independent that Britain’s tracing app had nothing to stop individuals “maliciously triggering notifications” using its normal functionality.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“People can deliberately put others into quarantine or report large areas,” he said. “A child could try to get a day off school by reporting symptoms from a parent’s phone to trigger a quarantine.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Constant Bluetooth signals in the back will drain the phone battery eventually causing over heating. Will be see a new epidemic of ‘pockets in fire’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ICAR, the Association of  experts in Cryptologic research has issued a statement against mass surveillance <a href=\"https://www.iacr.org/misc/statement-May2014.html\">\'The Copenhagen Resolution\'</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards. Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> <a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">A technical deep-dive into the NHS COVID-19 contact tracing app</a> : Since \'<em>the contact tracing beta is now open source for both&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-iOS-BETA\" target=\"_blank\"><em>iOS</em></a><em>&nbsp;and&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Android-BETA\" target=\"_blank\"><em>Android</em></a><em>, along with some&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Documentation-BETA\" target=\"_blank\"><em>documentation</em></a><em>. As a follow-up to our “</em><a href=\"https://reincubate.com/blog/staying-alive-covid-19-background-tracing/\"><em>Staying alive</em></a><em>” post, we’ve taken a deep-dive into the source code. It’s pleasantly surprising to find it licensed under MIT, indicating an NHSX commitment to transparency and quality... There have been claims that the Android app accesses location data, as the prompt for Bluetooth API access on Android devices appears to ask for location permissions. However, we debunked this yesterday: this is a consequence of how Android&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://developer.android.com/guide/topics/connectivity/bluetooth#Permissions\" target=\"_blank\"><em>manages requests for Bluetooth permissions</em></a><em>.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Reincubate’s CEO, Aidan Fitzpatrick, says:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, it is the case that the coming Apple&nbsp;<code>ExposureNotification</code>&nbsp;framework in iOS 13.5 obviates the need for these keepalives. However, it’s worth noting that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>iOS 13.5 has not been released, and may not be for some weeks</li><li>Prior to yesterday, the last iOS 13.5 beta had a&nbsp;<a href=\"https://siguza.github.io/psychicpaper/\" rel=\"noreferrer noopener\" target=\"_blank\">major security flaw</a>, suggesting heavy lifting is going on in Apple’s engineering teams</li><li>Once it is released, it will&nbsp;<a href=\"https://venturebeat.com/2020/01/29/as-ios-and-ipados-13-near-80-adoption-is-the-race-with-android-over/\" rel=\"noreferrer noopener\" target=\"_blank\">likely take months</a>&nbsp;for a majority of iOS users to install it (unusually, the equivalent Android adoption may be&nbsp;<a href=\"https://www.theverge.com/2020/4/13/21220033/android-covid-19-tracking-updates-google-play-contact-tracing\" rel=\"noreferrer noopener\" target=\"_blank\">more rapid</a>)</li><li>Older iOS devices — such as the iPhone 6 — cannot run iOS 13, and will not be able to use the Apple technique</li><li><em>There’s no reason why the NHS COVID-19 app won’t be able to automatically transition in future to using Apple’s framework — or even dual-running both mechanisms</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The app will become increasingly effective as more people use it, and the benefit of mass adoption will create a flywheel effect in this sense. The Australian COVIDSafe app struggled as it didn’t support detecting backgrounded iOS devices from an Android device, and it didn’t have this clever iOS-to-iOS keepalive mechanism.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to reflect on which circumstances make use of technology like this appropriate. If contact tracing is successful in saving lives, which criteria should be assessed as to whether it’s applied for future diseases? Once the precedent is set, is there an argument that this technology might be used to combat&nbsp;<em>pre-existing</em>&nbsp;infectious diseases? It’s foreseeable that different societies will evaluate the trade-offs differently.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III - The balance of Proportionality requires a three party test :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Fundamental rights, enshrined in the Charter of Fundamental Rights of the European Union constitute the core values of the European Union . These rights must be respected whenever the EU institutions and bodies design and implement new policies or adopt any new legislative measure and in the ECHR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU law which requires that \"<em>the content and form of Union action shall not exceed what is necessary to achieve the objectives of the treaties\"</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives\" . It therefore \"restricts the authorities in the exercise of their powers by requiring a balance to be struck between the means used and the intended aim (or Under Article 52(1) of the Charter, \"subject to the principle of proportionality, limitations </em><a href=\"#\"><em>onresult reached)\" the exercise of fundamental rights</em></a><em> may be made only if they are necessary (...</em>)\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The necessity</strong>, Something needs to be done to end this national confinement killing the country’s economy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the Data Protection Impact Assessment published by <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e. V. .</a> They recommend that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> An appropriate legal basis must be established and in this respect responsibilities have to be defined. </li><li>Reinforcing the measures of pseudonymisation \'when creating the TempIDs in the app, it must be ensured that there is no connection between TempIDs and it must never be possible to make one. ...The server(s)’ operator must employ an effective separation method...\'</li><li>Accompanying the publication of the app it must be ensured in law and in fact that users have to disclose neither the status of the app nor the mere existence on a device to third parties. </li><li>Before the app gets published, a comprehensive investigation of the software and the overall system must be conducted and published by an independent body. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2- Could the same result be achieved in a less intrusive way?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I would argue providing tests,, masks, ventilators and resources to over loaded NHS staff will bring a serious improvement with any inconvenient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The cost of the deployment of the NHSX App is unknown. The Australian Government would have allegedly spend 700.000 AUD just to host the data in Amazon AWS clouds. This is how much less resource the NHS will receive.<a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">h</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://martinralbrecht.wordpress.com/2020/05/03/open-letters-v-surveillance/﻿\">A letter, signed by 177 scientists and researchers working in the UK in the fields of information security and privacy, reads: </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<em>Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified.1 Such invasive information can include the ‘social graph’ of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens’ real-world activities.</em>”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.wired.co.uk/article/contact-tracing-apps-coronavirus\"><strong>IV - Coronavirus contact tracing apps were meant to save us</strong></a><strong>. They won’t. ‘With little evidence to show how effective such apps are and growing privacy concerns, there’s a risk they could do more harm than good‘ </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>From Iceland to Israel,&nbsp;</em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\"><em>more than 30 systems</em></a><em>&nbsp;are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>False alerts might loose users trust. An Oxford research said that the probability of seeing any result from the tracing Apps requires that at least 60% of the population use the App. Will the most vulnerable population of over 60% be willing to download and use it ? Will the government be liable for the false alters causing distress, unnecessary isolation and loss of revenues? France is talking of self isolating in hotels, where and how feed and entertain these people? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Elsewhere projects using personal data to combat SARS-CoV-2 </a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://tracetogether.zendesk.com/hc/en-sg/articles/360046475654-20-April-2020-One-Month-On\"><em>Singapour’s TraceTogether App</em></a><em> moved to the The Apple and Google collaboration on digital contact tracing solutions, is a game-changer, as we said previously. It will significantly improve the contact tracing capability available to governments and public health authorities over what is available through public APIs on either Android or iOS platforms. We are glad that Apple and Google are engaging governments and public health authorities around the world, including us, to incorporate feedback as the specifications for their contract tracing protocol and private APIs.  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=e6e61ca3-45ae-49a0-b6f1-5fd4adf11291\">In Poland</a>, Although initially voluntary in nature, it has become mandatory for all those under obligatory quarantine or epidemiological surveillance, as a tool to confirm compliance with quarantine obligations (e.g. whether the ban on leaving the quarantine location is observed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Contact tracing apps in Austria: a Red Cross initiative |Has been launched In March 2020 in co-operation with Accenture. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The first published version of the Stopp Corona app required users to log their contacts via a \'manual\' handshake. In the current version, however, the app already allows contacts to be traced automatically, depending on the device and its configuration.&nbsp;</em></p><p><em>The automatic handshake functionality is based on the discovery and messaging functionality of the p2pkit developed by the Swiss company Uepaa, which uses Bluetooth and Wifi-direct techniques to determine the distance between the users.&nbsp;</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Switzerland: \"WeTrace\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>This project is ready to be deployed. It is open source. All data remains locally on the devices. Packaged information encrypted asymmetrically. The sole information a potential malfeasor on the central server would see is the fact _that_ an infected person has actually pushed a status update, but on the core server it is not visible \"what\" the person has broadcasted. The broadcasting user can determine the details of what should be broadcasted aside from status (location of contact, time of contact, etc.). Packages will be sent not to everyone but only to those that need to know.</em></p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Spain: \"Open Coronavirus\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The Spanish medical investigator Aurelia Bustos has released Open Coronavirus, an open-source app with the aim to copy the advantages of the South-Korean app: in the end, serving as an individual-validation-method in order to allow free movement of the citizens. This tool can be used by any public institution as a basis for its own apps on tracking citizens due to the coronavirus emergency, and it offers a modular design: three levels of management (mobile phone, central management of data by the competent authority and checking of the control points by the competent authority too) with different options of geolocation (GPS, bluetooth, positioning by mobile operators cells) that could be implemented or not by the corresponding institution. Its use would be voluntary for the citizen (although, in words of the medical investigator, \"it would be probably very advantageous for the user, as it would allow him/her to have the possibility to finish an eventually longer quarantine\"), and it would necessarily depend on the realization of any kind of coronavirus detection tests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>As this is an open-source app, that it will not be officially published in its current status, and any use of the same by any institutons must be always in line with GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, it can be said of the NHSX Tracing App, similar to the French STOPCOVID, that <a href=\"https://www.lemonde.fr/idees/article/2020/04/25/stopcovid-est-un-projet-desastreux-pilote-par-des-apprentis-sorciers_6037721_3232.html\">«&nbsp;StopCovid est un projet désastreux piloté par des apprentis sorciers&nbsp;»</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE 8th May</strong>, The Financial Times reveals \'<a href=\"https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b\">UK starts to build second contact tracing app</a>\' going for a decentralised model in collaboration with Apple and Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The different existing systems&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">The Chinese System based on geolocation</a></li><li><a href=\"https://github.com/DP-3T/documents\">The DP3T</a> Protocol&nbsp;(sous diverses variantes), sa déclinaison par l’alliance&nbsp;</li><li><a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a>&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\"> PACT- Est</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://pact.mit.edu/\">PACT-Ouest</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://github.com/TCNCoalition/TCN\">TCN</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">ROBERT</a> Protocol&nbsp;.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Liste of <a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Projects using personal data to combat SARS-CoV-2</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDRI <a href=\"https://edri.org/covid-19-digital-rights-document-pool/\">COVID-19 &amp; Digital Rights: Document Pool</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/sites/edp/files/publication/20-05-08_techdispatch-tracing_en.pdf\">Techdispatch&nbsp;\'</a>Contact Tracing with Mobile Applications\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:gallery {\"ids\":[930,931,932]} -->\n<ul class=\"wp-block-gallery columns-3 is-cropped\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQe2X0AE1.png\" alt=\"\" data-id=\"930\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqe2x0ae1/\" class=\"wp-image-930\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQexXQAYJ2.png\" alt=\"\" data-id=\"931\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqexxqayj2/\" class=\"wp-image-931\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQfQX0AEk3.png\" alt=\"\" data-id=\"932\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqfqx0aek3/\" class=\"wp-image-932\" /></figure></li></ul>\n<!-- /wp:gallery -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">Privacy International : A technical deep-dive into the NHS COVID-19 contact tracing app</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":933} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/EXethgcXgAAF4.jpeg\" alt=\"\" class=\"wp-image-933\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.privacyinternational.org/long-read/3752/coronavirus-tracking-uk-what-we-know-so-far\">UK government Covid tracking app: what you need to know!</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://insights.doughtystreet.co.uk/post/102g6tz/guide-to-coronavirus-offences-help-for-the-public-police-and-lawyers\">Guide to Coronavirus Offences. Help for the public, police and lawyers</a></em> by the Doughty Street Chambers</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A SPECIAL THANK YOU TO GRAEME McGOWAN for allowing me to use his beautiful photography.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','NHSX Contacts Tracing App','Is NHSX UK centralised Tracing APP capable of best combat the COVID19 propagation? the Balance of proportionality looks rather weak. ','inherit','closed','closed','','898-revision-v1','','','2020-05-08 11:53:54','2020-05-08 10:53:54','',898,'https://datarainbow.eu/2020/05/08/898-revision-v1/',0,'revision','',0),(945,5,'2020-05-08 12:04:30','2020-05-08 11:04:30','<!-- wp:paragraph -->\n<p>In UK, like in many countries a contract tracing app act is presented as the solution to get out of lockdown. Is technology really the right solution?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been written and the debate is still ongoing. We have published an article on <a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">the French government project of STOPCOVID. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK NHSX project is another centralised contact tracing App. A first tryout has started on the Isle of Wight since Tuesday May 2nd.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">I - </a>A<strong>nalysing the data protection compliance aspects of the project, from&nbsp;</strong><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\"><strong>Chris Pounder of Amber-walk has published his&nbsp;views</strong></a><strong> </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">COVID-19: how the GDPR applies to trace and track.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Emphasis is put in the voluntary adoption of the measure as requested by most EU Data Protection Authorties.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Chris Pounder develops, ‘<em>NHSX claim that every operation related to the APP is voluntary (e.g. to download, to communicate to a central database if need be). Users can choose to delete the APP at any time; this would also delete the data on the phone but not any data previously uploaded to NHSX’s central database.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data is pseudonymised more than anonymised as it can be re-identifiable, therefore it will be the GDPR and not the ePrivacy Directive that will apply</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a published DPIA, Chris reminds the government promise that ‘T<em>he APP does not use any identifier already on the phone (e.g. phone number, SIM card identifier) or location details.’ The APP generates a random ID number exchanged with other phones that have also downloaded the APP. This record will remain on both phones for 14 days. When someone is COVID+ this record will trace back the contacts with a warning message for the user</em> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- The APP should not keep any personal information and no location data. Only the first half of the postcode is collected from APP users to alert local hospitals.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, for <a href=\"https://tech.newstatesman.com/coronavirus/uncertainty-over-who-could-access-nhsx-contact-tracing-app-data-as-pilot-goes-live\">Laurie Clarke reporter</a>, remains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Uncertainty over who could access NHSX contact tracing app data as Isle of White pilot goes live’. ‘The NHSX coronavirus contact tracing app is being rolled out on the Isle of Wight this week, but major question marks still hang over the app. Matthew Gould, CEO of NHSX, told parliament today that the data collected by the app would be accessible to unspecified organisations as long as it was used for public health purposes. ‘</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>3- For Chris Pounder, ‘</strong><em><strong>there are three definitional issues:</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>(<em>a) is personal data processed? </em></li><li><em>b) if so, who is the controller processing personal data? and </em></li><li><em>(c) if there is a controller, does the voluntary nature of the APP equate to “data subject consent”?</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject is identifiable and the data related to medical health. He is therefore ‘<em>pretty sure the APP is processing personal data and special category of personal data</em>’, subject to the Article 6  lawful basis and a condition that overcomes the prohibition in Article 9(1) from processing health personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Controller, there would be joint controllers as he points to the NHSX website stating that “<em>NHS England and NHS Improvement and the Department of Health and Social Care are delivering NHSX together” This bring to the Article 26 that requires any processing of personal data “shall in a transparent manner determine their respective responsibilities</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the emphasis is on the voluntary adoption of the App, the next question  is on ”<em>data subject consent</em>”. Chris points out that <em>‘the NHS text on the website is very careful to avoid the use of the “C word” and it is easy to see why</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 states that with respect to consent: “<em>consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller</em>” This will be the case where the controller is a public authority or an employer. It will be unlikely for that consent to be considered as ‘<em>freely given</em>’. Therefore voluntary adoption does not refer the character of legitimate basis on consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The limit of the ‘<em>voluntary</em>’ adoption he sees is that it could lead to a denial of a service as previously for the ‘<em>ID Card holders refused to “volunteer” making it a requirement to interact with any public service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The first comment is that any interference by a public authority (NHSX) is unlikely to infringe Article 8(1) [_<a href=\"https://awallon.com:15001/oo/r/546619490369058645\">GDPR08</a>_]&nbsp;of the European Convention on Human Rights; This is because Article 8(2) permits legislation to be enacted by a Parliament process (e.g. in the Coronavirus 2 which sets aside the A.8(1) right in limited circumstances (e.g. any interference deemed&nbsp;<strong><em>necessary</em></strong>&nbsp; “<em>for the protection of health</em>”).&nbsp; It all hangs on the word “<em>necessary</em>”; it is either necessary or it isn’t. If there is reliance on data subject consent (which we think is unreliable), then there is also no A.8 breach (so long consent is properly formed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the GDPR/DPA2018,  <em>‘if the processing is “necessary” it will have Article 6 lawful basis (e.g. candidates are A.6(1)(c) or A.6(1)(e); A.6(1)(d) could be used in a case-by-case emergency). If there is need for an A.9 condition that lifts the prohibition on processing of health personal data the candidates are A.9(2)(c), A.9(2)(g), A.9(1)(i), Schedule 1, paragraphs2, 3 or 6 of the DPA2018</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>If there is reliance on consent or necessary or public task (or even necessary legitimate interests of controller/Third Party), the controller has to specify publicly (A.13; A.14) what happens to the personal data if there withdrawal of consent or exercise of the exercise of the right to object to the processing.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in he concludes ‘<em>the ICO should take up Article 8 ECHR cases on the grounds that necessary as used in the GDPR has the same meaning as in Article 8.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>II - The UK like France has opted for the centralised model </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The App is encountering technical issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.iacr.org/misc/statement-May2014.html\">UK ICO</a> like the <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">French CNIL</a> have expressed their preference for the decentralised model for a decentralised model. Chris Pounder sees further vulnerability of the centralised approach  with a ‘<em>future legislative mood of Government</em>’. He believes ‘<em>It could be tempting (e.g. to reduce the pressures on the public purse) for Government to enact legislation that makes certain processing of personal data compulsory. For instance, to prove entitlement to a COVID related benefit</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> <em>\'Considering to revert to a decentralised model to resolve their Bluetooth issues. ‘Covidsafe app is not working properly on iPhones, authorities admit’ ‘Australians running the Covidsafe contact tracing app on iPhones may not be recording all the data required if they don’t have the app running in the foreground or they are using an older model phone, the government has admitted.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://uk.reuters.com/article/us-health-coronavirus-france-tech/france-accuses-apple-of-refusing-help-with-stopcovid-app-idUKKBN22H0LX\">France is struggling to find an agreement with Apple and Google</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theguardian.com/world/2020/may/06/covidsafe-app-is-not-working-properly-on-iphones-authorities-admit\">Australia who has already deployed the App has been struggling technically </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/\">The Register</a> wrote: ‘<em>UK finds itself almost alone with centralized virus contact-tracing app that probably won\'t work well, asks for your location, may be illegal’. ‘On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in the Isle of Wight – will work, and why it is a better solution to the one by Apple and Google that other nations have decided to adopt. It has also released a more technical explanation</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Running the Bluetooth connection in the back has several inconvenience such as draining the battery and opening security vulnerabilities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, the Bluetooth distance measurement is unreliable <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">according to its own inventor</a>. Bluetooth signals can pierce obstacles the virus hopefully cannot such as a wall or vehicle bodies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The margin of error has caused a return to lock down in Singapore, one of the first nations after China to deploy TraceTogether App. Less than 20% of the population actually downloaded the App It is suspected that Bluetooth works through glass and even some walls and may even be triggered by reflection in windows in buildings. Jason Bay Senior Director (Government Digital Services) at the Government Technology Agency, Singapore&nbsp;<a href=\"https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98\">wrote</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain ? (throw whatever buzzword you want), not for the foreseeabl</em>e future.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The amount of <strong>false alerts</strong> will cause major distress and reduce trust on the App. When someone receives the warning SMS that they have been in contact with someone COVID+, that doesn\'t mean the NHS can test them immediately. They might be asked to self isolate themselves which is not always technically possibly. It has been suggested in France that they would be hotels dedicated to quarantine. That means 14 days of accommodation, food and entertainment. During which time the person and his family or network will be under distress, maybe unnecessarily isolated causing loss of revenues. Should the government be liable for all that ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- These Apps are source of security issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The well known and security expert Bruce Schneier has expressed his concerns about the issues of using Bluetooth Technology <a href=\"https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"My problem with contact tracing apps is that they have absolutely no value,\" Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet &amp; Society at Harvard University, told BuzzFeed News. \"I\'m not even talking about the privacy concerns, I mean the efficacy. Does anybody think this will do something useful? ... This is just something governments want to do for the hell of it. To me, it\'s just techies doing techie things because they don\'t know what else to do.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">SecurityWeek reporter Kevin Townsend wrote</a> ‘<em>These apps could easily become subject to a high number of false positives – and false positives always lead to a rejection by users. ‘ que faire du stresse, isolation et perte de revenus consécutives au faux positives alertes? Le BT transverse les murs et un automobiliste à proximité pourrait être décelé conne en ‘contact’</em> .  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">As contact tracing gains attention, a researcher pokes a hole in Bluetooth technology</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>If someone is reluctant to self quarantine, will they ignore the warning messages ?</li><li>The most at risk populations are the over 60x, will they be willing to download the app ?</li><li>What are going the security issues of opening the Bluetooth connection be?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Any data base creates security issues. New NHS contact-tracing app vulnerable to ‘<em>malicious false alerts</em>’, warn experts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Additionaly, ‘<em>The new NHS contact-tracing app could be used to send malicious alerts causing people to isolate unnecessarily, it has been warned.</em></p><p><em>The app, which is being trialled in the Isle of Wight, tells users if someone they have been in proximity with may be suffering from coronavirus, meaning they could be exposed.</em></p><p><em>But because users can set off the warnings themselves by reporting symptoms – rather than positive Covid-19 test results – it could be used to send out false alerts.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\'Dr Michael Veale, a lecturer in digital rights and regulation at University College London who this week gave evidence to MPs on the technology, told The Independent that Britain’s tracing app had nothing to stop individuals “maliciously triggering notifications” using its normal functionality.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“People can deliberately put others into quarantine or report large areas,” he said. “A child could try to get a day off school by reporting symptoms from a parent’s phone to trigger a quarantine.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Constant Bluetooth signals in the back will drain the phone battery eventually causing over heating. Will be see a new epidemic of ‘pockets in fire’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ICAR, the Association of  experts in Cryptologic research has issued a statement against mass surveillance <a href=\"https://www.iacr.org/misc/statement-May2014.html\">\'The Copenhagen Resolution\'</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards. Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> <a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">A technical deep-dive into the NHS COVID-19 contact tracing app</a> : Since \'<em>the contact tracing beta is now open source for both&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-iOS-BETA\" target=\"_blank\"><em>iOS</em></a><em>&nbsp;and&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Android-BETA\" target=\"_blank\"><em>Android</em></a><em>, along with some&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Documentation-BETA\" target=\"_blank\"><em>documentation</em></a><em>. As a follow-up to our “</em><a href=\"https://reincubate.com/blog/staying-alive-covid-19-background-tracing/\"><em>Staying alive</em></a><em>” post, we’ve taken a deep-dive into the source code. It’s pleasantly surprising to find it licensed under MIT, indicating an NHSX commitment to transparency and quality... There have been claims that the Android app accesses location data, as the prompt for Bluetooth API access on Android devices appears to ask for location permissions. However, we debunked this yesterday: this is a consequence of how Android&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://developer.android.com/guide/topics/connectivity/bluetooth#Permissions\" target=\"_blank\"><em>manages requests for Bluetooth permissions</em></a><em>.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Reincubate’s CEO, Aidan Fitzpatrick, says:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, it is the case that the coming Apple&nbsp;<code>ExposureNotification</code>&nbsp;framework in iOS 13.5 obviates the need for these keepalives. However, it’s worth noting that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>iOS 13.5 has not been released, and may not be for some weeks</li><li>Prior to yesterday, the last iOS 13.5 beta had a&nbsp;<a href=\"https://siguza.github.io/psychicpaper/\" rel=\"noreferrer noopener\" target=\"_blank\">major security flaw</a>, suggesting heavy lifting is going on in Apple’s engineering teams</li><li>Once it is released, it will&nbsp;<a href=\"https://venturebeat.com/2020/01/29/as-ios-and-ipados-13-near-80-adoption-is-the-race-with-android-over/\" rel=\"noreferrer noopener\" target=\"_blank\">likely take months</a>&nbsp;for a majority of iOS users to install it (unusually, the equivalent Android adoption may be&nbsp;<a href=\"https://www.theverge.com/2020/4/13/21220033/android-covid-19-tracking-updates-google-play-contact-tracing\" rel=\"noreferrer noopener\" target=\"_blank\">more rapid</a>)</li><li>Older iOS devices — such as the iPhone 6 — cannot run iOS 13, and will not be able to use the Apple technique</li><li><em>There’s no reason why the NHS COVID-19 app won’t be able to automatically transition in future to using Apple’s framework — or even dual-running both mechanisms</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The app will become increasingly effective as more people use it, and the benefit of mass adoption will create a flywheel effect in this sense. The Australian COVIDSafe app struggled as it didn’t support detecting backgrounded iOS devices from an Android device, and it didn’t have this clever iOS-to-iOS keepalive mechanism.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to reflect on which circumstances make use of technology like this appropriate. If contact tracing is successful in saving lives, which criteria should be assessed as to whether it’s applied for future diseases? Once the precedent is set, is there an argument that this technology might be used to combat&nbsp;<em>pre-existing</em>&nbsp;infectious diseases? It’s foreseeable that different societies will evaluate the trade-offs differently.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III - The balance of Proportionality requires a three party test :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Fundamental rights, enshrined in the Charter of Fundamental Rights of the European Union constitute the core values of the European Union . These rights must be respected whenever the EU institutions and bodies design and implement new policies or adopt any new legislative measure and in the ECHR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU law which requires that \"<em>the content and form of Union action shall not exceed what is necessary to achieve the objectives of the treaties\"</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives\" . It therefore \"restricts the authorities in the exercise of their powers by requiring a balance to be struck between the means used and the intended aim (or Under Article 52(1) of the Charter, \"subject to the principle of proportionality, limitations </em><a href=\"#\"><em>onresult reached)\" the exercise of fundamental rights</em></a><em> may be made only if they are necessary (...</em>)\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The necessity</strong>, Something needs to be done to end this national confinement killing the country’s economy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the Data Protection Impact Assessment published by <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e. V. .</a> They recommend that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> An appropriate legal basis must be established and in this respect responsibilities have to be defined. </li><li>Reinforcing the measures of pseudonymisation \'when creating the TempIDs in the app, it must be ensured that there is no connection between TempIDs and it must never be possible to make one. ...The server(s)’ operator must employ an effective separation method...\'</li><li>Accompanying the publication of the app it must be ensured in law and in fact that users have to disclose neither the status of the app nor the mere existence on a device to third parties. </li><li>Before the app gets published, a comprehensive investigation of the software and the overall system must be conducted and published by an independent body. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2- Could the same result be achieved in a less intrusive way?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I would argue providing tests,, masks, ventilators and resources to over loaded NHS staff will bring a serious improvement with any inconvenient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The cost of the deployment of the NHSX App is unknown. The Australian Government would have allegedly spend 700.000 AUD just to host the data in Amazon AWS clouds. This is how much less resource the NHS will receive.<a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">h</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://martinralbrecht.wordpress.com/2020/05/03/open-letters-v-surveillance/﻿\">A letter, signed by 177 scientists and researchers working in the UK in the fields of information security and privacy, reads: </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<em>Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified.1 Such invasive information can include the ‘social graph’ of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens’ real-world activities.</em>”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.wired.co.uk/article/contact-tracing-apps-coronavirus\"><strong>IV - Coronavirus contact tracing apps were meant to save us</strong></a><strong>. They won’t. ‘With little evidence to show how effective such apps are and growing privacy concerns, there’s a risk they could do more harm than good‘ </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>From Iceland to Israel,&nbsp;</em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\"><em>more than 30 systems</em></a><em>&nbsp;are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>False alerts might loose users trust. An Oxford research said that the probability of seeing any result from the tracing Apps requires that at least 60% of the population use the App. Will the most vulnerable population of over 60% be willing to download and use it ? Will the government be liable for the false alters causing distress, unnecessary isolation and loss of revenues? France is talking of self isolating in hotels, where and how feed and entertain these people? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Elsewhere projects using personal data to combat SARS-CoV-2 </a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://tracetogether.zendesk.com/hc/en-sg/articles/360046475654-20-April-2020-One-Month-On\"><em>Singapour’s TraceTogether App</em></a><em> moved to the The Apple and Google collaboration on digital contact tracing solutions, is a game-changer, as we said previously. It will significantly improve the contact tracing capability available to governments and public health authorities over what is available through public APIs on either Android or iOS platforms. We are glad that Apple and Google are engaging governments and public health authorities around the world, including us, to incorporate feedback as the specifications for their contract tracing protocol and private APIs.  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=e6e61ca3-45ae-49a0-b6f1-5fd4adf11291\">In Poland</a>, Although initially voluntary in nature, it has become mandatory for all those under obligatory quarantine or epidemiological surveillance, as a tool to confirm compliance with quarantine obligations (e.g. whether the ban on leaving the quarantine location is observed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Contact tracing apps in Austria: a Red Cross initiative |Has been launched In March 2020 in co-operation with Accenture. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The first published version of the Stopp Corona app required users to log their contacts via a \'manual\' handshake. In the current version, however, the app already allows contacts to be traced automatically, depending on the device and its configuration.&nbsp;</em></p><p><em>The automatic handshake functionality is based on the discovery and messaging functionality of the p2pkit developed by the Swiss company Uepaa, which uses Bluetooth and Wifi-direct techniques to determine the distance between the users.&nbsp;</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Switzerland: \"WeTrace\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>This project is ready to be deployed. It is open source. All data remains locally on the devices. Packaged information encrypted asymmetrically. The sole information a potential malfeasor on the central server would see is the fact _that_ an infected person has actually pushed a status update, but on the core server it is not visible \"what\" the person has broadcasted. The broadcasting user can determine the details of what should be broadcasted aside from status (location of contact, time of contact, etc.). Packages will be sent not to everyone but only to those that need to know.</em></p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Spain: \"Open Coronavirus\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The Spanish medical investigator Aurelia Bustos has released Open Coronavirus, an open-source app with the aim to copy the advantages of the South-Korean app: in the end, serving as an individual-validation-method in order to allow free movement of the citizens. This tool can be used by any public institution as a basis for its own apps on tracking citizens due to the coronavirus emergency, and it offers a modular design: three levels of management (mobile phone, central management of data by the competent authority and checking of the control points by the competent authority too) with different options of geolocation (GPS, bluetooth, positioning by mobile operators cells) that could be implemented or not by the corresponding institution. Its use would be voluntary for the citizen (although, in words of the medical investigator, \"it would be probably very advantageous for the user, as it would allow him/her to have the possibility to finish an eventually longer quarantine\"), and it would necessarily depend on the realization of any kind of coronavirus detection tests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>As this is an open-source app, that it will not be officially published in its current status, and any use of the same by any institutons must be always in line with GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, it can be said of the NHSX Tracing App, similar to the French STOPCOVID, that <a href=\"https://www.lemonde.fr/idees/article/2020/04/25/stopcovid-est-un-projet-desastreux-pilote-par-des-apprentis-sorciers_6037721_3232.html\">«&nbsp;StopCovid est un projet désastreux piloté par des apprentis sorciers&nbsp;»</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE 8th May</strong>, The Financial Times reveals \'<a href=\"https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b\">UK starts to build second contact tracing app</a>\' going for a decentralised model in collaboration with Apple and Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The different existing systems&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">The Chinese System based on geolocation</a></li><li><a href=\"https://github.com/DP-3T/documents\">The DP3T</a> Protocol&nbsp;(sous diverses variantes), sa déclinaison par l’alliance&nbsp;</li><li><a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a>&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\"> PACT- Est</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://pact.mit.edu/\">PACT-Ouest</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://github.com/TCNCoalition/TCN\">TCN</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">ROBERT</a> Protocol&nbsp;.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Liste of <a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Projects using personal data to combat SARS-CoV-2</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDRI <a href=\"https://edri.org/covid-19-digital-rights-document-pool/\">COVID-19 &amp; Digital Rights: Document Pool</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/sites/edp/files/publication/20-05-08_techdispatch-tracing_en.pdf\">Techdispatch&nbsp;\'</a>Contact Tracing with Mobile Applications\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:gallery {\"ids\":[930,931,932]} -->\n<ul class=\"wp-block-gallery columns-3 is-cropped\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQe2X0AE1.png\" alt=\"\" data-id=\"930\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqe2x0ae1/\" class=\"wp-image-930\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQexXQAYJ2.png\" alt=\"\" data-id=\"931\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqexxqayj2/\" class=\"wp-image-931\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQfQX0AEk3.png\" alt=\"\" data-id=\"932\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqfqx0aek3/\" class=\"wp-image-932\" /></figure></li></ul>\n<!-- /wp:gallery -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">Privacy International : A technical deep-dive into the NHS COVID-19 contact tracing app</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":933} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/EXethgcXgAAF4.jpeg\" alt=\"\" class=\"wp-image-933\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.privacyinternational.org/long-read/3752/coronavirus-tracking-uk-what-we-know-so-far\">UK government Covid tracking app: what you need to know!</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://insights.doughtystreet.co.uk/post/102g6tz/guide-to-coronavirus-offences-help-for-the-public-police-and-lawyers\">Guide to Coronavirus Offences. Help for the public, police and lawyers</a></em> by the Doughty Street Chambers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://axisofeasy.com/aoe/computer-model-that-locked-down-the-world-turns-out-to-be-shtcode/\">Computer model that locked down the world turns out to be sh*tcode.</a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A SPECIAL THANK YOU TO GRAEME McGOWAN for allowing me to use his beautiful photography.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','NHSX Contacts Tracing App','Is NHSX UK centralised Tracing APP capable of best combat the COVID19 propagation? the Balance of proportionality looks rather weak. ','inherit','closed','closed','','898-revision-v1','','','2020-05-08 12:04:30','2020-05-08 11:04:30','',898,'https://datarainbow.eu/2020/05/08/898-revision-v1/',0,'revision','',0),(947,5,'2020-05-08 12:21:50','2020-05-08 11:21:50','<!-- wp:paragraph -->\n<p>In UK, like in many countries a contract tracing app act is presented as the solution to get out of lockdown. Is technology really the right solution?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been written and the debate is still ongoing. We have published an article on <a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">the French government project of STOPCOVID. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK NHSX project is another centralised contact tracing App. A first tryout has started on the Isle of Wight since Tuesday May 2nd.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">I - </a>A<strong>nalysing the data protection compliance aspects of the project, from&nbsp;</strong><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\"><strong>Chris Pounder of Amber-walk has published his&nbsp;views</strong></a><strong> </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">COVID-19: how the GDPR applies to trace and track.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Emphasis is put in the voluntary adoption of the measure as requested by most EU Data Protection Authorties.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Chris Pounder develops, ‘<em>NHSX claim that every operation related to the APP is voluntary (e.g. to download, to communicate to a central database if need be). Users can choose to delete the APP at any time; this would also delete the data on the phone but not any data previously uploaded to NHSX’s central database.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data is pseudonymised more than anonymised as it can be re-identifiable, therefore it will be the GDPR and not the ePrivacy Directive that will apply</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a published DPIA, Chris reminds the government promise that ‘T<em>he APP does not use any identifier already on the phone (e.g. phone number, SIM card identifier) or location details.’ The APP generates a random ID number exchanged with other phones that have also downloaded the APP. This record will remain on both phones for 14 days. When someone is COVID+ this record will trace back the contacts with a warning message for the user</em> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- The APP should not keep any personal information and no location data. Only the first half of the postcode is collected from APP users to alert local hospitals.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, for <a href=\"https://tech.newstatesman.com/coronavirus/uncertainty-over-who-could-access-nhsx-contact-tracing-app-data-as-pilot-goes-live\">Laurie Clarke reporter</a>, remains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Uncertainty over who could access NHSX contact tracing app data as Isle of White pilot goes live’. ‘The NHSX coronavirus contact tracing app is being rolled out on the Isle of Wight this week, but major question marks still hang over the app. Matthew Gould, CEO of NHSX, told parliament today that the data collected by the app would be accessible to unspecified organisations as long as it was used for public health purposes. ‘</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>3- For Chris Pounder, ‘</strong><em><strong>there are three definitional issues:</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>(<em>a) is personal data processed? </em></li><li><em>b) if so, who is the controller processing personal data? and </em></li><li><em>(c) if there is a controller, does the voluntary nature of the APP equate to “data subject consent”?</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject is identifiable and the data related to medical health. He is therefore ‘<em>pretty sure the APP is processing personal data and special category of personal data</em>’, subject to the Article 6  lawful basis and a condition that overcomes the prohibition in Article 9(1) from processing health personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Controller, there would be joint controllers as he points to the NHSX website stating that “<em>NHS England and NHS Improvement and the Department of Health and Social Care are delivering NHSX together” This bring to the Article 26 that requires any processing of personal data “shall in a transparent manner determine their respective responsibilities</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the emphasis is on the voluntary adoption of the App, the next question  is on ”<em>data subject consent</em>”. Chris points out that <em>‘the NHS text on the website is very careful to avoid the use of the “C word” and it is easy to see why</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 states that with respect to consent: “<em>consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller</em>” This will be the case where the controller is a public authority or an employer. It will be unlikely for that consent to be considered as ‘<em>freely given</em>’. Therefore voluntary adoption does not refer the character of legitimate basis on consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The limit of the ‘<em>voluntary</em>’ adoption he sees is that it could lead to a denial of a service as previously for the ‘<em>ID Card holders refused to “volunteer” making it a requirement to interact with any public service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The first comment is that any interference by a public authority (NHSX) is unlikely to infringe Article 8(1) [_<a href=\"https://awallon.com:15001/oo/r/546619490369058645\">GDPR08</a>_]&nbsp;of the European Convention on Human Rights; This is because Article 8(2) permits legislation to be enacted by a Parliament process (e.g. in the Coronavirus 2 which sets aside the A.8(1) right in limited circumstances (e.g. any interference deemed&nbsp;<strong><em>necessary</em></strong>&nbsp; “<em>for the protection of health</em>”).&nbsp; It all hangs on the word “<em>necessary</em>”; it is either necessary or it isn’t. If there is reliance on data subject consent (which we think is unreliable), then there is also no A.8 breach (so long consent is properly formed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the GDPR/DPA2018,  <em>‘if the processing is “necessary” it will have Article 6 lawful basis (e.g. candidates are A.6(1)(c) or A.6(1)(e); A.6(1)(d) could be used in a case-by-case emergency). If there is need for an A.9 condition that lifts the prohibition on processing of health personal data the candidates are A.9(2)(c), A.9(2)(g), A.9(1)(i), Schedule 1, paragraphs2, 3 or 6 of the DPA2018</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>If there is reliance on consent or necessary or public task (or even necessary legitimate interests of controller/Third Party), the controller has to specify publicly (A.13; A.14) what happens to the personal data if there withdrawal of consent or exercise of the exercise of the right to object to the processing.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in he concludes ‘<em>the ICO should take up Article 8 ECHR cases on the grounds that necessary as used in the GDPR has the same meaning as in Article 8.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>II - The UK like France has opted for the centralised model </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The App is encountering technical issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.iacr.org/misc/statement-May2014.html\">UK ICO</a> like the <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">French CNIL</a> have expressed their preference for the decentralised model for a decentralised model. Chris Pounder sees further vulnerability of the centralised approach  with a ‘<em>future legislative mood of Government</em>’. He believes ‘<em>It could be tempting (e.g. to reduce the pressures on the public purse) for Government to enact legislation that makes certain processing of personal data compulsory. For instance, to prove entitlement to a COVID related benefit</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> <em>\'Considering to revert to a decentralised model to resolve their Bluetooth issues. ‘Covidsafe app is not working properly on iPhones, authorities admit’ ‘Australians running the Covidsafe contact tracing app on iPhones may not be recording all the data required if they don’t have the app running in the foreground or they are using an older model phone, the government has admitted.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://uk.reuters.com/article/us-health-coronavirus-france-tech/france-accuses-apple-of-refusing-help-with-stopcovid-app-idUKKBN22H0LX\">France is struggling to find an agreement with Apple and Google</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theguardian.com/world/2020/may/06/covidsafe-app-is-not-working-properly-on-iphones-authorities-admit\">Australia who has already deployed the App has been struggling technically </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/\">The Register</a> wrote: ‘<em>UK finds itself almost alone with centralized virus contact-tracing app that probably won\'t work well, asks for your location, may be illegal’. ‘On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in the Isle of Wight – will work, and why it is a better solution to the one by Apple and Google that other nations have decided to adopt. It has also released a more technical explanation</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Running the Bluetooth connection in the back has several inconvenience such as draining the battery and opening security vulnerabilities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, the Bluetooth distance measurement is unreliable <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">according to its own inventor</a>. Bluetooth signals can pierce obstacles the virus hopefully cannot such as a wall or vehicle bodies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The margin of error has caused a return to lock down in Singapore, one of the first nations after China to deploy TraceTogether App. Less than 20% of the population actually downloaded the App It is suspected that Bluetooth works through glass and even some walls and may even be triggered by reflection in windows in buildings. Jason Bay Senior Director (Government Digital Services) at the Government Technology Agency, Singapore&nbsp;<a href=\"https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98\">wrote</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain ? (throw whatever buzzword you want), not for the foreseeabl</em>e future.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The amount of <strong>false alerts</strong> will cause major distress and reduce trust on the App. When someone receives the warning SMS that they have been in contact with someone COVID+, that doesn\'t mean the NHS can test them immediately. They might be asked to self isolate themselves which is not always technically possibly. It has been suggested in France that they would be hotels dedicated to quarantine. That means 14 days of accommodation, food and entertainment. During which time the person and his family or network will be under distress, maybe unnecessarily isolated causing loss of revenues. Should the government be liable for all that ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- These Apps are source of security issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The well known and security expert Bruce Schneier has expressed his concerns about the issues of using Bluetooth Technology <a href=\"https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"My problem with contact tracing apps is that they have absolutely no value,\" Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet &amp; Society at Harvard University, told BuzzFeed News. \"I\'m not even talking about the privacy concerns, I mean the efficacy. Does anybody think this will do something useful? ... This is just something governments want to do for the hell of it. To me, it\'s just techies doing techie things because they don\'t know what else to do.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">SecurityWeek reporter Kevin Townsend wrote</a> ‘<em>These apps could easily become subject to a high number of false positives – and false positives always lead to a rejection by users. ‘ que faire du stresse, isolation et perte de revenus consécutives au faux positives alertes? Le BT transverse les murs et un automobiliste à proximité pourrait être décelé conne en ‘contact’</em> .  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">As contact tracing gains attention, a researcher pokes a hole in Bluetooth technology</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>If someone is reluctant to self quarantine, will they ignore the warning messages ?</li><li>The most at risk populations are the over 60x, will they be willing to download the app ?</li><li>What are going the security issues of opening the Bluetooth connection be?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Any data base creates security issues. New NHS contact-tracing app vulnerable to ‘<em>malicious false alerts</em>’, warn experts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Additionaly, ‘<em>The new NHS contact-tracing app could be used to send malicious alerts causing people to isolate unnecessarily, it has been warned.</em></p><p><em>The app, which is being trialled in the Isle of Wight, tells users if someone they have been in proximity with may be suffering from coronavirus, meaning they could be exposed.</em></p><p><em>But because users can set off the warnings themselves by reporting symptoms – rather than positive Covid-19 test results – it could be used to send out false alerts.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\'Dr Michael Veale, a lecturer in digital rights and regulation at University College London who this week gave evidence to MPs on the technology, told The Independent that Britain’s tracing app had nothing to stop individuals “maliciously triggering notifications” using its normal functionality.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“People can deliberately put others into quarantine or report large areas,” he said. “A child could try to get a day off school by reporting symptoms from a parent’s phone to trigger a quarantine.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Constant Bluetooth signals in the back will drain the phone battery eventually causing over heating. Will be see a new epidemic of ‘pockets in fire’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ICAR, the Association of  experts in Cryptologic research has issued a statement against mass surveillance <a href=\"https://www.iacr.org/misc/statement-May2014.html\">\'The Copenhagen Resolution\'</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards. Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> <a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">A technical deep-dive into the NHS COVID-19 contact tracing app</a> : Since \'<em>the contact tracing beta is now open source for both&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-iOS-BETA\" target=\"_blank\"><em>iOS</em></a><em>&nbsp;and&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Android-BETA\" target=\"_blank\"><em>Android</em></a><em>, along with some&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Documentation-BETA\" target=\"_blank\"><em>documentation</em></a><em>. As a follow-up to our “</em><a href=\"https://reincubate.com/blog/staying-alive-covid-19-background-tracing/\"><em>Staying alive</em></a><em>” post, we’ve taken a deep-dive into the source code. It’s pleasantly surprising to find it licensed under MIT, indicating an NHSX commitment to transparency and quality... There have been claims that the Android app accesses location data, as the prompt for Bluetooth API access on Android devices appears to ask for location permissions. However, we debunked this yesterday: this is a consequence of how Android&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://developer.android.com/guide/topics/connectivity/bluetooth#Permissions\" target=\"_blank\"><em>manages requests for Bluetooth permissions</em></a><em>.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Reincubate’s CEO, Aidan Fitzpatrick, says:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, it is the case that the coming Apple&nbsp;<code>ExposureNotification</code>&nbsp;framework in iOS 13.5 obviates the need for these keepalives. However, it’s worth noting that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>iOS 13.5 has not been released, and may not be for some weeks</li><li>Prior to yesterday, the last iOS 13.5 beta had a&nbsp;<a href=\"https://siguza.github.io/psychicpaper/\" rel=\"noreferrer noopener\" target=\"_blank\">major security flaw</a>, suggesting heavy lifting is going on in Apple’s engineering teams</li><li>Once it is released, it will&nbsp;<a href=\"https://venturebeat.com/2020/01/29/as-ios-and-ipados-13-near-80-adoption-is-the-race-with-android-over/\" rel=\"noreferrer noopener\" target=\"_blank\">likely take months</a>&nbsp;for a majority of iOS users to install it (unusually, the equivalent Android adoption may be&nbsp;<a href=\"https://www.theverge.com/2020/4/13/21220033/android-covid-19-tracking-updates-google-play-contact-tracing\" rel=\"noreferrer noopener\" target=\"_blank\">more rapid</a>)</li><li>Older iOS devices — such as the iPhone 6 — cannot run iOS 13, and will not be able to use the Apple technique</li><li><em>There’s no reason why the NHS COVID-19 app won’t be able to automatically transition in future to using Apple’s framework — or even dual-running both mechanisms</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The app will become increasingly effective as more people use it, and the benefit of mass adoption will create a flywheel effect in this sense. The Australian COVIDSafe app struggled as it didn’t support detecting backgrounded iOS devices from an Android device, and it didn’t have this clever iOS-to-iOS keepalive mechanism.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to reflect on which circumstances make use of technology like this appropriate. If contact tracing is successful in saving lives, which criteria should be assessed as to whether it’s applied for future diseases? Once the precedent is set, is there an argument that this technology might be used to combat&nbsp;<em>pre-existing</em>&nbsp;infectious diseases? It’s foreseeable that different societies will evaluate the trade-offs differently.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III - The balance of Proportionality requires a three party test :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Fundamental rights, enshrined in the Charter of Fundamental Rights of the European Union constitute the core values of the European Union . These rights must be respected whenever the EU institutions and bodies design and implement new policies or adopt any new legislative measure and in the ECHR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU law which requires that \"<em>the content and form of Union action shall not exceed what is necessary to achieve the objectives of the treaties\"</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives\" . It therefore \"restricts the authorities in the exercise of their powers by requiring a balance to be struck between the means used and the intended aim (or Under Article 52(1) of the Charter, \"subject to the principle of proportionality, limitations </em><a href=\"#\"><em>onresult reached)\" the exercise of fundamental rights</em></a><em> may be made only if they are necessary (...</em>)\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The necessity</strong>, Something needs to be done to end this national confinement killing the country’s economy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the Data Protection Impact Assessment published by <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e. V. .</a> They recommend that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> An appropriate legal basis must be established and in this respect responsibilities have to be defined. </li><li>Reinforcing the measures of pseudonymisation \'when creating the TempIDs in the app, it must be ensured that there is no connection between TempIDs and it must never be possible to make one. ...The server(s)’ operator must employ an effective separation method...\'</li><li>Accompanying the publication of the app it must be ensured in law and in fact that users have to disclose neither the status of the app nor the mere existence on a device to third parties. </li><li>Before the app gets published, a comprehensive investigation of the software and the overall system must be conducted and published by an independent body. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2- Could the same result be achieved in a less intrusive way?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I would argue providing tests,, masks, ventilators and resources to over loaded NHS staff will bring a serious improvement with any inconvenient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The cost of the deployment of the NHSX App is unknown. The Australian Government would have allegedly spend 700.000 AUD just to host the data in Amazon AWS clouds. This is how much less resource the NHS will receive.<a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">h</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://martinralbrecht.wordpress.com/2020/05/03/open-letters-v-surveillance/﻿\">A letter, signed by 177 scientists and researchers working in the UK in the fields of information security and privacy, reads: </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<em>Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified.1 Such invasive information can include the ‘social graph’ of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens’ real-world activities.</em>”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Actually, early testing can give far better results as epidemiologists are saying it is during the first 24 hours that the COVID+ are most contagious. <em><a href=\"https://news.sky.com/story/coronavirus-send-virus-alerts-within-24-hours-or-risk-second-wave-scientist-warns-11984908\">\'Coronavirus: Send virus alerts within 24 hours or risk second wave, scientist warns</a></em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.wired.co.uk/article/contact-tracing-apps-coronavirus\"><strong>IV - Coronavirus contact tracing apps were meant to save us</strong></a><strong>. They won’t. ‘With little evidence to show how effective such apps are and growing privacy concerns, there’s a risk they could do more harm than good‘ </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>From Iceland to Israel,&nbsp;</em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\"><em>more than 30 systems</em></a><em>&nbsp;are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>False alerts might loose users trust. An Oxford research said that the probability of seeing any result from the tracing Apps requires that at least 60% of the population use the App. Will the most vulnerable population of over 60% be willing to download and use it ? Will the government be liable for the false alters causing distress, unnecessary isolation and loss of revenues? France is talking of self isolating in hotels, where and how feed and entertain these people? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Elsewhere projects using personal data to combat SARS-CoV-2 </a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://tracetogether.zendesk.com/hc/en-sg/articles/360046475654-20-April-2020-One-Month-On\"><em>Singapour’s TraceTogether App</em></a><em> moved to the The Apple and Google collaboration on digital contact tracing solutions, is a game-changer, as we said previously. It will significantly improve the contact tracing capability available to governments and public health authorities over what is available through public APIs on either Android or iOS platforms. We are glad that Apple and Google are engaging governments and public health authorities around the world, including us, to incorporate feedback as the specifications for their contract tracing protocol and private APIs.  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=e6e61ca3-45ae-49a0-b6f1-5fd4adf11291\">In Poland</a>, Although initially voluntary in nature, it has become mandatory for all those under obligatory quarantine or epidemiological surveillance, as a tool to confirm compliance with quarantine obligations (e.g. whether the ban on leaving the quarantine location is observed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Contact tracing apps in Austria: a Red Cross initiative |Has been launched In March 2020 in co-operation with Accenture. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The first published version of the Stopp Corona app required users to log their contacts via a \'manual\' handshake. In the current version, however, the app already allows contacts to be traced automatically, depending on the device and its configuration.&nbsp;</em></p><p><em>The automatic handshake functionality is based on the discovery and messaging functionality of the p2pkit developed by the Swiss company Uepaa, which uses Bluetooth and Wifi-direct techniques to determine the distance between the users.&nbsp;</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Switzerland: \"WeTrace\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>This project is ready to be deployed. It is open source. All data remains locally on the devices. Packaged information encrypted asymmetrically. The sole information a potential malfeasor on the central server would see is the fact _that_ an infected person has actually pushed a status update, but on the core server it is not visible \"what\" the person has broadcasted. The broadcasting user can determine the details of what should be broadcasted aside from status (location of contact, time of contact, etc.). Packages will be sent not to everyone but only to those that need to know.</em></p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Spain: \"Open Coronavirus\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The Spanish medical investigator Aurelia Bustos has released Open Coronavirus, an open-source app with the aim to copy the advantages of the South-Korean app: in the end, serving as an individual-validation-method in order to allow free movement of the citizens. This tool can be used by any public institution as a basis for its own apps on tracking citizens due to the coronavirus emergency, and it offers a modular design: three levels of management (mobile phone, central management of data by the competent authority and checking of the control points by the competent authority too) with different options of geolocation (GPS, bluetooth, positioning by mobile operators cells) that could be implemented or not by the corresponding institution. Its use would be voluntary for the citizen (although, in words of the medical investigator, \"it would be probably very advantageous for the user, as it would allow him/her to have the possibility to finish an eventually longer quarantine\"), and it would necessarily depend on the realization of any kind of coronavirus detection tests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>As this is an open-source app, that it will not be officially published in its current status, and any use of the same by any institutons must be always in line with GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, it can be said of the NHSX Tracing App, similar to the French STOPCOVID, that <a href=\"https://www.lemonde.fr/idees/article/2020/04/25/stopcovid-est-un-projet-desastreux-pilote-par-des-apprentis-sorciers_6037721_3232.html\">«&nbsp;StopCovid est un projet désastreux piloté par des apprentis sorciers&nbsp;»</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE 8th May</strong>, The Financial Times reveals \'<a href=\"https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b\">UK starts to build second contact tracing app</a>\' going for a decentralised model in collaboration with Apple and Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The different existing systems&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">The Chinese System based on geolocation</a></li><li><a href=\"https://github.com/DP-3T/documents\">The DP3T</a> Protocol&nbsp;(sous diverses variantes), sa déclinaison par l’alliance&nbsp;</li><li><a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a>&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\"> PACT- Est</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://pact.mit.edu/\">PACT-Ouest</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://github.com/TCNCoalition/TCN\">TCN</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">ROBERT</a> Protocol&nbsp;.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Liste of <a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Projects using personal data to combat SARS-CoV-2</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDRI <a href=\"https://edri.org/covid-19-digital-rights-document-pool/\">COVID-19 &amp; Digital Rights: Document Pool</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/sites/edp/files/publication/20-05-08_techdispatch-tracing_en.pdf\">Techdispatch&nbsp;\'</a>Contact Tracing with Mobile Applications\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:gallery {\"ids\":[930,931,932]} -->\n<ul class=\"wp-block-gallery columns-3 is-cropped\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQe2X0AE1.png\" alt=\"\" data-id=\"930\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqe2x0ae1/\" class=\"wp-image-930\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQexXQAYJ2.png\" alt=\"\" data-id=\"931\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqexxqayj2/\" class=\"wp-image-931\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQfQX0AEk3.png\" alt=\"\" data-id=\"932\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqfqx0aek3/\" class=\"wp-image-932\" /></figure></li></ul>\n<!-- /wp:gallery -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">Privacy International : A technical deep-dive into the NHS COVID-19 contact tracing app</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":933} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/EXethgcXgAAF4.jpeg\" alt=\"\" class=\"wp-image-933\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.privacyinternational.org/long-read/3752/coronavirus-tracking-uk-what-we-know-so-far\">UK government Covid tracking app: what you need to know!</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://insights.doughtystreet.co.uk/post/102g6tz/guide-to-coronavirus-offences-help-for-the-public-police-and-lawyers\">Guide to Coronavirus Offences. Help for the public, police and lawyers</a></em> by the Doughty Street Chambers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://axisofeasy.com/aoe/computer-model-that-locked-down-the-world-turns-out-to-be-shtcode/\">Computer model that locked down the world turns out to be sh*tcode.</a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A SPECIAL THANK YOU TO GRAEME McGOWAN for allowing me to use his beautiful photography.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','NHSX Contacts Tracing App','Is NHSX UK centralised Tracing APP capable of best combat the COVID19 propagation? the Balance of proportionality looks rather weak. ','inherit','closed','closed','','898-revision-v1','','','2020-05-08 12:21:50','2020-05-08 11:21:50','',898,'https://datarainbow.eu/2020/05/08/898-revision-v1/',0,'revision','',0),(949,5,'2020-05-08 12:46:25','2020-05-08 11:46:25','<!-- wp:paragraph -->\n<p>In UK, like in many countries, the contact tracing app is presented as the solution to get out of lockdown. Is technology really the right solution?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been written and the debate is still ongoing. We have published an article on <a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">the French government project of STOPCOVID. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK NHSX project is another centralised contact tracing App. A first tryout has started on the Isle of Wight since Tuesday May 2nd.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">I - </a>A<strong>nalysing the data protection compliance aspects of the project, from&nbsp;</strong><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\"><strong>Chris Pounder of Amber-walk has published his&nbsp;views</strong></a><strong> </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">COVID-19: how the GDPR applies to trace and track.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Emphasis is put in the voluntary adoption of the measure as requested by most EU Data Protection Authorties.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Chris Pounder develops, ‘<em>NHSX claim that every operation related to the APP is voluntary (e.g. to download, to communicate to a central database if need be). Users can choose to delete the APP at any time; this would also delete the data on the phone but not any data previously uploaded to NHSX’s central database.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data is pseudonymised more than anonymised as it can be re-identifiable, therefore it will be the GDPR and not the ePrivacy Directive that will apply</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a published DPIA, Chris reminds the government promise that ‘T<em>he APP does not use any identifier already on the phone (e.g. phone number, SIM card identifier) or location details.’ The APP generates a random ID number exchanged with other phones that have also downloaded the APP. This record will remain on both phones for 14 days. When someone is COVID+ this record will trace back the contacts with a warning message for the user</em> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- The APP should not keep any personal information and no location data. Only the first half of the postcode is collected from APP users to alert local hospitals.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, for <a href=\"https://tech.newstatesman.com/coronavirus/uncertainty-over-who-could-access-nhsx-contact-tracing-app-data-as-pilot-goes-live\">Laurie Clarke reporter</a>, remains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Uncertainty over who could access NHSX contact tracing app data as Isle of White pilot goes live’. ‘The NHSX coronavirus contact tracing app is being rolled out on the Isle of Wight this week, but major question marks still hang over the app. Matthew Gould, CEO of NHSX, told parliament today that the data collected by the app would be accessible to unspecified organisations as long as it was used for public health purposes. ‘</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>3- For Chris Pounder, ‘</strong><em><strong>there are three definitional issues:</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>(<em>a) is personal data processed? </em></li><li><em>b) if so, who is the controller processing personal data? and </em></li><li><em>(c) if there is a controller, does the voluntary nature of the APP equate to “data subject consent”?</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject is identifiable and the data related to medical health. He is therefore ‘<em>pretty sure the APP is processing personal data and special category of personal data</em>’, subject to the Article 6  lawful basis and a condition that overcomes the prohibition in Article 9(1) from processing health personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Controller, there would be joint controllers as he points to the NHSX website stating that “<em>NHS England and NHS Improvement and the Department of Health and Social Care are delivering NHSX together” This bring to the Article 26 that requires any processing of personal data “shall in a transparent manner determine their respective responsibilities</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the emphasis is on the voluntary adoption of the App, the next question  is on ”<em>data subject consent</em>”. Chris points out that <em>‘the NHS text on the website is very careful to avoid the use of the “C word” and it is easy to see why</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 states that with respect to consent: “<em>consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller</em>” This will be the case where the controller is a public authority or an employer. It will be unlikely for that consent to be considered as ‘<em>freely given</em>’. Therefore voluntary adoption does not refer the character of legitimate basis on consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The limit of the ‘<em>voluntary</em>’ adoption he sees is that it could lead to a denial of a service as previously for the ‘<em>ID Card holders refused to “volunteer” making it a requirement to interact with any public service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The first comment is that any interference by a public authority (NHSX) is unlikely to infringe Article 8(1) [_<a href=\"https://awallon.com:15001/oo/r/546619490369058645\">GDPR08</a>_]&nbsp;of the European Convention on Human Rights; This is because Article 8(2) permits legislation to be enacted by a Parliament process (e.g. in the Coronavirus 2 which sets aside the A.8(1) right in limited circumstances (e.g. any interference deemed&nbsp;<strong><em>necessary</em></strong>&nbsp; “<em>for the protection of health</em>”).&nbsp; It all hangs on the word “<em>necessary</em>”; it is either necessary or it isn’t. If there is reliance on data subject consent (which we think is unreliable), then there is also no A.8 breach (so long consent is properly formed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the GDPR/DPA2018,  <em>‘if the processing is “necessary” it will have Article 6 lawful basis (e.g. candidates are A.6(1)(c) or A.6(1)(e); A.6(1)(d) could be used in a case-by-case emergency). If there is need for an A.9 condition that lifts the prohibition on processing of health personal data the candidates are A.9(2)(c), A.9(2)(g), A.9(1)(i), Schedule 1, paragraphs2, 3 or 6 of the DPA2018</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>If there is reliance on consent or necessary or public task (or even necessary legitimate interests of controller/Third Party), the controller has to specify publicly (A.13; A.14) what happens to the personal data if there withdrawal of consent or exercise of the exercise of the right to object to the processing.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in he concludes ‘<em>the ICO should take up Article 8 ECHR cases on the grounds that necessary as used in the GDPR has the same meaning as in Article 8.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>II - The UK like France has opted for the centralised model </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The App is encountering technical issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.iacr.org/misc/statement-May2014.html\">UK ICO</a> like the <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">French CNIL</a> have expressed their preference for the decentralised model for a decentralised model. Chris Pounder sees further vulnerability of the centralised approach  with a ‘<em>future legislative mood of Government</em>’. He believes ‘<em>It could be tempting (e.g. to reduce the pressures on the public purse) for Government to enact legislation that makes certain processing of personal data compulsory. For instance, to prove entitlement to a COVID related benefit</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> <em>\'Considering to revert to a decentralised model to resolve their Bluetooth issues. ‘Covidsafe app is not working properly on iPhones, authorities admit’ ‘Australians running the Covidsafe contact tracing app on iPhones may not be recording all the data required if they don’t have the app running in the foreground or they are using an older model phone, the government has admitted.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://uk.reuters.com/article/us-health-coronavirus-france-tech/france-accuses-apple-of-refusing-help-with-stopcovid-app-idUKKBN22H0LX\">France is struggling to find an agreement with Apple and Google</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theguardian.com/world/2020/may/06/covidsafe-app-is-not-working-properly-on-iphones-authorities-admit\">Australia who has already deployed the App has been struggling technically </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/\">The Register</a> wrote: ‘<em>UK finds itself almost alone with centralized virus contact-tracing app that probably won\'t work well, asks for your location, may be illegal’. ‘On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in the Isle of Wight – will work, and why it is a better solution to the one by Apple and Google that other nations have decided to adopt. It has also released a more technical explanation</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Running the Bluetooth connection in the back has several inconvenience such as draining the battery and opening security vulnerabilities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, the Bluetooth distance measurement is unreliable <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">according to its own inventor</a>. Bluetooth signals can pierce obstacles the virus hopefully cannot such as a wall or vehicle bodies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The margin of error has caused a return to lock down in Singapore, one of the first nations after China to deploy TraceTogether App. Less than 20% of the population actually downloaded the App It is suspected that Bluetooth works through glass and even some walls and may even be triggered by reflection in windows in buildings. Jason Bay Senior Director (Government Digital Services) at the Government Technology Agency, Singapore&nbsp;<a href=\"https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98\">wrote</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain ? (throw whatever buzzword you want), not for the foreseeabl</em>e future.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The amount of <strong>false alerts</strong> will cause major distress and reduce trust on the App. When someone receives the warning SMS that they have been in contact with someone COVID+, that doesn\'t mean the NHS can test them immediately. They might be asked to self isolate themselves which is not always technically possibly. It has been suggested in France that they would be hotels dedicated to quarantine. That means 14 days of accommodation, food and entertainment. During which time the person and his family or network will be under distress, maybe unnecessarily isolated causing loss of revenues. Should the government be liable for all that ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- These Apps are source of security issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The well known and security expert Bruce Schneier has expressed his concerns about the issues of using Bluetooth Technology <a href=\"https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"My problem with contact tracing apps is that they have absolutely no value,\" Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet &amp; Society at Harvard University, told BuzzFeed News. \"I\'m not even talking about the privacy concerns, I mean the efficacy. Does anybody think this will do something useful? ... This is just something governments want to do for the hell of it. To me, it\'s just techies doing techie things because they don\'t know what else to do.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">SecurityWeek reporter Kevin Townsend wrote</a> ‘<em>These apps could easily become subject to a high number of false positives – and false positives always lead to a rejection by users. ‘ que faire du stresse, isolation et perte de revenus consécutives au faux positives alertes? Le BT transverse les murs et un automobiliste à proximité pourrait être décelé conne en ‘contact’</em> .  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">As contact tracing gains attention, a researcher pokes a hole in Bluetooth technology</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>If someone is reluctant to self quarantine, will they ignore the warning messages ?</li><li>The most at risk populations are the over 60x, will they be willing to download the app ?</li><li>What are going the security issues of opening the Bluetooth connection be?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Any data base creates security issues. New NHS contact-tracing app vulnerable to ‘<em>malicious false alerts</em>’, warn experts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Additionaly, ‘<em>The new NHS contact-tracing app could be used to send malicious alerts causing people to isolate unnecessarily, it has been warned.</em></p><p><em>The app, which is being trialled in the Isle of Wight, tells users if someone they have been in proximity with may be suffering from coronavirus, meaning they could be exposed.</em></p><p><em>But because users can set off the warnings themselves by reporting symptoms – rather than positive Covid-19 test results – it could be used to send out false alerts.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\'Dr Michael Veale, a lecturer in digital rights and regulation at University College London who this week gave evidence to MPs on the technology, told The Independent that Britain’s tracing app had nothing to stop individuals “maliciously triggering notifications” using its normal functionality.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“People can deliberately put others into quarantine or report large areas,” he said. “A child could try to get a day off school by reporting symptoms from a parent’s phone to trigger a quarantine.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Constant Bluetooth signals in the back will drain the phone battery eventually causing over heating. Will be see a new epidemic of ‘pockets in fire’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ICAR, the Association of  experts in Cryptologic research has issued a statement against mass surveillance <a href=\"https://www.iacr.org/misc/statement-May2014.html\">\'The Copenhagen Resolution\'</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards. Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> <a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">A technical deep-dive into the NHS COVID-19 contact tracing app</a> : Since \'<em>the contact tracing beta is now open source for both&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-iOS-BETA\" target=\"_blank\"><em>iOS</em></a><em>&nbsp;and&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Android-BETA\" target=\"_blank\"><em>Android</em></a><em>, along with some&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Documentation-BETA\" target=\"_blank\"><em>documentation</em></a><em>. As a follow-up to our “</em><a href=\"https://reincubate.com/blog/staying-alive-covid-19-background-tracing/\"><em>Staying alive</em></a><em>” post, we’ve taken a deep-dive into the source code. It’s pleasantly surprising to find it licensed under MIT, indicating an NHSX commitment to transparency and quality... There have been claims that the Android app accesses location data, as the prompt for Bluetooth API access on Android devices appears to ask for location permissions. However, we debunked this yesterday: this is a consequence of how Android&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://developer.android.com/guide/topics/connectivity/bluetooth#Permissions\" target=\"_blank\"><em>manages requests for Bluetooth permissions</em></a><em>.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Reincubate’s CEO, Aidan Fitzpatrick, says:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, it is the case that the coming Apple&nbsp;<code>ExposureNotification</code>&nbsp;framework in iOS 13.5 obviates the need for these keepalives. However, it’s worth noting that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>iOS 13.5 has not been released, and may not be for some weeks</li><li>Prior to yesterday, the last iOS 13.5 beta had a&nbsp;<a href=\"https://siguza.github.io/psychicpaper/\" rel=\"noreferrer noopener\" target=\"_blank\">major security flaw</a>, suggesting heavy lifting is going on in Apple’s engineering teams</li><li>Once it is released, it will&nbsp;<a href=\"https://venturebeat.com/2020/01/29/as-ios-and-ipados-13-near-80-adoption-is-the-race-with-android-over/\" rel=\"noreferrer noopener\" target=\"_blank\">likely take months</a>&nbsp;for a majority of iOS users to install it (unusually, the equivalent Android adoption may be&nbsp;<a href=\"https://www.theverge.com/2020/4/13/21220033/android-covid-19-tracking-updates-google-play-contact-tracing\" rel=\"noreferrer noopener\" target=\"_blank\">more rapid</a>)</li><li>Older iOS devices — such as the iPhone 6 — cannot run iOS 13, and will not be able to use the Apple technique</li><li><em>There’s no reason why the NHS COVID-19 app won’t be able to automatically transition in future to using Apple’s framework — or even dual-running both mechanisms</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The app will become increasingly effective as more people use it, and the benefit of mass adoption will create a flywheel effect in this sense. The Australian COVIDSafe app struggled as it didn’t support detecting backgrounded iOS devices from an Android device, and it didn’t have this clever iOS-to-iOS keepalive mechanism.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to reflect on which circumstances make use of technology like this appropriate. If contact tracing is successful in saving lives, which criteria should be assessed as to whether it’s applied for future diseases? Once the precedent is set, is there an argument that this technology might be used to combat&nbsp;<em>pre-existing</em>&nbsp;infectious diseases? It’s foreseeable that different societies will evaluate the trade-offs differently.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III - The balance of Proportionality requires a three party test :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Fundamental rights, enshrined in the Charter of Fundamental Rights of the European Union constitute the core values of the European Union . These rights must be respected whenever the EU institutions and bodies design and implement new policies or adopt any new legislative measure and in the ECHR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU law which requires that \"<em>the content and form of Union action shall not exceed what is necessary to achieve the objectives of the treaties\"</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives\" . It therefore \"restricts the authorities in the exercise of their powers by requiring a balance to be struck between the means used and the intended aim (or Under Article 52(1) of the Charter, \"subject to the principle of proportionality, limitations </em><a href=\"#\"><em>onresult reached)\" the exercise of fundamental rights</em></a><em> may be made only if they are necessary (...</em>)\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The necessity</strong>, Something needs to be done to end this national confinement killing the country’s economy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the Data Protection Impact Assessment published by <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e. V. .</a> They recommend that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> An appropriate legal basis must be established and in this respect responsibilities have to be defined. </li><li>Reinforcing the measures of pseudonymisation \'when creating the TempIDs in the app, it must be ensured that there is no connection between TempIDs and it must never be possible to make one. ...The server(s)’ operator must employ an effective separation method...\'</li><li>Accompanying the publication of the app it must be ensured in law and in fact that users have to disclose neither the status of the app nor the mere existence on a device to third parties. </li><li>Before the app gets published, a comprehensive investigation of the software and the overall system must be conducted and published by an independent body. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2- Could the same result be achieved in a less intrusive way?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I would argue providing tests,, masks, ventilators and resources to over loaded NHS staff will bring a serious improvement with any inconvenient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The cost of the deployment of the NHSX App is unknown. The Australian Government would have allegedly spend 700.000 AUD just to host the data in Amazon AWS clouds. This is how much less resource the NHS will receive.<a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">h</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://martinralbrecht.wordpress.com/2020/05/03/open-letters-v-surveillance/﻿\">A letter, signed by 177 scientists and researchers working in the UK in the fields of information security and privacy, reads: </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<em>Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified.1 Such invasive information can include the ‘social graph’ of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens’ real-world activities.</em>”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Actually, early testing can give far better results as epidemiologists are saying it is during the first 24 hours that the COVID+ are most contagious. <em><a href=\"https://news.sky.com/story/coronavirus-send-virus-alerts-within-24-hours-or-risk-second-wave-scientist-warns-11984908\">\'Coronavirus: Send virus alerts within 24 hours or risk second wave, scientist warns</a></em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.wired.co.uk/article/contact-tracing-apps-coronavirus\"><strong>IV - Coronavirus contact tracing apps were meant to save us</strong></a><strong>. They won’t. ‘With little evidence to show how effective such apps are and growing privacy concerns, there’s a risk they could do more harm than good‘ </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>From Iceland to Israel,&nbsp;</em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\"><em>more than 30 systems</em></a><em>&nbsp;are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>False alerts might loose users trust. An Oxford research said that the probability of seeing any result from the tracing Apps requires that at least 60% of the population use the App. Will the most vulnerable population of over 60% be willing to download and use it ? Will the government be liable for the false alters causing distress, unnecessary isolation and loss of revenues? France is talking of self isolating in hotels, where and how feed and entertain these people? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Elsewhere projects using personal data to combat SARS-CoV-2 </a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://tracetogether.zendesk.com/hc/en-sg/articles/360046475654-20-April-2020-One-Month-On\"><em>Singapour’s TraceTogether App</em></a><em> moved to the The Apple and Google collaboration on digital contact tracing solutions, is a game-changer, as we said previously. It will significantly improve the contact tracing capability available to governments and public health authorities over what is available through public APIs on either Android or iOS platforms. We are glad that Apple and Google are engaging governments and public health authorities around the world, including us, to incorporate feedback as the specifications for their contract tracing protocol and private APIs.  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=e6e61ca3-45ae-49a0-b6f1-5fd4adf11291\">In Poland</a>, Although initially voluntary in nature, it has become mandatory for all those under obligatory quarantine or epidemiological surveillance, as a tool to confirm compliance with quarantine obligations (e.g. whether the ban on leaving the quarantine location is observed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Contact tracing apps in Austria: a Red Cross initiative |Has been launched In March 2020 in co-operation with Accenture. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The first published version of the Stopp Corona app required users to log their contacts via a \'manual\' handshake. In the current version, however, the app already allows contacts to be traced automatically, depending on the device and its configuration.&nbsp;</em></p><p><em>The automatic handshake functionality is based on the discovery and messaging functionality of the p2pkit developed by the Swiss company Uepaa, which uses Bluetooth and Wifi-direct techniques to determine the distance between the users.&nbsp;</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Switzerland: \"WeTrace\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>This project is ready to be deployed. It is open source. All data remains locally on the devices. Packaged information encrypted asymmetrically. The sole information a potential malfeasor on the central server would see is the fact _that_ an infected person has actually pushed a status update, but on the core server it is not visible \"what\" the person has broadcasted. The broadcasting user can determine the details of what should be broadcasted aside from status (location of contact, time of contact, etc.). Packages will be sent not to everyone but only to those that need to know.</em></p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Spain: \"Open Coronavirus\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The Spanish medical investigator Aurelia Bustos has released Open Coronavirus, an open-source app with the aim to copy the advantages of the South-Korean app: in the end, serving as an individual-validation-method in order to allow free movement of the citizens. This tool can be used by any public institution as a basis for its own apps on tracking citizens due to the coronavirus emergency, and it offers a modular design: three levels of management (mobile phone, central management of data by the competent authority and checking of the control points by the competent authority too) with different options of geolocation (GPS, bluetooth, positioning by mobile operators cells) that could be implemented or not by the corresponding institution. Its use would be voluntary for the citizen (although, in words of the medical investigator, \"it would be probably very advantageous for the user, as it would allow him/her to have the possibility to finish an eventually longer quarantine\"), and it would necessarily depend on the realization of any kind of coronavirus detection tests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>As this is an open-source app, that it will not be officially published in its current status, and any use of the same by any institutons must be always in line with GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, it can be said of the NHSX Tracing App, similar to the French STOPCOVID, that <a href=\"https://www.lemonde.fr/idees/article/2020/04/25/stopcovid-est-un-projet-desastreux-pilote-par-des-apprentis-sorciers_6037721_3232.html\">«&nbsp;StopCovid est un projet désastreux piloté par des apprentis sorciers&nbsp;»</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE 8th May</strong>, The Financial Times reveals \'<a href=\"https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b\">UK starts to build second contact tracing app</a>\' going for a decentralised model in collaboration with Apple and Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The different existing systems&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">The Chinese System based on geolocation</a></li><li><a href=\"https://github.com/DP-3T/documents\">The DP3T</a> Protocol&nbsp;(sous diverses variantes), sa déclinaison par l’alliance&nbsp;</li><li><a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a>&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\"> PACT- Est</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://pact.mit.edu/\">PACT-Ouest</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://github.com/TCNCoalition/TCN\">TCN</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">ROBERT</a> Protocol&nbsp;.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Liste of <a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Projects using personal data to combat SARS-CoV-2</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDRI <a href=\"https://edri.org/covid-19-digital-rights-document-pool/\">COVID-19 &amp; Digital Rights: Document Pool</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/sites/edp/files/publication/20-05-08_techdispatch-tracing_en.pdf\">Techdispatch&nbsp;\'</a>Contact Tracing with Mobile Applications\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:gallery {\"ids\":[930,931,932]} -->\n<ul class=\"wp-block-gallery columns-3 is-cropped\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQe2X0AE1.png\" alt=\"\" data-id=\"930\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqe2x0ae1/\" class=\"wp-image-930\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQexXQAYJ2.png\" alt=\"\" data-id=\"931\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqexxqayj2/\" class=\"wp-image-931\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQfQX0AEk3.png\" alt=\"\" data-id=\"932\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqfqx0aek3/\" class=\"wp-image-932\" /></figure></li></ul>\n<!-- /wp:gallery -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">Privacy International : A technical deep-dive into the NHS COVID-19 contact tracing app</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":933} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/EXethgcXgAAF4.jpeg\" alt=\"\" class=\"wp-image-933\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.privacyinternational.org/long-read/3752/coronavirus-tracking-uk-what-we-know-so-far\">UK government Covid tracking app: what you need to know!</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://insights.doughtystreet.co.uk/post/102g6tz/guide-to-coronavirus-offences-help-for-the-public-police-and-lawyers\">Guide to Coronavirus Offences. Help for the public, police and lawyers</a></em> by the Doughty Street Chambers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://axisofeasy.com/aoe/computer-model-that-locked-down-the-world-turns-out-to-be-shtcode/\">Computer model that locked down the world turns out to be sh*tcode.</a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A SPECIAL THANK YOU TO GRAEME McGOWAN for allowing me to use his beautiful photography.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','NHSX Contacts Tracing App','Is NHSX UK centralised Tracing APP capable of best combat the COVID19 propagation? the Balance of proportionality looks rather weak. ','inherit','closed','closed','','898-revision-v1','','','2020-05-08 12:46:25','2020-05-08 11:46:25','',898,'https://datarainbow.eu/2020/05/08/898-revision-v1/',0,'revision','',0),(951,5,'2020-05-13 23:33:16','2020-05-13 22:33:16','<!-- wp:paragraph -->\n<p><strong><a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\">Avis du Conseil Constitutionnel</a> sur la loi d’urgence</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Communiqué de presse Décision n°<a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\"> 2020-800 DC</a> du 11 mai 2020 - </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.assemblee-nationale.fr/dyn/15/textes/l15t0418_texte-adopte-seance\">Loi prorogeant l\'état d\'urgence sanitaire et complétant ses dispositions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://awallon.com/wordpress/wp-admin/post.php?post=726&amp;action=edit&amp;classic-editor__forget#\"> Non conformité partielle - réserve </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le Président de la République et le Président du Sénat ont demandé au Conseil constitutionnel (Cons. const., 11 mai 2020, <a href=\"https://www.conseil-constitutionnel.fr/decision/2020/2020800DC.htm\">n°&nbsp;2020-800&nbsp;DC</a>) de se prononcer sur la conformité à la Constitution de dispositions de l\'article 1er et des articles 3, 5 et 11 de cette <a href=\"https://www.vie-publique.fr/loi/274230-loi-du-11-mai-2020-prolongation-etat-durgence-sanitaire\">loi</a> (la <a href=\"https://www.legifrance.gouv.fr/eli/loi/2020/5/11/PRMX2010645L/jo/texte\">loi n°&nbsp;2020-546&nbsp;du 11 mai 2020</a>, publiée au Journal officiel du 12 mai, proroge jusqu’au 10 juillet 2020 l’état d’urgence sanitaire déclaré par l’article 4 de la loi n°&nbsp;2020-290&nbsp;du 23 mars 2020 d’urgence pour faire face à l’épidémie&nbsp;de covid-19. Elle est complétée par le <a href=\"https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=D1BAA5E6CCAC7D7B6E6864C32189E998.tplgfr34s_1?cidTexte=JORFTEXT000041865329&amp;dateTexte=&amp;oldAction=rechJO&amp;categorieLien=id&amp;idJO=JORFCONT000041865241\">décret n°&nbsp;2020-548</a>&nbsp;du même jour). Outre les mêmes articles, les recours parlementaires en contestaient la procédure d\'adoption et l\'article 9. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le lundi 11 mai, le Conseil constitutionnel a rendu son avis sur la loi votée par le Parlement samedi. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Comme bon nombre de journaux, Franceinfo passe outre les objections du Conseil et titre<a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\"> “Le Conseil Constitutionnel valide la loi prorogeant l\'état d\'urgence, mais censure des éléments liés à l\'isolement et au \"traçage numérique”</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En réalité, la position du Conseil Constitutionnel est bien plus nuancée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Si le texte et la majorité des mesures sur le déconfinement sont validés, les mesures liées au traçage numérique des contacts sont fermement critiquées. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A- Les mesures votées portant sur :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>les conditions d\'engagement de la responsabilité pénale en cas de catastrophe sanitaire</li><li> le régime de l\'état d\'urgence sanitaire<br>﻿</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Le Conseil constate que le législateur  procéde à une conciliation équilibrée entre ces exigences constitutionnelles en adoptant les mesures autorisant le Premier ministre à réglementer ou interdire la circulation des personnes et des véhicules, en réglementant l\'accès aux moyens de transport et les conditions de leur usage ou en ordonnant la fermeture provisoire et réglementant l\'ouverture des établissements recevant du public ainsi que des lieux de réunion. S\'agissant de ces lieux, il a en particulier relevé qu\'ils ne s\'étendaient pas aux locaux à usage d\'habitation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour ce qui est des mesures du 7° du paragraphe I de l\'<a href=\"https://www.legifrance.gouv.fr/affichCodeArticle.do?idArticle=LEGIARTI000041747777&amp;cidTexte=LEGITEXT000006072665&amp;dateTexte=20200324\">article L. 3131-15 du code de la santé publique</a> de réquisitions de personnes, de biens et de services permises, le Conseil Constitutionnel a rappelé l’exigence de <strong>nécessité</strong> de la mesure à contrer ‘<em>la catastrophe sanitaire</em>’. Les réquisitions ouvriront droit à indemnisation, dans les conditions prévues par le code de la défense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deux censures partielles donc pour limiter le nombre de personnes pouvant accéder à ces données, et pour qu\'un juge des libertés puisse effectuer un \"<em>contrôle</em>\" si le malade ne peut pas sortir plus de 12 heures par jour de son lieu d\'isolement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>B- Les mesures privative de liberté</strong> <strong>portant sur la mise en quarantaine et le placement en isolement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cette mesure de quarantaine pouvant être prolongée à un mois est privative de liberté. Se fondant sur l\'<a href=\"https://www.legifrance.gouv.fr/affichTexteArticle.do?idArticle=LEGIARTI000006527558&amp;cidTexte=LEGITEXT000006071194&amp;dateTexte=19581005\">article 66 de la Constitution</a> et conformément à une jurisprudence constante, le Conseil constitutionnel a rappelé que “<em>la liberté individuelle, dont la protection est confiée à l\'autorité judiciaire, ne saurait être entravée par une rigueur non nécessaire. Les atteintes portées à l\'exercice de cette liberté doivent être adaptées, <strong>nécessaires et proportionnées aux objectifs poursuivis.</strong></em>” </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cette mesure parait alors conforme à l’objectif de valeur constitutionnelle de protection de la santé concernant l’entrée dans une zone de circulation de l’infraction, sous reserve d’une constatation par certificat médical, prolongée au-delà de 14 jours sur avis medical établissant la nécessité de cette prolongation afin d’en <strong>garantir la nécessité et la proportionnalité.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le <strong>juge des libertés et de la détention</strong> devra être préalablement saisi par le Préfet afin d’autoriser la prolongation de la mesure d’isolement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>C- Les mesures portant sur le système d\'information destiné à permettre le traitement de données destinées au « traçage » des personnes atteintes par le covid-19 et de celles ayant été en contact avec ces dernières</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>le Conseil constitutionnel a rappelé qu\'il résulte du droit constitutionnel au respect de la vie privée que la collecte, l\'enregistrement, la conservation, la consultation et la communication de données à caractère personnel doivent être justifiés par un <strong>motif d\'intérêt général</strong> et mis en œuvre de manière adéquate et <strong>proportionnée à cet objectif.</strong> Il a en outre jugé pour la première fois que, lorsque sont en cause des <strong>données à caractère personnel de nature médicale</strong>, une particulière vigilance doit être observée dans la conduite de ces opérations et la détermination de leurs modalités.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour le Conseil, les dispositions adoptées portent <strong>atteinte au droit au respect de la vie privée</strong>. Seules quatre finalités pourraient justifier une telle atteinte à la vie privée. La collecte devra être <strong>limitée</strong> “<em>aux seules données relatives au statut virologique ou sérologique des personnes à l\'égard de la maladie covid-19 ou aux <strong>éléments probants de diagnostic</strong> clinique et d\'imagerie médicale précisés par décret en Conseil d\'État pris après avis du Haut Conseil de la santé publique.</em>” Apportant une exigence supplémentaire au-delà d\'une simple pseudonymisation de <strong>supprimer les coordonnées téléphoniques et électroniques des intéressés</strong>.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Malgré la validation d’un champ relativement large des personnes susceptibles d’avoir accès à ces données personnelles, les p<strong>ersonnels d’accompagnement social </strong>ne relevant pas directement de la lutte contre l’épidémie devraient être <strong>exclus</strong> de la liste en l’absence de consentement des intéressés. Le <strong>consentement</strong> des intéressés est ici retenu comme critère de partage de l’information notamment avec les tiers avec qui ils seraient en contact. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les <strong>sous-traitants</strong> devront être soumis au secret professionnel et répondre aux critères habituels de garantie. [_<a href=\"https://awallon.com/d/s/546474490935162525/NFqrQeVzSR_CX79NNl06bvw5rqVhdEJh-prqAU9yslgc_\">RGPD28</a>_]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce dispositif ne pourra en aucune façon être prolongé au-delà du temps strictement nécessaire à la lutte contre la propagation de l’épidémie. Il devra être pris soin de <strong>supprimer les données trois mois après leur collecte.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On aurait aimé savoir que cet effacement, voir le déroulement même de ces mesures, seraient accompagnés et mis sous contrôle d\'un organisme tel la CNIL garante du respect de la réglementation sur la Protection des données.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'Le principe de proportionnalité doit être appliqué dans toutes ses dimensions et le noyau dur des libertés doit être sanctuarisé.... Il ne suffit pas d’invoquer la proportionnalité en des formules creuses et vite expédiées, comme aime à le faire le Conseil constitutionnel : il convient d’effectuer les vérifications qu’il implique en ses trois éléments d’adéquation, de proportionnalité&nbsp;<em>stricto sensu</em>&nbsp;et de nécessité, étant rappelé que la mesure critiquée doit subir avec succès l’examen sur ces trois aspects successivement.\' écrit <a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/les-libertes-et-les-mesures-prises-pour-lutter-contre-la-propagation-du-covid-19-sanctuariser-le-noyau-dur-des-libertes/\">Patrick Wachsmann, Professeur émérite à l’Université de Strasbourg, IRCM</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Par ailleurs, aucune <strong>analyse d’impact </strong>de l’Application STOPCOVID n’a encore été publiée. Voir Fiche CNIL <a href=\"https://www.cnil.fr/fr/quelles-formalites-pour-les-traitements-de-donnees-de-sante-caractere-personnel\"> Quelles formalités pour les traitements de données de santé à caractère personnel ? </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>le responsable de traitement doit être en mesure de démontrer, à tout moment, sa conformité aux exigences du RGPD en traçant toutes les démarches entreprises (principe d’accountability). Il faudra notamment :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>mettre en place un registre des traitements (outil recensant l’ensemble des traitements mis en œuvre dans votre structure). Pour vous aider, vous pouvez consulter le modèle de registre et la fiche pratique sur le registre des traitements ;</em></li><li><em>mener des analyses d’impact pour les traitements considérés comme présentant « un risque élevé » pour les personnes. Pour vous aider, vous pouvez consulter la rubrique « Analyses d’impact » (FAQ, logiciel d’aide à la réalisation d’une étude d’impact, guides) ;</em></li><li><em>veiller à encadrer l’information des personnes concernées (patients, fournisseurs, étudiants, usagers, etc.) et s’assurer de l’effectivité de leurs droits (droit d’accès, de rectification, d’opposition, etc.). Pour vous aider, vous pouvez consulter la fiche pratique Traitements de données de santé, comment informer les personnes concernées ? ».</em></li><li><em>formaliser les rôles et responsabilités du responsable de traitement. Pour vous aider, vous pouvez consulter le guide sous-traitant ;</em></li><li><em>lorsque cela est obligatoire, désigner un délégué à la protection des données (DPO). Sur ce point, vous pouvez consulter la fiche « Désigner un délégué à la protection des données » ;</em></li><li><em>renseigner les actions menées pour garantir la sécurité des données ;</em></li><li><em>Etc.</em><br>﻿</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On pourra s’étonner de ce que le Conseil Constitutionnel n’ait pas souhaité se référer dans son avis à l’organisme en charge de la protection des données personnelles, en l’occurence la <a href=\"https://www.cnil.fr/en/home\">CNIL</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lire aussi :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">STOP-COVID COMBATTRE LA PANDÉMIE SANS INFECTER LA DÉMOCRATIE</a></li><li><a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/les-libertes-et-les-mesures-prises-pour-lutter-contre-la-propagation-du-covid-19-une-accoutumance-aux-regimes-dexception/\">Les libertés et les mesures prises pour lutter contre la propagation du Covid-19 : une accoutumance aux régimes d’exception</a></li><li><a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/libertes-mesures-prises-pour-lutter-contre-propagation-covid-19-lindividualisme-subordonne-logique-sante/\">Les libertés et les mesures prises pour lutter contre la propagation du Covid-19 : l’individualisme subordonné à une logique de santé</a></li><li><a href=\"https://www.elysee.fr/emmanuel-macron/2020/05/11/communique-de-presse-du-president-de-la-republique-et-du-premier-ministre\">Communiqué commun du Président et du Premier Ministre au coeur de la nuit car la loi d’état d’urgence sanitaire n’a pu être promulguée à temps pour ce lundi,</a> le conseil constitutionnel n’ayant pas rendu son avis. Un vide juridique existait</li><li><a href=\"https://www.legalis.net/actualite/confinement-pas-didentification-des-personnes-par-les-drones/\">État d’urgence pour les données de santé (I) : l’application StopCovid</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','Les dispositions de prolongation de l\'etat d\'urgence soumises à l\'avis du Conseil Constitutionnel','Le lundi 11 mai, le Conseil constitutionnel a rendu son avis sur la loi votée par le Parlement samedi. ','publish','closed','closed','','les-dispositions-de-prolongation-de-letat-durgence-soumises-a-lavis-du-conseil-constitutionnel','','','2020-05-14 00:13:49','2020-05-13 23:13:49','',0,'http://datarainbow.eu/?p=951',0,'post','',0),(952,5,'2020-05-13 23:28:58','2020-05-13 22:28:58','','Screenshot 2020-05-13 at 23.28.26','','inherit','closed','closed','','screenshot-2020-05-13-at-23-28-26','','','2020-05-13 23:28:58','2020-05-13 22:28:58','',951,'/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-13-at-23.28.26.png',0,'attachment','image/png',0),(953,5,'2020-05-13 23:33:16','2020-05-13 22:33:16','<!-- wp:paragraph -->\n<p><strong><a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\">Avis du Conseil Constitutionnel</a> sur la loi d’urgence</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\">Co</a>mmuniqué de presse Décision n° 2020-800 DC du 11 mai 2020 - Communiqué de presse</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.assemblee-nationale.fr/dyn/15/textes/l15t0418_texte-adopte-seance\">Loi prorogeant l\'état d\'urgence sanitaire et complétant ses dispositions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://awallon.com/wordpress/wp-admin/post.php?post=726&amp;action=edit&amp;classic-editor__forget#\"> Non conformité partielle - réserve </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le Président de la République et le Président du Sénat ont demandé au Conseil constitutionnel (Cons. const., 11 mai 2020, <a href=\"https://www.conseil-constitutionnel.fr/decision/2020/2020800DC.htm\">n°&nbsp;2020-800&nbsp;DC</a>) de se prononcer sur la conformité à la Constitution de dispositions de l\'article 1er et des articles 3, 5 et 11 de cette <a href=\"https://www.vie-publique.fr/loi/274230-loi-du-11-mai-2020-prolongation-etat-durgence-sanitaire\">loi</a> (la <a href=\"https://www.legifrance.gouv.fr/eli/loi/2020/5/11/PRMX2010645L/jo/texte\">loi n°&nbsp;2020-546&nbsp;du 11 mai 2020</a>, publiée au Journal officiel du 12 mai, proroge jusqu’au 10 juillet 2020 l’état d’urgence sanitaire déclaré par l’article 4 de la loi n°&nbsp;2020-290&nbsp;du 23 mars 2020 d’urgence pour faire face à l’épidémie&nbsp;de covid-19. Elle est complétée par le <a href=\"https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=D1BAA5E6CCAC7D7B6E6864C32189E998.tplgfr34s_1?cidTexte=JORFTEXT000041865329&amp;dateTexte=&amp;oldAction=rechJO&amp;categorieLien=id&amp;idJO=JORFCONT000041865241\">décret n°&nbsp;2020-548</a>&nbsp;du même jour). Outre les mêmes articles, les recours parlementaires en contestaient la procédure d\'adoption et l\'article 9. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le lundi 11 mai, le Conseil constitutionnel a rendu son avis sur la loi votée par le Parlement samedi. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Comme bon nombre de journaux, Franceinfo passe outre les objections du Conseil et titre<a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\"> “Le Conseil constitutionnel valide la loi prorogeant l\'état d\'urgence, mais censure des éléments liés à l\'isolement et au \"traçage numérique”</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En réalité, la position du Conseil Constitutionnel est bien plus nuancée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Si le texte et la majorité des mesures sur le déconfinement sont validées, les mesures liées au traçage numérique des contacts sont fermement critiquées. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A- Les mesures votées portant sur :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>les conditions d\'engagement de la responsabilité pénale en cas de catastrophe sanitaire</li><li> le régime de l\'état d\'urgence sanitaire<br>﻿</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Le Conseil constate que le législateur  procéde à une conciliation équilibrée entre ces exigences constitutionnelles en adoptant les mesures autorisant le Premier ministre à réglementer ou interdire la circulation des personnes et des véhicules, en réglementant l\'accès aux moyens de transport et les conditions de leur usage ou en ordonnant la fermeture provisoire et réglementant l\'ouverture des établissements recevant du public ainsi que des lieux de réunion. S\'agissant de ces lieux, il a en particulier relevé qu\'ils ne s\'étendaient pas aux locaux à usage d\'habitation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour ce qui est des mesures du 7° du paragraphe I de l\'<a href=\"https://www.legifrance.gouv.fr/affichCodeArticle.do?idArticle=LEGIARTI000041747777&amp;cidTexte=LEGITEXT000006072665&amp;dateTexte=20200324\">article L. 3131-15 du code de la santé publique</a> de réquisitions de personnes, de biens et de services permises, le Conseil Constitutionnel a rappelé l’exigence de nécessité de la mesure à contrer ‘<em>la catastrophe sanitaire</em>’. Les réquisitions ouvriront droit à indemnisation, dans les conditions prévues par le code de la défense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deux censures partielles donc pour limiter le nombre de personnes pouvant accéder à ces données, et pour qu\'un juge des libertés puisse effectuer un \"<em>contrôle</em>\" si le malade ne peut pas sortir plus de 12 heures par jour de son lieu d\'isolement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>B- Les mesures portant sur la mise en quarantaine et le placement en isolement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cette mesure de quarantaine pouvant être prolongée à un mois est privative de liberté. Se fondant sur l\'<a href=\"https://www.legifrance.gouv.fr/affichTexteArticle.do?idArticle=LEGIARTI000006527558&amp;cidTexte=LEGITEXT000006071194&amp;dateTexte=19581005\">article 66 de la Constitution</a> et conformément à une jurisprudence constante, le Conseil constitutionnel a rappelé que “<em>la liberté individuelle, dont la protection est confiée à l\'autorité judiciaire, ne saurait être entravée par une rigueur non nécessaire. Les atteintes portées à l\'exercice de cette liberté doivent être adaptées, <strong>nécessaires et proportionnées aux objectifs poursuivis.</strong></em>” </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cette mesure parait alors conforme à l’objectif de valeur constitutionnelle de protection de la santé concernant l’entrée dans une zone de circulation de l’infraction, sous reserve d’une constatation par certificat médical, prolongée au-delà de 14 jours sur avis medical établissant la nécessité de cette prolongation afin d’en <strong>garantir la nécessité et la proportionnalité.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le <strong>juge des libertés et de la détention</strong> devra être préalablement saisi par le Préfet afin d’autoriser la prolongation de la mesure d’isolement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>C- Les mesures portant sur le système d\'information destiné à permettre le traitement de données destinées au « traçage » des personnes atteintes par le covid-19 et de celles ayant été en contact avec ces dernières</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>le Conseil constitutionnel a rappelé qu\'il résulte du droit constitutionnel au respect de la vie privée que la collecte, l\'enregistrement, la conservation, la consultation et la communication de données à caractère personnel doivent être justifiés par un <strong>motif d\'intérêt général</strong> et mis en œuvre de manière adéquate et <strong>proportionnée à cet objectif.</strong> Il a en outre jugé pour la première fois que, lorsque sont en cause des <strong>données à caractère personnel de nature médicale</strong>, une particulière vigilance doit être observée dans la conduite de ces opérations et la détermination de leurs modalités.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour le Conseil, les dispositions adoptées portent <strong>atteinte au droit au respect de la vie privée</strong>. Seules quatre finalités pourraient justifier une telle atteinte à la vie privée. La collecte devra être <strong>limitée</strong> “<em>aux seules données relatives au statut virologique ou sérologique des personnes à l\'égard de la maladie covid-19 ou aux éléments probants de diagnostic clinique et d\'imagerie médicale précisés par décret en Conseil d\'État pris après avis du Haut Conseil de la santé publique.</em>” Apportant une exigence supplémentaire au-delà d\'une simple pseudonymisation de <strong>supprimer les coordonnées téléphoniques et électroniques des intéressés</strong>.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Malgré la validation d’un champ relativement large des personnes susceptibles d’avoir accès à ces données personnelles, les p<strong>ersonnels d’accompagnement social </strong>ne relevant pas directement de la lutte contre l’épidémie devraient être <strong>exclus</strong> de la liste en l’absence de consentement des intéressés. Le consentement des intéressés est ici retenu comme critère de partage de l’information notamment avec les tiers avec qui ils seraient en contact. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les <strong>sous-traitants</strong> devront être soumis au secret professionnel et répondre aux critères habituels de garantie. [_<a href=\"https://awallon.com/d/s/546474490935162525/NFqrQeVzSR_CX79NNl06bvw5rqVhdEJh-prqAU9yslgc_\">RGPD28</a>_]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce dispositif ne pourra en aucune façon être prolongé au-delà du temps strictement nécessaire à la lutte contre la propagation de l’épidémie. Il devra être pris soin de <strong>supprimer les données trois mois après leur collecte.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On aurait aimé savoir que cet effacement, voir le déroulement même de ces mesures, seraient accompagnés et sous contrôle d\'un organisme tel la CNIL garante du respect de la réglementation sur la Protection des données.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'Le principe de proportionnalité doit être appliqué dans toutes ses dimensions et le noyau dur des libertés doit être sanctuarisé.... Il ne suffit pas d’invoquer la proportionnalité en des formules creuses et vite expédiées, comme aime à le faire le Conseil constitutionnel : il convient d’effectuer les vérifications qu’il implique en ses trois éléments d’adéquation, de proportionnalité&nbsp;<em>stricto sensu</em>&nbsp;et de nécessité, étant rappelé que la mesure critiquée doit subir avec succès l’examen sur ces trois aspects successivement.\' écrit <a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/les-libertes-et-les-mesures-prises-pour-lutter-contre-la-propagation-du-covid-19-sanctuariser-le-noyau-dur-des-libertes/\">Patrick Wachsmann, Professeur émérite à l’Université de Strasbourg, IRCM</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Par ailleurs, aucune <strong>analyse d’impact </strong>de l’Application STOPCOVID n’a encore été publiée. Voir Fiche CNIL <a href=\"https://www.cnil.fr/fr/quelles-formalites-pour-les-traitements-de-donnees-de-sante-caractere-personnel\"> Quelles formalités pour les traitements de données de santé à caractère personnel ? </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>le responsable de traitement doit être en mesure de démontrer, à tout moment, sa conformité aux exigences du RGPD en traçant toutes les démarches entreprises (principe d’accountability). Il faudra notamment :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>mettre en place un registre des traitements (outil recensant l’ensemble des traitements mis en œuvre dans votre structure). Pour vous aider, vous pouvez consulter le modèle de registre et la fiche pratique sur le registre des traitements ;</em></li><li><em>mener des analyses d’impact pour les traitements considérés comme présentant « un risque élevé » pour les personnes. Pour vous aider, vous pouvez consulter la rubrique « Analyses d’impact » (FAQ, logiciel d’aide à la réalisation d’une étude d’impact, guides) ;</em></li><li><em>veiller à encadrer l’information des personnes concernées (patients, fournisseurs, étudiants, usagers, etc.) et s’assurer de l’effectivité de leurs droits (droit d’accès, de rectification, d’opposition, etc.). Pour vous aider, vous pouvez consulter la fiche pratique Traitements de données de santé, comment informer les personnes concernées ? ».</em></li><li><em>formaliser les rôles et responsabilités du responsable de traitement. Pour vous aider, vous pouvez consulter le guide sous-traitant ;</em></li><li><em>lorsque cela est obligatoire, désigner un délégué à la protection des données (DPO). Sur ce point, vous pouvez consulter la fiche « Désigner un délégué à la protection des données » ;</em></li><li><em>renseigner les actions menées pour garantir la sécurité des données ;</em></li><li><em>Etc.</em><br>﻿</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On pourra s’étonner de ce que le Conseil Constitutionnel n’ait pas souhaité se référer dans son avis à l’organisme en charge de la protection des données personnelles, en l’occurence la <a href=\"https://www.cnil.fr/en/home\">CNIL</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lire aussi :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">STOP-COVID COMBATTRE LA PANDÉMIE SANS INFECTER LA DÉMOCRATIE</a></li><li><a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/les-libertes-et-les-mesures-prises-pour-lutter-contre-la-propagation-du-covid-19-une-accoutumance-aux-regimes-dexception/\">Les libertés et les mesures prises pour lutter contre la propagation du Covid-19 : une accoutumance aux régimes d’exception</a></li><li><a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/libertes-mesures-prises-pour-lutter-contre-propagation-covid-19-lindividualisme-subordonne-logique-sante/\">Les libertés et les mesures prises pour lutter contre la propagation du Covid-19 : l’individualisme subordonné à une logique de santé</a></li><li><a href=\"https://www.elysee.fr/emmanuel-macron/2020/05/11/communique-de-presse-du-president-de-la-republique-et-du-premier-ministre\">Communiqué commun du Président et du Premier Ministre au coeur de la nuit car la loi d’état d’urgence sanitaire n’a pu être promulguée à temps pour ce lundi,</a> le conseil constitutionnel n’ayant pas rendu son avis. Un vide juridique existait</li><li><a href=\"https://www.legalis.net/actualite/confinement-pas-didentification-des-personnes-par-les-drones/\">État d’urgence pour les données de santé (I) : l’application StopCovid</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','Les dispositions de prolongation de l\'etat d\'urgence soumises à l\'avis du Conseil Constitutionnel','Le lundi 11 mai, le Conseil constitutionnel a rendu son avis sur la loi votée par le Parlement samedi. ','inherit','closed','closed','','951-revision-v1','','','2020-05-13 23:33:16','2020-05-13 22:33:16','',951,'https://datarainbow.eu/2020/05/13/951-revision-v1/',0,'revision','',0),(955,5,'2020-05-14 00:06:32','2020-05-13 23:06:32','<!-- wp:paragraph -->\n<p><strong><a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\">Avis du Conseil Constitutionnel</a> sur la loi d’urgence</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Communiqué de presse Décision n°<a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\"> 2020-800 DC</a> du 11 mai 2020 - </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.assemblee-nationale.fr/dyn/15/textes/l15t0418_texte-adopte-seance\">Loi prorogeant l\'état d\'urgence sanitaire et complétant ses dispositions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://awallon.com/wordpress/wp-admin/post.php?post=726&amp;action=edit&amp;classic-editor__forget#\"> Non conformité partielle - réserve </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le Président de la République et le Président du Sénat ont demandé au Conseil constitutionnel (Cons. const., 11 mai 2020, <a href=\"https://www.conseil-constitutionnel.fr/decision/2020/2020800DC.htm\">n°&nbsp;2020-800&nbsp;DC</a>) de se prononcer sur la conformité à la Constitution de dispositions de l\'article 1er et des articles 3, 5 et 11 de cette <a href=\"https://www.vie-publique.fr/loi/274230-loi-du-11-mai-2020-prolongation-etat-durgence-sanitaire\">loi</a> (la <a href=\"https://www.legifrance.gouv.fr/eli/loi/2020/5/11/PRMX2010645L/jo/texte\">loi n°&nbsp;2020-546&nbsp;du 11 mai 2020</a>, publiée au Journal officiel du 12 mai, proroge jusqu’au 10 juillet 2020 l’état d’urgence sanitaire déclaré par l’article 4 de la loi n°&nbsp;2020-290&nbsp;du 23 mars 2020 d’urgence pour faire face à l’épidémie&nbsp;de covid-19. Elle est complétée par le <a href=\"https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=D1BAA5E6CCAC7D7B6E6864C32189E998.tplgfr34s_1?cidTexte=JORFTEXT000041865329&amp;dateTexte=&amp;oldAction=rechJO&amp;categorieLien=id&amp;idJO=JORFCONT000041865241\">décret n°&nbsp;2020-548</a>&nbsp;du même jour). Outre les mêmes articles, les recours parlementaires en contestaient la procédure d\'adoption et l\'article 9. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le lundi 11 mai, le Conseil constitutionnel a rendu son avis sur la loi votée par le Parlement samedi. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Comme bon nombre de journaux, Franceinfo passe outre les objections du Conseil et titre<a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\"> “Le Conseil constitutionnel valide la loi prorogeant l\'état d\'urgence, mais censure des éléments liés à l\'isolement et au \"traçage numérique”</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En réalité, la position du Conseil Constitutionnel est bien plus nuancée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Si le texte et la majorité des mesures sur le déconfinement sont validées, les mesures liées au traçage numérique des contacts sont fermement critiquées. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A- Les mesures votées portant sur :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>les conditions d\'engagement de la responsabilité pénale en cas de catastrophe sanitaire</li><li> le régime de l\'état d\'urgence sanitaire<br>﻿</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Le Conseil constate que le législateur  procéde à une conciliation équilibrée entre ces exigences constitutionnelles en adoptant les mesures autorisant le Premier ministre à réglementer ou interdire la circulation des personnes et des véhicules, en réglementant l\'accès aux moyens de transport et les conditions de leur usage ou en ordonnant la fermeture provisoire et réglementant l\'ouverture des établissements recevant du public ainsi que des lieux de réunion. S\'agissant de ces lieux, il a en particulier relevé qu\'ils ne s\'étendaient pas aux locaux à usage d\'habitation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour ce qui est des mesures du 7° du paragraphe I de l\'<a href=\"https://www.legifrance.gouv.fr/affichCodeArticle.do?idArticle=LEGIARTI000041747777&amp;cidTexte=LEGITEXT000006072665&amp;dateTexte=20200324\">article L. 3131-15 du code de la santé publique</a> de réquisitions de personnes, de biens et de services permises, le Conseil Constitutionnel a rappelé l’exigence de nécessité de la mesure à contrer ‘<em>la catastrophe sanitaire</em>’. Les réquisitions ouvriront droit à indemnisation, dans les conditions prévues par le code de la défense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deux censures partielles donc pour limiter le nombre de personnes pouvant accéder à ces données, et pour qu\'un juge des libertés puisse effectuer un \"<em>contrôle</em>\" si le malade ne peut pas sortir plus de 12 heures par jour de son lieu d\'isolement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>B- Les mesures portant sur la mise en quarantaine et le placement en isolement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cette mesure de quarantaine pouvant être prolongée à un mois est privative de liberté. Se fondant sur l\'<a href=\"https://www.legifrance.gouv.fr/affichTexteArticle.do?idArticle=LEGIARTI000006527558&amp;cidTexte=LEGITEXT000006071194&amp;dateTexte=19581005\">article 66 de la Constitution</a> et conformément à une jurisprudence constante, le Conseil constitutionnel a rappelé que “<em>la liberté individuelle, dont la protection est confiée à l\'autorité judiciaire, ne saurait être entravée par une rigueur non nécessaire. Les atteintes portées à l\'exercice de cette liberté doivent être adaptées, <strong>nécessaires et proportionnées aux objectifs poursuivis.</strong></em>” </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cette mesure parait alors conforme à l’objectif de valeur constitutionnelle de protection de la santé concernant l’entrée dans une zone de circulation de l’infraction, sous reserve d’une constatation par certificat médical, prolongée au-delà de 14 jours sur avis medical établissant la nécessité de cette prolongation afin d’en <strong>garantir la nécessité et la proportionnalité.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le <strong>juge des libertés et de la détention</strong> devra être préalablement saisi par le Préfet afin d’autoriser la prolongation de la mesure d’isolement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>C- Les mesures portant sur le système d\'information destiné à permettre le traitement de données destinées au « traçage » des personnes atteintes par le covid-19 et de celles ayant été en contact avec ces dernières</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>le Conseil constitutionnel a rappelé qu\'il résulte du droit constitutionnel au respect de la vie privée que la collecte, l\'enregistrement, la conservation, la consultation et la communication de données à caractère personnel doivent être justifiés par un <strong>motif d\'intérêt général</strong> et mis en œuvre de manière adéquate et <strong>proportionnée à cet objectif.</strong> Il a en outre jugé pour la première fois que, lorsque sont en cause des <strong>données à caractère personnel de nature médicale</strong>, une particulière vigilance doit être observée dans la conduite de ces opérations et la détermination de leurs modalités.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour le Conseil, les dispositions adoptées portent <strong>atteinte au droit au respect de la vie privée</strong>. Seules quatre finalités pourraient justifier une telle atteinte à la vie privée. La collecte devra être <strong>limitée</strong> “<em>aux seules données relatives au statut virologique ou sérologique des personnes à l\'égard de la maladie covid-19 ou aux éléments probants de diagnostic clinique et d\'imagerie médicale précisés par décret en Conseil d\'État pris après avis du Haut Conseil de la santé publique.</em>” Apportant une exigence supplémentaire au-delà d\'une simple pseudonymisation de <strong>supprimer les coordonnées téléphoniques et électroniques des intéressés</strong>.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Malgré la validation d’un champ relativement large des personnes susceptibles d’avoir accès à ces données personnelles, les p<strong>ersonnels d’accompagnement social </strong>ne relevant pas directement de la lutte contre l’épidémie devraient être <strong>exclus</strong> de la liste en l’absence de consentement des intéressés. Le consentement des intéressés est ici retenu comme critère de partage de l’information notamment avec les tiers avec qui ils seraient en contact. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les <strong>sous-traitants</strong> devront être soumis au secret professionnel et répondre aux critères habituels de garantie. [_<a href=\"https://awallon.com/d/s/546474490935162525/NFqrQeVzSR_CX79NNl06bvw5rqVhdEJh-prqAU9yslgc_\">RGPD28</a>_]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce dispositif ne pourra en aucune façon être prolongé au-delà du temps strictement nécessaire à la lutte contre la propagation de l’épidémie. Il devra être pris soin de <strong>supprimer les données trois mois après leur collecte.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On aurait aimé savoir que cet effacement, voir le déroulement même de ces mesures, seraient accompagnés et sous contrôle d\'un organisme tel la CNIL garante du respect de la réglementation sur la Protection des données.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'Le principe de proportionnalité doit être appliqué dans toutes ses dimensions et le noyau dur des libertés doit être sanctuarisé.... Il ne suffit pas d’invoquer la proportionnalité en des formules creuses et vite expédiées, comme aime à le faire le Conseil constitutionnel : il convient d’effectuer les vérifications qu’il implique en ses trois éléments d’adéquation, de proportionnalité&nbsp;<em>stricto sensu</em>&nbsp;et de nécessité, étant rappelé que la mesure critiquée doit subir avec succès l’examen sur ces trois aspects successivement.\' écrit <a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/les-libertes-et-les-mesures-prises-pour-lutter-contre-la-propagation-du-covid-19-sanctuariser-le-noyau-dur-des-libertes/\">Patrick Wachsmann, Professeur émérite à l’Université de Strasbourg, IRCM</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Par ailleurs, aucune <strong>analyse d’impact </strong>de l’Application STOPCOVID n’a encore été publiée. Voir Fiche CNIL <a href=\"https://www.cnil.fr/fr/quelles-formalites-pour-les-traitements-de-donnees-de-sante-caractere-personnel\"> Quelles formalités pour les traitements de données de santé à caractère personnel ? </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>le responsable de traitement doit être en mesure de démontrer, à tout moment, sa conformité aux exigences du RGPD en traçant toutes les démarches entreprises (principe d’accountability). Il faudra notamment :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>mettre en place un registre des traitements (outil recensant l’ensemble des traitements mis en œuvre dans votre structure). Pour vous aider, vous pouvez consulter le modèle de registre et la fiche pratique sur le registre des traitements ;</em></li><li><em>mener des analyses d’impact pour les traitements considérés comme présentant « un risque élevé » pour les personnes. Pour vous aider, vous pouvez consulter la rubrique « Analyses d’impact » (FAQ, logiciel d’aide à la réalisation d’une étude d’impact, guides) ;</em></li><li><em>veiller à encadrer l’information des personnes concernées (patients, fournisseurs, étudiants, usagers, etc.) et s’assurer de l’effectivité de leurs droits (droit d’accès, de rectification, d’opposition, etc.). Pour vous aider, vous pouvez consulter la fiche pratique Traitements de données de santé, comment informer les personnes concernées ? ».</em></li><li><em>formaliser les rôles et responsabilités du responsable de traitement. Pour vous aider, vous pouvez consulter le guide sous-traitant ;</em></li><li><em>lorsque cela est obligatoire, désigner un délégué à la protection des données (DPO). Sur ce point, vous pouvez consulter la fiche « Désigner un délégué à la protection des données » ;</em></li><li><em>renseigner les actions menées pour garantir la sécurité des données ;</em></li><li><em>Etc.</em><br>﻿</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On pourra s’étonner de ce que le Conseil Constitutionnel n’ait pas souhaité se référer dans son avis à l’organisme en charge de la protection des données personnelles, en l’occurence la <a href=\"https://www.cnil.fr/en/home\">CNIL</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lire aussi :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">STOP-COVID COMBATTRE LA PANDÉMIE SANS INFECTER LA DÉMOCRATIE</a></li><li><a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/les-libertes-et-les-mesures-prises-pour-lutter-contre-la-propagation-du-covid-19-une-accoutumance-aux-regimes-dexception/\">Les libertés et les mesures prises pour lutter contre la propagation du Covid-19 : une accoutumance aux régimes d’exception</a></li><li><a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/libertes-mesures-prises-pour-lutter-contre-propagation-covid-19-lindividualisme-subordonne-logique-sante/\">Les libertés et les mesures prises pour lutter contre la propagation du Covid-19 : l’individualisme subordonné à une logique de santé</a></li><li><a href=\"https://www.elysee.fr/emmanuel-macron/2020/05/11/communique-de-presse-du-president-de-la-republique-et-du-premier-ministre\">Communiqué commun du Président et du Premier Ministre au coeur de la nuit car la loi d’état d’urgence sanitaire n’a pu être promulguée à temps pour ce lundi,</a> le conseil constitutionnel n’ayant pas rendu son avis. Un vide juridique existait</li><li><a href=\"https://www.legalis.net/actualite/confinement-pas-didentification-des-personnes-par-les-drones/\">État d’urgence pour les données de santé (I) : l’application StopCovid</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','Les dispositions de prolongation de l\'etat d\'urgence soumises à l\'avis du Conseil Constitutionnel','Le lundi 11 mai, le Conseil constitutionnel a rendu son avis sur la loi votée par le Parlement samedi. ','inherit','closed','closed','','951-revision-v1','','','2020-05-14 00:06:32','2020-05-13 23:06:32','',951,'https://datarainbow.eu/2020/05/14/951-revision-v1/',0,'revision','',0),(957,5,'2020-05-14 00:13:47','2020-05-13 23:13:47','<!-- wp:paragraph -->\n<p><strong><a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\">Avis du Conseil Constitutionnel</a> sur la loi d’urgence</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Communiqué de presse Décision n°<a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\"> 2020-800 DC</a> du 11 mai 2020 - </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.assemblee-nationale.fr/dyn/15/textes/l15t0418_texte-adopte-seance\">Loi prorogeant l\'état d\'urgence sanitaire et complétant ses dispositions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://awallon.com/wordpress/wp-admin/post.php?post=726&amp;action=edit&amp;classic-editor__forget#\"> Non conformité partielle - réserve </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le Président de la République et le Président du Sénat ont demandé au Conseil constitutionnel (Cons. const., 11 mai 2020, <a href=\"https://www.conseil-constitutionnel.fr/decision/2020/2020800DC.htm\">n°&nbsp;2020-800&nbsp;DC</a>) de se prononcer sur la conformité à la Constitution de dispositions de l\'article 1er et des articles 3, 5 et 11 de cette <a href=\"https://www.vie-publique.fr/loi/274230-loi-du-11-mai-2020-prolongation-etat-durgence-sanitaire\">loi</a> (la <a href=\"https://www.legifrance.gouv.fr/eli/loi/2020/5/11/PRMX2010645L/jo/texte\">loi n°&nbsp;2020-546&nbsp;du 11 mai 2020</a>, publiée au Journal officiel du 12 mai, proroge jusqu’au 10 juillet 2020 l’état d’urgence sanitaire déclaré par l’article 4 de la loi n°&nbsp;2020-290&nbsp;du 23 mars 2020 d’urgence pour faire face à l’épidémie&nbsp;de covid-19. Elle est complétée par le <a href=\"https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=D1BAA5E6CCAC7D7B6E6864C32189E998.tplgfr34s_1?cidTexte=JORFTEXT000041865329&amp;dateTexte=&amp;oldAction=rechJO&amp;categorieLien=id&amp;idJO=JORFCONT000041865241\">décret n°&nbsp;2020-548</a>&nbsp;du même jour). Outre les mêmes articles, les recours parlementaires en contestaient la procédure d\'adoption et l\'article 9. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le lundi 11 mai, le Conseil constitutionnel a rendu son avis sur la loi votée par le Parlement samedi. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Comme bon nombre de journaux, Franceinfo passe outre les objections du Conseil et titre<a href=\"https://www.conseil-constitutionnel.fr/actualites/communique/decision-n-2020-800-dc-du-11-mai-2020-communique-de-presse\"> “Le Conseil Constitutionnel valide la loi prorogeant l\'état d\'urgence, mais censure des éléments liés à l\'isolement et au \"traçage numérique”</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En réalité, la position du Conseil Constitutionnel est bien plus nuancée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Si le texte et la majorité des mesures sur le déconfinement sont validés, les mesures liées au traçage numérique des contacts sont fermement critiquées. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A- Les mesures votées portant sur :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>les conditions d\'engagement de la responsabilité pénale en cas de catastrophe sanitaire</li><li> le régime de l\'état d\'urgence sanitaire<br>﻿</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Le Conseil constate que le législateur  procéde à une conciliation équilibrée entre ces exigences constitutionnelles en adoptant les mesures autorisant le Premier ministre à réglementer ou interdire la circulation des personnes et des véhicules, en réglementant l\'accès aux moyens de transport et les conditions de leur usage ou en ordonnant la fermeture provisoire et réglementant l\'ouverture des établissements recevant du public ainsi que des lieux de réunion. S\'agissant de ces lieux, il a en particulier relevé qu\'ils ne s\'étendaient pas aux locaux à usage d\'habitation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour ce qui est des mesures du 7° du paragraphe I de l\'<a href=\"https://www.legifrance.gouv.fr/affichCodeArticle.do?idArticle=LEGIARTI000041747777&amp;cidTexte=LEGITEXT000006072665&amp;dateTexte=20200324\">article L. 3131-15 du code de la santé publique</a> de réquisitions de personnes, de biens et de services permises, le Conseil Constitutionnel a rappelé l’exigence de <strong>nécessité</strong> de la mesure à contrer ‘<em>la catastrophe sanitaire</em>’. Les réquisitions ouvriront droit à indemnisation, dans les conditions prévues par le code de la défense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deux censures partielles donc pour limiter le nombre de personnes pouvant accéder à ces données, et pour qu\'un juge des libertés puisse effectuer un \"<em>contrôle</em>\" si le malade ne peut pas sortir plus de 12 heures par jour de son lieu d\'isolement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>B- Les mesures privative de liberté</strong> <strong>portant sur la mise en quarantaine et le placement en isolement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cette mesure de quarantaine pouvant être prolongée à un mois est privative de liberté. Se fondant sur l\'<a href=\"https://www.legifrance.gouv.fr/affichTexteArticle.do?idArticle=LEGIARTI000006527558&amp;cidTexte=LEGITEXT000006071194&amp;dateTexte=19581005\">article 66 de la Constitution</a> et conformément à une jurisprudence constante, le Conseil constitutionnel a rappelé que “<em>la liberté individuelle, dont la protection est confiée à l\'autorité judiciaire, ne saurait être entravée par une rigueur non nécessaire. Les atteintes portées à l\'exercice de cette liberté doivent être adaptées, <strong>nécessaires et proportionnées aux objectifs poursuivis.</strong></em>” </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cette mesure parait alors conforme à l’objectif de valeur constitutionnelle de protection de la santé concernant l’entrée dans une zone de circulation de l’infraction, sous reserve d’une constatation par certificat médical, prolongée au-delà de 14 jours sur avis medical établissant la nécessité de cette prolongation afin d’en <strong>garantir la nécessité et la proportionnalité.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le <strong>juge des libertés et de la détention</strong> devra être préalablement saisi par le Préfet afin d’autoriser la prolongation de la mesure d’isolement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>C- Les mesures portant sur le système d\'information destiné à permettre le traitement de données destinées au « traçage » des personnes atteintes par le covid-19 et de celles ayant été en contact avec ces dernières</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>le Conseil constitutionnel a rappelé qu\'il résulte du droit constitutionnel au respect de la vie privée que la collecte, l\'enregistrement, la conservation, la consultation et la communication de données à caractère personnel doivent être justifiés par un <strong>motif d\'intérêt général</strong> et mis en œuvre de manière adéquate et <strong>proportionnée à cet objectif.</strong> Il a en outre jugé pour la première fois que, lorsque sont en cause des <strong>données à caractère personnel de nature médicale</strong>, une particulière vigilance doit être observée dans la conduite de ces opérations et la détermination de leurs modalités.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour le Conseil, les dispositions adoptées portent <strong>atteinte au droit au respect de la vie privée</strong>. Seules quatre finalités pourraient justifier une telle atteinte à la vie privée. La collecte devra être <strong>limitée</strong> “<em>aux seules données relatives au statut virologique ou sérologique des personnes à l\'égard de la maladie covid-19 ou aux <strong>éléments probants de diagnostic</strong> clinique et d\'imagerie médicale précisés par décret en Conseil d\'État pris après avis du Haut Conseil de la santé publique.</em>” Apportant une exigence supplémentaire au-delà d\'une simple pseudonymisation de <strong>supprimer les coordonnées téléphoniques et électroniques des intéressés</strong>.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Malgré la validation d’un champ relativement large des personnes susceptibles d’avoir accès à ces données personnelles, les p<strong>ersonnels d’accompagnement social </strong>ne relevant pas directement de la lutte contre l’épidémie devraient être <strong>exclus</strong> de la liste en l’absence de consentement des intéressés. Le <strong>consentement</strong> des intéressés est ici retenu comme critère de partage de l’information notamment avec les tiers avec qui ils seraient en contact. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les <strong>sous-traitants</strong> devront être soumis au secret professionnel et répondre aux critères habituels de garantie. [_<a href=\"https://awallon.com/d/s/546474490935162525/NFqrQeVzSR_CX79NNl06bvw5rqVhdEJh-prqAU9yslgc_\">RGPD28</a>_]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce dispositif ne pourra en aucune façon être prolongé au-delà du temps strictement nécessaire à la lutte contre la propagation de l’épidémie. Il devra être pris soin de <strong>supprimer les données trois mois après leur collecte.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On aurait aimé savoir que cet effacement, voir le déroulement même de ces mesures, seraient accompagnés et mis sous contrôle d\'un organisme tel la CNIL garante du respect de la réglementation sur la Protection des données.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'Le principe de proportionnalité doit être appliqué dans toutes ses dimensions et le noyau dur des libertés doit être sanctuarisé.... Il ne suffit pas d’invoquer la proportionnalité en des formules creuses et vite expédiées, comme aime à le faire le Conseil constitutionnel : il convient d’effectuer les vérifications qu’il implique en ses trois éléments d’adéquation, de proportionnalité&nbsp;<em>stricto sensu</em>&nbsp;et de nécessité, étant rappelé que la mesure critiquée doit subir avec succès l’examen sur ces trois aspects successivement.\' écrit <a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/les-libertes-et-les-mesures-prises-pour-lutter-contre-la-propagation-du-covid-19-sanctuariser-le-noyau-dur-des-libertes/\">Patrick Wachsmann, Professeur émérite à l’Université de Strasbourg, IRCM</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Par ailleurs, aucune <strong>analyse d’impact </strong>de l’Application STOPCOVID n’a encore été publiée. Voir Fiche CNIL <a href=\"https://www.cnil.fr/fr/quelles-formalites-pour-les-traitements-de-donnees-de-sante-caractere-personnel\"> Quelles formalités pour les traitements de données de santé à caractère personnel ? </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>le responsable de traitement doit être en mesure de démontrer, à tout moment, sa conformité aux exigences du RGPD en traçant toutes les démarches entreprises (principe d’accountability). Il faudra notamment :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>mettre en place un registre des traitements (outil recensant l’ensemble des traitements mis en œuvre dans votre structure). Pour vous aider, vous pouvez consulter le modèle de registre et la fiche pratique sur le registre des traitements ;</em></li><li><em>mener des analyses d’impact pour les traitements considérés comme présentant « un risque élevé » pour les personnes. Pour vous aider, vous pouvez consulter la rubrique « Analyses d’impact » (FAQ, logiciel d’aide à la réalisation d’une étude d’impact, guides) ;</em></li><li><em>veiller à encadrer l’information des personnes concernées (patients, fournisseurs, étudiants, usagers, etc.) et s’assurer de l’effectivité de leurs droits (droit d’accès, de rectification, d’opposition, etc.). Pour vous aider, vous pouvez consulter la fiche pratique Traitements de données de santé, comment informer les personnes concernées ? ».</em></li><li><em>formaliser les rôles et responsabilités du responsable de traitement. Pour vous aider, vous pouvez consulter le guide sous-traitant ;</em></li><li><em>lorsque cela est obligatoire, désigner un délégué à la protection des données (DPO). Sur ce point, vous pouvez consulter la fiche « Désigner un délégué à la protection des données » ;</em></li><li><em>renseigner les actions menées pour garantir la sécurité des données ;</em></li><li><em>Etc.</em><br>﻿</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On pourra s’étonner de ce que le Conseil Constitutionnel n’ait pas souhaité se référer dans son avis à l’organisme en charge de la protection des données personnelles, en l’occurence la <a href=\"https://www.cnil.fr/en/home\">CNIL</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lire aussi :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">STOP-COVID COMBATTRE LA PANDÉMIE SANS INFECTER LA DÉMOCRATIE</a></li><li><a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/les-libertes-et-les-mesures-prises-pour-lutter-contre-la-propagation-du-covid-19-une-accoutumance-aux-regimes-dexception/\">Les libertés et les mesures prises pour lutter contre la propagation du Covid-19 : une accoutumance aux régimes d’exception</a></li><li><a href=\"https://www.leclubdesjuristes.com/blog-du-coronavirus/libres-propos/libertes-mesures-prises-pour-lutter-contre-propagation-covid-19-lindividualisme-subordonne-logique-sante/\">Les libertés et les mesures prises pour lutter contre la propagation du Covid-19 : l’individualisme subordonné à une logique de santé</a></li><li><a href=\"https://www.elysee.fr/emmanuel-macron/2020/05/11/communique-de-presse-du-president-de-la-republique-et-du-premier-ministre\">Communiqué commun du Président et du Premier Ministre au coeur de la nuit car la loi d’état d’urgence sanitaire n’a pu être promulguée à temps pour ce lundi,</a> le conseil constitutionnel n’ayant pas rendu son avis. Un vide juridique existait</li><li><a href=\"https://www.legalis.net/actualite/confinement-pas-didentification-des-personnes-par-les-drones/\">État d’urgence pour les données de santé (I) : l’application StopCovid</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','Les dispositions de prolongation de l\'etat d\'urgence soumises à l\'avis du Conseil Constitutionnel','Le lundi 11 mai, le Conseil constitutionnel a rendu son avis sur la loi votée par le Parlement samedi. ','inherit','closed','closed','','951-revision-v1','','','2020-05-14 00:13:47','2020-05-13 23:13:47','',951,'https://datarainbow.eu/2020/05/14/951-revision-v1/',0,'revision','',0),(960,5,'2020-05-16 13:57:42','2020-05-16 12:57:42','<!-- wp:paragraph -->\n<p>In UK, like in many countries, the contact tracing app is presented as the solution to get out of lockdown. Is technology really the right solution?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been written and the debate is still ongoing. We have published an article on <a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">the French government project of STOPCOVID. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK NHSX project is another centralised contact tracing App. A first tryout has started on the Isle of Wight since Tuesday May 2nd.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">I - </a>A<strong>nalysing the data protection compliance aspects of the project, from&nbsp;</strong><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\"><strong>Chris Pounder of Amber-walk has published his&nbsp;views</strong></a><strong> </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">COVID-19: how the GDPR applies to trace and track.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Emphasis is put in the voluntary adoption of the measure as requested by most EU Data Protection Authorties.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Chris Pounder develops, ‘<em>NHSX claim that every operation related to the APP is voluntary (e.g. to download, to communicate to a central database if need be). Users can choose to delete the APP at any time; this would also delete the data on the phone but not any data previously uploaded to NHSX’s central database.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data is pseudonymised more than anonymised as it can be re-identifiable, therefore it will be the GDPR and not the ePrivacy Directive that will apply</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a published DPIA, Chris reminds the government promise that ‘T<em>he APP does not use any identifier already on the phone (e.g. phone number, SIM card identifier) or location details.’ The APP generates a random ID number exchanged with other phones that have also downloaded the APP. This record will remain on both phones for 14 days. When someone is COVID+ this record will trace back the contacts with a warning message for the user</em> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- The APP should not keep any personal information and no location data. Only the first half of the postcode is collected from APP users to alert local hospitals.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, for <a href=\"https://tech.newstatesman.com/coronavirus/uncertainty-over-who-could-access-nhsx-contact-tracing-app-data-as-pilot-goes-live\">Laurie Clarke reporter</a>, remains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Uncertainty over who could access NHSX contact tracing app data as Isle of White pilot goes live’. ‘The NHSX coronavirus contact tracing app is being rolled out on the Isle of Wight this week, but major question marks still hang over the app. Matthew Gould, CEO of NHSX, told parliament today that the data collected by the app would be accessible to unspecified organisations as long as it was used for public health purposes. ‘</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>3- For Chris Pounder, ‘</strong><em><strong>there are three definitional issues:</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>(<em>a) is personal data processed? </em></li><li><em>b) if so, who is the controller processing personal data? and </em></li><li><em>(c) if there is a controller, does the voluntary nature of the APP equate to “data subject consent”?</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject is identifiable and the data related to medical health. He is therefore ‘<em>pretty sure the APP is processing personal data and special category of personal data</em>’, subject to the Article 6  lawful basis and a condition that overcomes the prohibition in Article 9(1) from processing health personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Controller, there would be joint controllers as he points to the NHSX website stating that “<em>NHS England and NHS Improvement and the Department of Health and Social Care are delivering NHSX together” This bring to the Article 26 that requires any processing of personal data “shall in a transparent manner determine their respective responsibilities</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the emphasis is on the voluntary adoption of the App, the next question  is on ”<em>data subject consent</em>”. Chris points out that <em>‘the NHS text on the website is very careful to avoid the use of the “C word” and it is easy to see why</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 states that with respect to consent: “<em>consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller</em>” This will be the case where the controller is a public authority or an employer. It will be unlikely for that consent to be considered as ‘<em>freely given</em>’. Therefore voluntary adoption does not refer the character of legitimate basis on consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The limit of the ‘<em>voluntary</em>’ adoption he sees is that it could lead to a denial of a service as previously for the ‘<em>ID Card holders refused to “volunteer” making it a requirement to interact with any public service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The first comment is that any interference by a public authority (NHSX) is unlikely to infringe Article 8(1) [_<a href=\"https://awallon.com:15001/oo/r/546619490369058645\">GDPR08</a>_]&nbsp;of the European Convention on Human Rights; This is because Article 8(2) permits legislation to be enacted by a Parliament process (e.g. in the Coronavirus 2 which sets aside the A.8(1) right in limited circumstances (e.g. any interference deemed&nbsp;<strong><em>necessary</em></strong>&nbsp; “<em>for the protection of health</em>”).&nbsp; It all hangs on the word “<em>necessary</em>”; it is either necessary or it isn’t. If there is reliance on data subject consent (which we think is unreliable), then there is also no A.8 breach (so long consent is properly formed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the GDPR/DPA2018,  <em>‘if the processing is “necessary” it will have Article 6 lawful basis (e.g. candidates are A.6(1)(c) or A.6(1)(e); A.6(1)(d) could be used in a case-by-case emergency). If there is need for an A.9 condition that lifts the prohibition on processing of health personal data the candidates are A.9(2)(c), A.9(2)(g), A.9(1)(i), Schedule 1, paragraphs2, 3 or 6 of the DPA2018</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>If there is reliance on consent or necessary or public task (or even necessary legitimate interests of controller/Third Party), the controller has to specify publicly (A.13; A.14) what happens to the personal data if there withdrawal of consent or exercise of the exercise of the right to object to the processing.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in he concludes ‘<em>the ICO should take up Article 8 ECHR cases on the grounds that necessary as used in the GDPR has the same meaning as in Article 8.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>II - The UK like France has opted for the centralised model </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The App is encountering technical issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.iacr.org/misc/statement-May2014.html\">UK ICO</a> like the <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">French CNIL</a> have expressed their preference for the decentralised model for a decentralised model. Chris Pounder sees further vulnerability of the centralised approach  with a ‘<em>future legislative mood of Government</em>’. He believes ‘<em>It could be tempting (e.g. to reduce the pressures on the public purse) for Government to enact legislation that makes certain processing of personal data compulsory. For instance, to prove entitlement to a COVID related benefit</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> <em>\'Considering to revert to a decentralised model to resolve their Bluetooth issues. ‘Covidsafe app is not working properly on iPhones, authorities admit’ ‘Australians running the Covidsafe contact tracing app on iPhones may not be recording all the data required if they don’t have the app running in the foreground or they are using an older model phone, the government has admitted.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://uk.reuters.com/article/us-health-coronavirus-france-tech/france-accuses-apple-of-refusing-help-with-stopcovid-app-idUKKBN22H0LX\">France is struggling to find an agreement with Apple and Google</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theguardian.com/world/2020/may/06/covidsafe-app-is-not-working-properly-on-iphones-authorities-admit\">Australia who has already deployed the App has been struggling technically </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/\">The Register</a> wrote: ‘<em>UK finds itself almost alone with centralized virus contact-tracing app that probably won\'t work well, asks for your location, may be illegal’. ‘On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in the Isle of Wight – will work, and why it is a better solution to the one by Apple and Google that other nations have decided to adopt. It has also released a more technical explanation</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Running the Bluetooth connection in the back has several inconvenience such as draining the battery and opening security vulnerabilities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, the Bluetooth distance measurement is unreliable <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">according to its own inventor</a>. Bluetooth signals can pierce obstacles the virus hopefully cannot such as a wall or vehicle bodies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The margin of error has caused a return to lock down in Singapore, one of the first nations after China to deploy TraceTogether App. Less than 20% of the population actually downloaded the App It is suspected that Bluetooth works through glass and even some walls and may even be triggered by reflection in windows in buildings. Jason Bay Senior Director (Government Digital Services) at the Government Technology Agency, Singapore&nbsp;<a href=\"https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98\">wrote</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain ? (throw whatever buzzword you want), not for the foreseeabl</em>e future.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The amount of <strong>false alerts</strong> will cause major distress and reduce trust on the App. When someone receives the warning SMS that they have been in contact with someone COVID+, that doesn\'t mean the NHS can test them immediately. They might be asked to self isolate themselves which is not always technically possibly. It has been suggested in France that they would be hotels dedicated to quarantine. That means 14 days of accommodation, food and entertainment. During which time the person and his family or network will be under distress, maybe unnecessarily isolated causing loss of revenues. Should the government be liable for all that ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- These Apps are source of security issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The well known and security expert Bruce Schneier has expressed his concerns about the issues of using Bluetooth Technology <a href=\"https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"My problem with contact tracing apps is that they have absolutely no value,\" Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet &amp; Society at Harvard University, told BuzzFeed News. \"I\'m not even talking about the privacy concerns, I mean the efficacy. Does anybody think this will do something useful? ... This is just something governments want to do for the hell of it. To me, it\'s just techies doing techie things because they don\'t know what else to do.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">SecurityWeek reporter Kevin Townsend wrote</a> ‘<em>These apps could easily become subject to a high number of false positives – and false positives always lead to a rejection by users. ‘ que faire du stresse, isolation et perte de revenus consécutives au faux positives alertes? Le BT transverse les murs et un automobiliste à proximité pourrait être décelé conne en ‘contact’</em> .  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">As contact tracing gains attention, a researcher pokes a hole in Bluetooth technology</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>If someone is reluctant to self quarantine, will they ignore the warning messages ?</li><li>The most at risk populations are the over 60x, will they be willing to download the app ?</li><li>What are going the security issues of opening the Bluetooth connection be?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Any data base creates security issues. New NHS contact-tracing app vulnerable to ‘<em>malicious false alerts</em>’, warn experts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Additionaly, ‘<em>The new NHS contact-tracing app could be used to send malicious alerts causing people to isolate unnecessarily, it has been warned.</em></p><p><em>The app, which is being trialled in the Isle of Wight, tells users if someone they have been in proximity with may be suffering from coronavirus, meaning they could be exposed.</em></p><p><em>But because users can set off the warnings themselves by reporting symptoms – rather than positive Covid-19 test results – it could be used to send out false alerts.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\'Dr Michael Veale, a lecturer in digital rights and regulation at University College London who this week gave evidence to MPs on the technology, told The Independent that Britain’s tracing app had nothing to stop individuals “maliciously triggering notifications” using its normal functionality.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“People can deliberately put others into quarantine or report large areas,” he said. “A child could try to get a day off school by reporting symptoms from a parent’s phone to trigger a quarantine.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Constant Bluetooth signals in the back will drain the phone battery eventually causing over heating. Will be see a new epidemic of ‘pockets in fire’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ICAR, the Association of  experts in Cryptologic research has issued a statement against mass surveillance <a href=\"https://www.iacr.org/misc/statement-May2014.html\">\'The Copenhagen Resolution\'</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards. Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> <a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">A technical deep-dive into the NHS COVID-19 contact tracing app</a> : Since \'<em>the contact tracing beta is now open source for both&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-iOS-BETA\" target=\"_blank\"><em>iOS</em></a><em>&nbsp;and&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Android-BETA\" target=\"_blank\"><em>Android</em></a><em>, along with some&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Documentation-BETA\" target=\"_blank\"><em>documentation</em></a><em>. As a follow-up to our “</em><a href=\"https://reincubate.com/blog/staying-alive-covid-19-background-tracing/\"><em>Staying alive</em></a><em>” post, we’ve taken a deep-dive into the source code. It’s pleasantly surprising to find it licensed under MIT, indicating an NHSX commitment to transparency and quality... There have been claims that the Android app accesses location data, as the prompt for Bluetooth API access on Android devices appears to ask for location permissions. However, we debunked this yesterday: this is a consequence of how Android&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://developer.android.com/guide/topics/connectivity/bluetooth#Permissions\" target=\"_blank\"><em>manages requests for Bluetooth permissions</em></a><em>.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Reincubate’s CEO, Aidan Fitzpatrick, says:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, it is the case that the coming Apple&nbsp;<code>ExposureNotification</code>&nbsp;framework in iOS 13.5 obviates the need for these keepalives. However, it’s worth noting that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>iOS 13.5 has not been released, and may not be for some weeks</li><li>Prior to yesterday, the last iOS 13.5 beta had a&nbsp;<a href=\"https://siguza.github.io/psychicpaper/\" rel=\"noreferrer noopener\" target=\"_blank\">major security flaw</a>, suggesting heavy lifting is going on in Apple’s engineering teams</li><li>Once it is released, it will&nbsp;<a href=\"https://venturebeat.com/2020/01/29/as-ios-and-ipados-13-near-80-adoption-is-the-race-with-android-over/\" rel=\"noreferrer noopener\" target=\"_blank\">likely take months</a>&nbsp;for a majority of iOS users to install it (unusually, the equivalent Android adoption may be&nbsp;<a href=\"https://www.theverge.com/2020/4/13/21220033/android-covid-19-tracking-updates-google-play-contact-tracing\" rel=\"noreferrer noopener\" target=\"_blank\">more rapid</a>)</li><li>Older iOS devices — such as the iPhone 6 — cannot run iOS 13, and will not be able to use the Apple technique</li><li><em>There’s no reason why the NHS COVID-19 app won’t be able to automatically transition in future to using Apple’s framework — or even dual-running both mechanisms</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The app will become increasingly effective as more people use it, and the benefit of mass adoption will create a flywheel effect in this sense. The Australian COVIDSafe app struggled as it didn’t support detecting backgrounded iOS devices from an Android device, and it didn’t have this clever iOS-to-iOS keepalive mechanism.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to reflect on which circumstances make use of technology like this appropriate. If contact tracing is successful in saving lives, which criteria should be assessed as to whether it’s applied for future diseases? Once the precedent is set, is there an argument that this technology might be used to combat&nbsp;<em>pre-existing</em>&nbsp;infectious diseases? It’s foreseeable that different societies will evaluate the trade-offs differently.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III - The balance of Proportionality requires a three party test :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Fundamental rights, enshrined in the Charter of Fundamental Rights of the European Union constitute the core values of the European Union . These rights must be respected whenever the EU institutions and bodies design and implement new policies or adopt any new legislative measure and in the ECHR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU law which requires that \"<em>the content and form of Union action shall not exceed what is necessary to achieve the objectives of the treaties\"</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives\" . It therefore \"restricts the authorities in the exercise of their powers by requiring a balance to be struck between the means used and the intended aim (or Under Article 52(1) of the Charter, \"subject to the principle of proportionality, limitations </em><a href=\"#\"><em>onresult reached)\" the exercise of fundamental rights</em></a><em> may be made only if they are necessary (...</em>)\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The necessity</strong>, Something needs to be done to end this national confinement killing the country’s economy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the Data Protection Impact Assessment published by <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e. V. .</a> They recommend that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> An appropriate legal basis must be established and in this respect responsibilities have to be defined. </li><li>Reinforcing the measures of pseudonymisation \'when creating the TempIDs in the app, it must be ensured that there is no connection between TempIDs and it must never be possible to make one. ...The server(s)’ operator must employ an effective separation method...\'</li><li>Accompanying the publication of the app it must be ensured in law and in fact that users have to disclose neither the status of the app nor the mere existence on a device to third parties. </li><li>Before the app gets published, a comprehensive investigation of the software and the overall system must be conducted and published by an independent body. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2- Could the same result be achieved in a less intrusive way?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I would argue providing tests,, masks, ventilators and resources to over loaded NHS staff will bring a serious improvement with any inconvenient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The cost of the deployment of the NHSX App is unknown. The Australian Government would have allegedly spend 700.000 AUD just to host the data in Amazon AWS clouds. This is how much less resource the NHS will receive.<a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">h</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://martinralbrecht.wordpress.com/2020/05/03/open-letters-v-surveillance/﻿\">A letter, signed by 177 scientists and researchers working in the UK in the fields of information security and privacy, reads: </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<em>Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified.1 Such invasive information can include the ‘social graph’ of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens’ real-world activities.</em>”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Actually, early testing can give far better results as epidemiologists are saying it is during the first 24 hours that the COVID+ are most contagious. <em><a href=\"https://news.sky.com/story/coronavirus-send-virus-alerts-within-24-hours-or-risk-second-wave-scientist-warns-11984908\">\'Coronavirus: Send virus alerts within 24 hours or risk second wave, scientist warns</a></em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.wired.co.uk/article/contact-tracing-apps-coronavirus\"><strong>IV - Coronavirus contact tracing apps were meant to save us</strong></a><strong>. They won’t. ‘With little evidence to show how effective such apps are and growing privacy concerns, there’s a risk they could do more harm than good‘ </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>From Iceland to Israel,&nbsp;</em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\"><em>more than 30 systems</em></a><em>&nbsp;are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>False alerts might loose users trust. An Oxford research said that the probability of seeing any result from the tracing Apps requires that at least 60% of the population use the App. Will the most vulnerable population of over 60% be willing to download and use it ? Will the government be liable for the false alters causing distress, unnecessary isolation and loss of revenues? France is talking of self isolating in hotels, where and how feed and entertain these people? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Elsewhere projects using personal data to combat SARS-CoV-2 </a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://tracetogether.zendesk.com/hc/en-sg/articles/360046475654-20-April-2020-One-Month-On\"><em>Singapour’s TraceTogether App</em></a><em> moved to the The Apple and Google collaboration on digital contact tracing solutions, is a game-changer, as we said previously. It will significantly improve the contact tracing capability available to governments and public health authorities over what is available through public APIs on either Android or iOS platforms. We are glad that Apple and Google are engaging governments and public health authorities around the world, including us, to incorporate feedback as the specifications for their contract tracing protocol and private APIs.  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=e6e61ca3-45ae-49a0-b6f1-5fd4adf11291\">In Poland</a>, Although initially voluntary in nature, it has become mandatory for all those under obligatory quarantine or epidemiological surveillance, as a tool to confirm compliance with quarantine obligations (e.g. whether the ban on leaving the quarantine location is observed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Contact tracing apps in Austria: a Red Cross initiative |Has been launched In March 2020 in co-operation with Accenture. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The first published version of the Stopp Corona app required users to log their contacts via a \'manual\' handshake. In the current version, however, the app already allows contacts to be traced automatically, depending on the device and its configuration.&nbsp;</em></p><p><em>The automatic handshake functionality is based on the discovery and messaging functionality of the p2pkit developed by the Swiss company Uepaa, which uses Bluetooth and Wifi-direct techniques to determine the distance between the users.&nbsp;</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Switzerland: \"WeTrace\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>This project is ready to be deployed. It is open source. All data remains locally on the devices. Packaged information encrypted asymmetrically. The sole information a potential malfeasor on the central server would see is the fact _that_ an infected person has actually pushed a status update, but on the core server it is not visible \"what\" the person has broadcasted. The broadcasting user can determine the details of what should be broadcasted aside from status (location of contact, time of contact, etc.). Packages will be sent not to everyone but only to those that need to know.</em></p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Spain: \"Open Coronavirus\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The Spanish medical investigator Aurelia Bustos has released Open Coronavirus, an open-source app with the aim to copy the advantages of the South-Korean app: in the end, serving as an individual-validation-method in order to allow free movement of the citizens. This tool can be used by any public institution as a basis for its own apps on tracking citizens due to the coronavirus emergency, and it offers a modular design: three levels of management (mobile phone, central management of data by the competent authority and checking of the control points by the competent authority too) with different options of geolocation (GPS, bluetooth, positioning by mobile operators cells) that could be implemented or not by the corresponding institution. Its use would be voluntary for the citizen (although, in words of the medical investigator, \"it would be probably very advantageous for the user, as it would allow him/her to have the possibility to finish an eventually longer quarantine\"), and it would necessarily depend on the realization of any kind of coronavirus detection tests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>As this is an open-source app, that it will not be officially published in its current status, and any use of the same by any institutons must be always in line with GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, it can be said of the NHSX Tracing App, similar to the French STOPCOVID, that <a href=\"https://www.lemonde.fr/idees/article/2020/04/25/stopcovid-est-un-projet-desastreux-pilote-par-des-apprentis-sorciers_6037721_3232.html\">«&nbsp;StopCovid est un projet désastreux piloté par des apprentis sorciers&nbsp;»</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE 8th May</strong>, The Financial Times reveals \'<a href=\"https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b\">UK starts to build second contact tracing app</a>\' going for a decentralised model in collaboration with Apple and Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The different existing systems&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">The Chinese System based on geolocation</a></li><li><a href=\"https://github.com/DP-3T/documents\">The DP3T</a> Protocol&nbsp;(sous diverses variantes), sa déclinaison par l’alliance&nbsp;</li><li><a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a>&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\"> PACT- Est</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://pact.mit.edu/\">PACT-Ouest</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://github.com/TCNCoalition/TCN\">TCN</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">ROBERT</a> Protocol&nbsp;.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Liste of <a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Projects using personal data to combat SARS-CoV-2</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.technologyreview.com/2020/05/07/1000961/launching-mittr-covid-tracing-tracker/﻿\">MIT - A flood of coronavirus apps are tracking us. Now it’s time to keep track of them.</a> MIT have documented 25 individual, significant automated contact tracing efforts globally, including details on what they are, how they work, and what policies and processes have been put in place around them.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDRI <a href=\"https://edri.org/covid-19-digital-rights-document-pool/\">COVID-19 &amp; Digital Rights: Document Pool</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/sites/edp/files/publication/20-05-08_techdispatch-tracing_en.pdf\">Techdispatch&nbsp;\'</a>Contact Tracing with Mobile Applications\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:gallery {\"ids\":[930,931,932]} -->\n<ul class=\"wp-block-gallery columns-3 is-cropped\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQe2X0AE1.png\" alt=\"\" data-id=\"930\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqe2x0ae1/\" class=\"wp-image-930\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQexXQAYJ2.png\" alt=\"\" data-id=\"931\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqexxqayj2/\" class=\"wp-image-931\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQfQX0AEk3.png\" alt=\"\" data-id=\"932\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqfqx0aek3/\" class=\"wp-image-932\" /></figure></li></ul>\n<!-- /wp:gallery -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">Privacy International : A technical deep-dive into the NHS COVID-19 contact tracing app</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":933} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/EXethgcXgAAF4.jpeg\" alt=\"\" class=\"wp-image-933\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.privacyinternational.org/long-read/3752/coronavirus-tracking-uk-what-we-know-so-far\">UK government Covid tracking app: what you need to know!</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://insights.doughtystreet.co.uk/post/102g6tz/guide-to-coronavirus-offences-help-for-the-public-police-and-lawyers\">Guide to Coronavirus Offences. Help for the public, police and lawyers</a></em>&nbsp;by&nbsp;the&nbsp;Doughty&nbsp;Street&nbsp;Chambers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://axisofeasy.com/aoe/computer-model-that-locked-down-the-world-turns-out-to-be-shtcode/\">Computer model that locked down the world turns out to be sh*tcode.</a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A SPECIAL THANK YOU TO GRAEME McGOWAN for allowing me to use his beautiful photography.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','NHSX Contacts Tracing App','Is NHSX UK centralised Tracing APP capable of best combat the COVID19 propagation? the Balance of proportionality looks rather weak. ','inherit','closed','closed','','898-revision-v1','','','2020-05-16 13:57:42','2020-05-16 12:57:42','',898,'https://datarainbow.eu/2020/05/16/898-revision-v1/',0,'revision','',0),(963,5,'2020-05-20 16:08:19','0000-00-00 00:00:00','<!-- wp:paragraph -->\n<p>What do we mean by cookies? Wikipedia has a page on <a href=\"https://en.wikipedia.org/wiki/Cookie\">cookies</a>. What we are interested on are not yummy cookies, but <a href=\"https://en.wikipedia.org/wiki/HTTP_cookie\">HTTP Cookies</a> and all other kind of more pernicious data collection from web surfing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:file {\"id\":965,\"href\":\"\\/wp-content\\/uploads\\/sites\\/3\\/2020\\/05\\/Cookies_mindmapTara2.png\"} -->\n<div class=\"wp-block-file\"><a href=\"/wp-content/uploads/sites/3/2020/05/Cookies_mindmapTara2.png\">Cookies_mindmapTara2</a><a href=\"/wp-content/uploads/sites/3/2020/05/Cookies_mindmapTara2.png\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Cookies are really not sweeties','','draft','closed','closed','','','','','2020-05-20 16:08:19','2020-05-20 15:08:19','',0,'http://datarainbow.eu/?p=963',0,'post','',0),(964,5,'2020-05-20 16:07:17','2020-05-20 15:07:17','<!-- wp:paragraph -->\n<p>What do we mean by cookies? Wikipedia has a page on <a href=\"https://en.wikipedia.org/wiki/Cookie\">cookies</a>. What we are interested on are not yummy cookies, but <a href=\"https://en.wikipedia.org/wiki/HTTP_cookie\">HTTP Cookies</a> and all other kind of more pernicious data collection from web surfing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:file {\"href\":\"blob:https:\\/\\/datarainbow.eu\\/f30a6735-21f6-430d-9545-214683270643\"} -->\n<div class=\"wp-block-file\"><a href=\"https://datarainbow.eu/f30a6735-21f6-430d-9545-214683270643\">Cookie MindMap</a><a href=\"https://datarainbow.eu/f30a6735-21f6-430d-9545-214683270643\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Cookies are really not sweeties','','inherit','closed','closed','','963-revision-v1','','','2020-05-20 16:07:17','2020-05-20 15:07:17','',963,'https://datarainbow.eu/2020/05/20/963-revision-v1/',0,'revision','',0),(965,5,'2020-05-20 16:07:46','2020-05-20 15:07:46','','Cookies_mindmapTara2','','inherit','closed','closed','','cookies_mindmaptara2','','','2020-05-20 16:07:46','2020-05-20 15:07:46','',963,'/wp-content/uploads/sites/3/2020/05/Cookies_mindmapTara2.png',0,'attachment','image/png',0),(966,5,'2020-05-20 16:18:57','2020-05-20 15:18:57','<!-- wp:paragraph -->\n<p>As a privacy and data protection advocate, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent request where applicable. The French Data Protection Authority, CNIL, has played a lead role in <a href=\"https://datarainbow.eu/2019/01/27/french-cnils-six-first-month-of-gdpr/\">clarifying the regulation</a>. The expectation would be that French websites would have benefited from the guidances produced, using the two years of preparation and the first year of GDPR application to comply. Sadly, this has not always been the case. Even pointing the issues to some web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular recognised expert, Allen Woods, retired today, kindly accepted to have a look to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting, data sharing with third parties not only via cookies but Java Script codes used by the web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers advising Data Protection compliance, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen the hidden JavaScript codes on the website \'represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered.\' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Gutenberg\'s font but no analytics, we are looking to change this.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing how much users\' behaviour is tracked gives a tough burden and liability to website owners as data controller unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that comes out of users control tracking behaviour and location. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page. The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. A detailed picture of users is build to target advertising to users. ECJ in the&nbsp;Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many web owners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’ has become an anti-trust issue of over grown corporations. GAFAM\'s seems to have become too big to any regulator to combat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing on all kind of websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, in <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can imagine the gathering of information on each individual internet user to profile their personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wish</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t anymore need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, not that long ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://policyreview.info/articles/news/data-subjects-data-controllers-fashionable-concept/1400\">On the expanding notion of data controller </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-revision-v1','','','2020-05-20 16:18:57','2020-05-20 15:18:57','',428,'https://datarainbow.eu/2020/05/20/428-revision-v1/',0,'revision','',0),(967,5,'2020-05-22 09:24:15','2020-05-22 08:24:15','<!-- wp:paragraph -->\n<p>Dont Shoot The GDPR for the Grandma’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For years, online security and privacy advocates have claimed a simple basic netiquette : ASK BEFORE YOU POST. It’s a fundamental right to wish to protect one’s image in the context of the internet where every scale is exacerbated : the speed, the reach and the lack of oblivion. We have previously wrote on <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Why Privacy Matters</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There can be various reasons why someone would want to protect its photos from falling into the arms of Facebook or other internet service provider. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The context of a family conflict and a divorce is what has motivated a <a href=\"https://gdprhub.eu/index.php?title=Rb._Gelderland_-_C/05/368427\">preliminary proceeding by the Dutch court of 1st instance</a> to order the take down of a photo posted on Facebook by the grandma.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contrary to the general outcry, this is not a GDPR immixtion into the grandparents freedom of cherishing their grand child. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although the GDPR has created a most ambitious regulation harmonising 28 EU member states data protection laws, it allows or requires Member States to implement specifications or restrictions on certain rules set out in the GDPR. Sometimes based on issues falling outside the EU’s legislative competence (national security, regulation of the press, the administration of justice,…)or for providing a margin of manoeuvre for Member States to specify their own rules for reasons of coherence.  Between these national specificities we can find Various age and conditions of consent or the applicability of the GDPR to deceased. This is an opportunity to allow more flexibility and adaptability to national legal systems and cultures. Harmonisation is not uniformisation. National sovereignties are respected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The court ruling here is based on a Dutch national legislation inserted into Article 5 of the GDPR, a national exception requiring that in the case of minors, their legal guardian must consent to the data processing. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To understand the judge’s ruling, the context of the dispute is essential. This is a daughter, in accordance with her ex-partner, fighting against her own parents to ask them to take down a photo of a minor child from Facebook. The grandparents had child’s custody for several years before he went living with his father. We have no information on why and how that happened. We have no information on the particular situation of the mother. Could she be a celebrity - the ruling is anonymised - Could she be a protected witness, a whistleblower …. What is the sensitivity of the picture? All we know is that she had obtained from the police an injunction against the grand parents to take down the pictures. they complied with several but left one. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is an interesting consideration of what is ‘personal and household’ GDPR exemption. Having lost custody, could it be  considered that the grand parents did not longer belong to the circle of ‘household’ and the publication on a Facebook page was considered outside the private circle? The judge does mention it was  unsure if the Facebook page was private or publicly accessible or the photo searchable by Google. Would the outcome be different if the page was private?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Léon Dijkman has published an excellent analysis of the case on the legal blawg the IPKat.  <a href=\"http://www.ipkat.com/?fbclid=IwAR3enrJLzk8mH6r7cVjp-EIWnRBRZaKXAqqkmgBBTnEgqwk1sthxA6IFpUQ\">Privacy rights and social media: can a person be prohibited from sharing online a picture of her grandson?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He describes the various conflicting rights. Claiming that ‘social media expressions may be protectable not just by Article 10 ECHR, but also Article 8: the right to family life (see also Article 7 Charter) referring to a 2017 book chapter by Professor Lorna Woods. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECtHR has recognised the right to maintain a relationship between a grandparent and a grandchild in <a href=\"#\">63190/16 Beccarini and Ridolfi v. Italy, at 50</a>. Is this relationship necessary broken by forbidding posting pictures on Facebook?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A balance of rights to strike between the various fundamental but not absolute conflicting rights : the fundamental right to privacy, as protected by Article 8 European Convention of Human Rights (ECHR) and Article 8 of the EU\'s Charter of Fundamental Rights and the right to family life in Article 7 of the Charter and the Article 10 on freedom of expression.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a  <a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photography by Geoff Lowe published with the authorisation of the Guardian Tara Taubman Bassirian. </p>\n<!-- /wp:paragraph -->','Don\'t Shoot the GDPR with the Grandma','A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!','publish','closed','closed','','dont-shoot-the-gdpr-with-the-grandma','','\nhttps://datarainbow.eu/2019/01/22/why-privacy-matters/','2020-05-22 10:49:09','2020-05-22 09:49:09','',0,'https://datarainbow.eu/?p=967',0,'post','',0),(968,5,'2020-05-22 09:15:51','2020-05-22 08:15:51','<!-- wp:paragraph -->\n<p>Dont Shoot The GDPR for the Grandma’</p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!</p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>For years, online security and privacy advocates have claimed a simple basic netiquette : ASK BEFORE YOU POST. It’s a fundamental right to wish to protect one’s image in the context of the internet where every scale is exacerbated : the speed, the reach and the lack of oblivion. We have previously wrote on <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Why Privacy Matters</a>.</p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>There can be various reasons why someone would want to protect its photos from falling into the arms of Facebook or other internet service provider. </p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>The context of a family conflict and a divorce is what has motivated a <a href=\"https://gdprhub.eu/index.php?title=Rb._Gelderland_-_C/05/368427\">preliminary proceeding by the Dutch court of 1st instance</a> to order the take down of a photo posted on Facebook by the grandma.</p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>Contrary to the general outcry, this is not a GDPR immixtion into the grandparents freedom. </p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>Although the GDPR has created a most ambitious regulation harmonising 28 EU member states data protection laws, it allows or requires Member States to implement specifications or restrictions on certain rules set out in the GDPR. Sometimes based on issues falling outside the EU’s legislative competence (national security, regulation of the press, the administration of justice,…)or for providing a margin of manoeuvre for Member States to specify their own rules for reasons of coherence.  Between these national specificities we can find Various age and conditions of consent or the applicability of the GDPR to deceased. This is an opportunity to allow more flexibility and adaptability to national legal systems and cultures. Harmonisation is not uniformisation. National sovereignties are respected.</p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>The court ruling here is based on a Dutch national legislation inserted into Article 5 of the GDPR, a national exception requiring that in the case of minors, their legal guardian must consent to the data processing. </p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>To understand the judge’s ruling, the context of the dispute is essential. This is a daughter, in accordance with her ex-partner, fighting against her own parents to ask them to take down a photo of a minor child from Facebook. The grandparents had child’s custody for several years before he went living with his father. We have no information on why and how that happened. We have no information on the particular situation of the mother. Could she be a celebrity - the ruling is anonymised - Could she be a protected witness, a whistleblower …. What is the sensitivity of the picture? All we know is that she had obtained from the police an injunction against the grand parents to take down the pictures. they complied with several but left one. </p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>There is an interesting consideration of what is ‘personal and household’ GDPR exemption. Having lost custody, could it be  considered that the grand parents did not longer belong to the circle of ‘household’ and the publication on a Facebook page was considered outside the private circle? The judge does mention it was  unsure if the Facebook page was private or publicly accessible or the photo searchable by Google. Would the outcome be different if the page was private?</p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>Léon Dijkman has published an excellent analysis of the case on the legal blawg the IPKat.  <a href=\"http://www.ipkat.com/?fbclid=IwAR3enrJLzk8mH6r7cVjp-EIWnRBRZaKXAqqkmgBBTnEgqwk1sthxA6IFpUQ\">Privacy rights and social media: can a person be prohibited from sharing online a picture of her grandson?</a></p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>He describes the various conflicting rights. Claiming that ‘social media expressions may be protectable not just by Article 10 ECHR, but also Article 8: the right to family life (see also Article 7 Charter) referring to a 2017 book chapter by Professor Lorna Woods. </p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>The ECtHR has recognised the right to maintain a relationship between a grandparent and a grandchild in <a href=\"#\">63190/16 Beccarini and Ridolfi v. Italy, at 50</a>. Is this relationship necessary broken by forbidding posting pictures on Facebook?</p>\n<!-- /wp:paragraph -->\n\n\n<!-- wp:paragraph -->\n<p>A balance of rights to strike between the various fundamental but not absolute conflicting rights : the fundamental right to privacy, as protected by Article 8 European Convention of Human Rights (ECHR) and Article 8 of the EU\'s Charter of Fundamental Rights and the right to family life in Article 7 of the Charter and the Article 10 on freedom of expression.</p>\n<!-- /wp:paragraph -->','Don\'t Shoot the GDPR with the Grandma','','inherit','closed','closed','','967-revision-v1','','','2020-05-22 09:15:51','2020-05-22 08:15:51','',967,'https://datarainbow.eu/2020/05/22/967-revision-v1/',0,'revision','',0),(969,5,'2020-05-22 09:23:59','2020-05-22 08:23:59','','Screenshot 2020-05-22 at 09.23.28','','inherit','closed','closed','','screenshot-2020-05-22-at-09-23-28','','','2020-05-22 09:23:59','2020-05-22 08:23:59','',967,'/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-22-at-09.23.28.png',0,'attachment','image/png',0),(970,5,'2020-05-22 09:24:15','2020-05-22 08:24:15','<!-- wp:paragraph -->\n<p>Dont Shoot The GDPR for the Grandma’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For years, online security and privacy advocates have claimed a simple basic netiquette : ASK BEFORE YOU POST. It’s a fundamental right to wish to protect one’s image in the context of the internet where every scale is exacerbated : the speed, the reach and the lack of oblivion. We have previously wrote on <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Why Privacy Matters</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There can be various reasons why someone would want to protect its photos from falling into the arms of Facebook or other internet service provider. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The context of a family conflict and a divorce is what has motivated a <a href=\"https://gdprhub.eu/index.php?title=Rb._Gelderland_-_C/05/368427\">preliminary proceeding by the Dutch court of 1st instance</a> to order the take down of a photo posted on Facebook by the grandma.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contrary to the general outcry, this is not a GDPR immixtion into the grandparents freedom. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although the GDPR has created a most ambitious regulation harmonising 28 EU member states data protection laws, it allows or requires Member States to implement specifications or restrictions on certain rules set out in the GDPR. Sometimes based on issues falling outside the EU’s legislative competence (national security, regulation of the press, the administration of justice,…)or for providing a margin of manoeuvre for Member States to specify their own rules for reasons of coherence.  Between these national specificities we can find Various age and conditions of consent or the applicability of the GDPR to deceased. This is an opportunity to allow more flexibility and adaptability to national legal systems and cultures. Harmonisation is not uniformisation. National sovereignties are respected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The court ruling here is based on a Dutch national legislation inserted into Article 5 of the GDPR, a national exception requiring that in the case of minors, their legal guardian must consent to the data processing. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To understand the judge’s ruling, the context of the dispute is essential. This is a daughter, in accordance with her ex-partner, fighting against her own parents to ask them to take down a photo of a minor child from Facebook. The grandparents had child’s custody for several years before he went living with his father. We have no information on why and how that happened. We have no information on the particular situation of the mother. Could she be a celebrity - the ruling is anonymised - Could she be a protected witness, a whistleblower …. What is the sensitivity of the picture? All we know is that she had obtained from the police an injunction against the grand parents to take down the pictures. they complied with several but left one. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is an interesting consideration of what is ‘personal and household’ GDPR exemption. Having lost custody, could it be  considered that the grand parents did not longer belong to the circle of ‘household’ and the publication on a Facebook page was considered outside the private circle? The judge does mention it was  unsure if the Facebook page was private or publicly accessible or the photo searchable by Google. Would the outcome be different if the page was private?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Léon Dijkman has published an excellent analysis of the case on the legal blawg the IPKat.  <a href=\"http://www.ipkat.com/?fbclid=IwAR3enrJLzk8mH6r7cVjp-EIWnRBRZaKXAqqkmgBBTnEgqwk1sthxA6IFpUQ\">Privacy rights and social media: can a person be prohibited from sharing online a picture of her grandson?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He describes the various conflicting rights. Claiming that ‘social media expressions may be protectable not just by Article 10 ECHR, but also Article 8: the right to family life (see also Article 7 Charter) referring to a 2017 book chapter by Professor Lorna Woods. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECtHR has recognised the right to maintain a relationship between a grandparent and a grandchild in <a href=\"#\">63190/16 Beccarini and Ridolfi v. Italy, at 50</a>. Is this relationship necessary broken by forbidding posting pictures on Facebook?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A balance of rights to strike between the various fundamental but not absolute conflicting rights : the fundamental right to privacy, as protected by Article 8 European Convention of Human Rights (ECHR) and Article 8 of the EU\'s Charter of Fundamental Rights and the right to family life in Article 7 of the Charter and the Article 10 on freedom of expression.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','Don\'t Shoot the GDPR with the Grandma','A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!','inherit','closed','closed','','967-revision-v1','','','2020-05-22 09:24:15','2020-05-22 08:24:15','',967,'https://datarainbow.eu/2020/05/22/967-revision-v1/',0,'revision','',0),(971,5,'2020-05-22 09:42:45','2020-05-22 08:42:45','<!-- wp:paragraph -->\n<p>Dont Shoot The GDPR for the Grandma’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For years, online security and privacy advocates have claimed a simple basic netiquette : ASK BEFORE YOU POST. It’s a fundamental right to wish to protect one’s image in the context of the internet where every scale is exacerbated : the speed, the reach and the lack of oblivion. We have previously wrote on <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Why Privacy Matters</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There can be various reasons why someone would want to protect its photos from falling into the arms of Facebook or other internet service provider. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The context of a family conflict and a divorce is what has motivated a <a href=\"https://gdprhub.eu/index.php?title=Rb._Gelderland_-_C/05/368427\">preliminary proceeding by the Dutch court of 1st instance</a> to order the take down of a photo posted on Facebook by the grandma.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contrary to the general outcry, this is not a GDPR immixtion into the grandparents freedom of cherishing their grand child. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although the GDPR has created a most ambitious regulation harmonising 28 EU member states data protection laws, it allows or requires Member States to implement specifications or restrictions on certain rules set out in the GDPR. Sometimes based on issues falling outside the EU’s legislative competence (national security, regulation of the press, the administration of justice,…)or for providing a margin of manoeuvre for Member States to specify their own rules for reasons of coherence.  Between these national specificities we can find Various age and conditions of consent or the applicability of the GDPR to deceased. This is an opportunity to allow more flexibility and adaptability to national legal systems and cultures. Harmonisation is not uniformisation. National sovereignties are respected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The court ruling here is based on a Dutch national legislation inserted into Article 5 of the GDPR, a national exception requiring that in the case of minors, their legal guardian must consent to the data processing. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To understand the judge’s ruling, the context of the dispute is essential. This is a daughter, in accordance with her ex-partner, fighting against her own parents to ask them to take down a photo of a minor child from Facebook. The grandparents had child’s custody for several years before he went living with his father. We have no information on why and how that happened. We have no information on the particular situation of the mother. Could she be a celebrity - the ruling is anonymised - Could she be a protected witness, a whistleblower …. What is the sensitivity of the picture? All we know is that she had obtained from the police an injunction against the grand parents to take down the pictures. they complied with several but left one. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is an interesting consideration of what is ‘personal and household’ GDPR exemption. Having lost custody, could it be  considered that the grand parents did not longer belong to the circle of ‘household’ and the publication on a Facebook page was considered outside the private circle? The judge does mention it was  unsure if the Facebook page was private or publicly accessible or the photo searchable by Google. Would the outcome be different if the page was private?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Léon Dijkman has published an excellent analysis of the case on the legal blawg the IPKat.  <a href=\"http://www.ipkat.com/?fbclid=IwAR3enrJLzk8mH6r7cVjp-EIWnRBRZaKXAqqkmgBBTnEgqwk1sthxA6IFpUQ\">Privacy rights and social media: can a person be prohibited from sharing online a picture of her grandson?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He describes the various conflicting rights. Claiming that ‘social media expressions may be protectable not just by Article 10 ECHR, but also Article 8: the right to family life (see also Article 7 Charter) referring to a 2017 book chapter by Professor Lorna Woods. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECtHR has recognised the right to maintain a relationship between a grandparent and a grandchild in <a href=\"#\">63190/16 Beccarini and Ridolfi v. Italy, at 50</a>. Is this relationship necessary broken by forbidding posting pictures on Facebook?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A balance of rights to strike between the various fundamental but not absolute conflicting rights : the fundamental right to privacy, as protected by Article 8 European Convention of Human Rights (ECHR) and Article 8 of the EU\'s Charter of Fundamental Rights and the right to family life in Article 7 of the Charter and the Article 10 on freedom of expression.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','Don\'t Shoot the GDPR with the Grandma','A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!','inherit','closed','closed','','967-revision-v1','','','2020-05-22 09:42:45','2020-05-22 08:42:45','',967,'https://datarainbow.eu/2020/05/22/967-revision-v1/',0,'revision','',0),(972,5,'2020-05-22 09:43:35','2020-05-22 08:43:35','<!-- wp:paragraph -->\n<p>Dont Shoot The GDPR for the Grandma’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For years, online security and privacy advocates have claimed a simple basic netiquette : ASK BEFORE YOU POST. It’s a fundamental right to wish to protect one’s image in the context of the internet where every scale is exacerbated : the speed, the reach and the lack of oblivion. We have previously wrote on <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Why Privacy Matters</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There can be various reasons why someone would want to protect its photos from falling into the arms of Facebook or other internet service provider. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The context of a family conflict and a divorce is what has motivated a <a href=\"https://gdprhub.eu/index.php?title=Rb._Gelderland_-_C/05/368427\">preliminary proceeding by the Dutch court of 1st instance</a> to order the take down of a photo posted on Facebook by the grandma.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contrary to the general outcry, this is not a GDPR immixtion into the grandparents freedom of cherishing their grand child. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although the GDPR has created a most ambitious regulation harmonising 28 EU member states data protection laws, it allows or requires Member States to implement specifications or restrictions on certain rules set out in the GDPR. Sometimes based on issues falling outside the EU’s legislative competence (national security, regulation of the press, the administration of justice,…)or for providing a margin of manoeuvre for Member States to specify their own rules for reasons of coherence.  Between these national specificities we can find Various age and conditions of consent or the applicability of the GDPR to deceased. This is an opportunity to allow more flexibility and adaptability to national legal systems and cultures. Harmonisation is not uniformisation. National sovereignties are respected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The court ruling here is based on a Dutch national legislation inserted into Article 5 of the GDPR, a national exception requiring that in the case of minors, their legal guardian must consent to the data processing. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To understand the judge’s ruling, the context of the dispute is essential. This is a daughter, in accordance with her ex-partner, fighting against her own parents to ask them to take down a photo of a minor child from Facebook. The grandparents had child’s custody for several years before he went living with his father. We have no information on why and how that happened. We have no information on the particular situation of the mother. Could she be a celebrity - the ruling is anonymised - Could she be a protected witness, a whistleblower …. What is the sensitivity of the picture? All we know is that she had obtained from the police an injunction against the grand parents to take down the pictures. they complied with several but left one. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is an interesting consideration of what is ‘personal and household’ GDPR exemption. Having lost custody, could it be  considered that the grand parents did not longer belong to the circle of ‘household’ and the publication on a Facebook page was considered outside the private circle? The judge does mention it was  unsure if the Facebook page was private or publicly accessible or the photo searchable by Google. Would the outcome be different if the page was private?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Léon Dijkman has published an excellent analysis of the case on the legal blawg the IPKat.  <a href=\"http://www.ipkat.com/?fbclid=IwAR3enrJLzk8mH6r7cVjp-EIWnRBRZaKXAqqkmgBBTnEgqwk1sthxA6IFpUQ\">Privacy rights and social media: can a person be prohibited from sharing online a picture of her grandson?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He describes the various conflicting rights. Claiming that ‘social media expressions may be protectable not just by Article 10 ECHR, but also Article 8: the right to family life (see also Article 7 Charter) referring to a 2017 book chapter by Professor Lorna Woods. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECtHR has recognised the right to maintain a relationship between a grandparent and a grandchild in <a href=\"#\">63190/16 Beccarini and Ridolfi v. Italy, at 50</a>. Is this relationship necessary broken by forbidding posting pictures on Facebook?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A balance of rights to strike between the various fundamental but not absolute conflicting rights : the fundamental right to privacy, as protected by Article 8 European Convention of Human Rights (ECHR) and Article 8 of the EU\'s Charter of Fundamental Rights and the right to family life in Article 7 of the Charter and the Article 10 on freedom of expression.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a  <a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photography by Geoff Lowe.</p>\n<!-- /wp:paragraph -->','Don\'t Shoot the GDPR with the Grandma','A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!','inherit','closed','closed','','967-revision-v1','','','2020-05-22 09:43:35','2020-05-22 08:43:35','',967,'https://datarainbow.eu/2020/05/22/967-revision-v1/',0,'revision','',0),(973,5,'2020-05-22 09:46:48','2020-05-22 08:46:48','<!-- wp:paragraph -->\n<p>Dont Shoot The GDPR for the Grandma’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For years, online security and privacy advocates have claimed a simple basic netiquette : ASK BEFORE YOU POST. It’s a fundamental right to wish to protect one’s image in the context of the internet where every scale is exacerbated : the speed, the reach and the lack of oblivion. We have previously wrote on <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Why Privacy Matters</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There can be various reasons why someone would want to protect its photos from falling into the arms of Facebook or other internet service provider. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The context of a family conflict and a divorce is what has motivated a <a href=\"https://gdprhub.eu/index.php?title=Rb._Gelderland_-_C/05/368427\">preliminary proceeding by the Dutch court of 1st instance</a> to order the take down of a photo posted on Facebook by the grandma.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contrary to the general outcry, this is not a GDPR immixtion into the grandparents freedom of cherishing their grand child. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although the GDPR has created a most ambitious regulation harmonising 28 EU member states data protection laws, it allows or requires Member States to implement specifications or restrictions on certain rules set out in the GDPR. Sometimes based on issues falling outside the EU’s legislative competence (national security, regulation of the press, the administration of justice,…)or for providing a margin of manoeuvre for Member States to specify their own rules for reasons of coherence.  Between these national specificities we can find Various age and conditions of consent or the applicability of the GDPR to deceased. This is an opportunity to allow more flexibility and adaptability to national legal systems and cultures. Harmonisation is not uniformisation. National sovereignties are respected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The court ruling here is based on a Dutch national legislation inserted into Article 5 of the GDPR, a national exception requiring that in the case of minors, their legal guardian must consent to the data processing. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To understand the judge’s ruling, the context of the dispute is essential. This is a daughter, in accordance with her ex-partner, fighting against her own parents to ask them to take down a photo of a minor child from Facebook. The grandparents had child’s custody for several years before he went living with his father. We have no information on why and how that happened. We have no information on the particular situation of the mother. Could she be a celebrity - the ruling is anonymised - Could she be a protected witness, a whistleblower …. What is the sensitivity of the picture? All we know is that she had obtained from the police an injunction against the grand parents to take down the pictures. they complied with several but left one. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is an interesting consideration of what is ‘personal and household’ GDPR exemption. Having lost custody, could it be  considered that the grand parents did not longer belong to the circle of ‘household’ and the publication on a Facebook page was considered outside the private circle? The judge does mention it was  unsure if the Facebook page was private or publicly accessible or the photo searchable by Google. Would the outcome be different if the page was private?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Léon Dijkman has published an excellent analysis of the case on the legal blawg the IPKat.  <a href=\"http://www.ipkat.com/?fbclid=IwAR3enrJLzk8mH6r7cVjp-EIWnRBRZaKXAqqkmgBBTnEgqwk1sthxA6IFpUQ\">Privacy rights and social media: can a person be prohibited from sharing online a picture of her grandson?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He describes the various conflicting rights. Claiming that ‘social media expressions may be protectable not just by Article 10 ECHR, but also Article 8: the right to family life (see also Article 7 Charter) referring to a 2017 book chapter by Professor Lorna Woods. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECtHR has recognised the right to maintain a relationship between a grandparent and a grandchild in <a href=\"#\">63190/16 Beccarini and Ridolfi v. Italy, at 50</a>. Is this relationship necessary broken by forbidding posting pictures on Facebook?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A balance of rights to strike between the various fundamental but not absolute conflicting rights : the fundamental right to privacy, as protected by Article 8 European Convention of Human Rights (ECHR) and Article 8 of the EU\'s Charter of Fundamental Rights and the right to family life in Article 7 of the Charter and the Article 10 on freedom of expression.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a  <a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photography by Geoff Lowe published with the authorisation of the Guardian Tara Taubman Bassirian. </p>\n<!-- /wp:paragraph -->','Don\'t Shoot the GDPR with the Grandma','A deluge of posts and articles have invaded the social media. How the GDPR could forbid a grandma to post her grand children’s photos online?!!!','inherit','closed','closed','','967-revision-v1','','','2020-05-22 09:46:48','2020-05-22 08:46:48','',967,'https://datarainbow.eu/2020/05/22/967-revision-v1/',0,'revision','',0),(975,5,'2020-07-20 00:44:20','2020-07-19 23:44:20','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>NEW IMPORTANT UPDATE 24th July 2020</strong> - <a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\">NOYB Next Steps for EU companies &amp; FAQs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>FISA 702+EO 12333 have no territorial limitation. They also apply to servers in the EU that are operated by a US \'electronic communication service provider\' or where certain operations are outsourced to a US provider. The location for hosting is therefore irrelevant.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Any non-EU/EEA provider had the duty to inform you about laws like <a href=\"https://twitter.com/hashtag/FISA?src=hashtag_click\">FISA</a> 702 and EO 12.333. If they have not done so, they are liable for all costs that result from cancelling the SCCs and transferring data back to the EU/EEA…</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> The <a href=\"https://twitter.com/hashtag/PrivacyShield?src=hashtag_click\">#PrivacyShield</a> Decision was an incorrect executive decision by the European Commission. In theory, damages claims can be brought against the EU under Article 340 TFEU.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>providers may have sufficiently limited the factual access (\'possession, custody or control\') from US entities, so that an EU/EEA server is factually beyond the reach of the US govt.” I wonder if such controls are possible without full separation </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is a complex decision based on the constatation that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations in the world this end of the week. At first read, the Privacy Shield is invalidated with immediate effect. Data export to the US cant be replaced by two other legal instruments which have been said valid in principle by the ECJ, specifically Standard Contractual Clauses and Binding Corporate Rules $Article 49 GDPR derogations). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In the absence of an adequacy decision, the controller or processor should t<strong>ake measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject</strong>. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, <strong>standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority</strong>. Those safeguards should ensure compliance with d<strong>ata protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation</strong>, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default.  </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs and BCRs are subject to a strict requirement to implement a case by case analysis and assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated - only not for the UK ICO !!!. Thousands of companies who relied on Privacy Shield will have to find another solution.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Paragraph 103 of the ECJ decision states :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.</p><p><br>Paragraph 143 to add:</p><p>Return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite the Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA bilk data collection , and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a>&nbsp;was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her first reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to the US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option left, only IF they are adapted and re-evaluated with the DPAs supervision. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more actively their concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they are other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>Ask the lawyers exchanging data across the channel, will they ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce you liability. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access although at some point the data will need to be unencrypted and vulnerable. Using EU companies as processor, or or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called <a href=\"https://www.cnbc.com/2020/07/17/gaia-x-europes-answer-to-us-and-chinese-tech-giants-power.html\">Gaia-X </a>might be the winner in this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third party cookies such as Google Analytics or Facebook Modernizr are means of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/our-work-tools/our-documents/other/frequently-asked-questions-judgment-court-justice-european-union_en\">Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems - European Data Protection Board - European Data Protection Board</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://iapp.org/news/a/using-sccs-post-schrems-ii-guidance-from-dpas/?mkt_tok=eyJpIjoiWkRsbVl6a3pZakJpTkRKaiIsInQiOiJSSVBkRGVVdFdBTXRUdDAzQzN5NktITWRaVG9QVnQ3U2hpeTQ2K09UU3BpWlJlVzZucTZjODVhSFFuV0VKcG1PdVpKQTErSTdVV09DNFJIYlwvQzl0bWxLYVVhZUxMa29QVkR4SVJcL1R6TUJpWkFlTjd2V0pFVDlpTXRXYmQ0WEdBIn0%3D&amp;utm_content=135417219&amp;utm_medium=social&amp;utm_source=linkedin&amp;hss_channel=lcp-10094295\">Using SCCs post-\'Schrems II\': Guidance from DPAs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">Schrems and the future of EU-US data transfers (or lack thereof…)&nbsp;</a>this is a LONG article. An interesting US view. It has some good elements but still missing few important points. No mention of the lawful basis of processing and the obligation of transparency FB failed. Why should there be any doubt on Facebook’s basis of data transfer to the US while SCC or Privacy Shield should be clearly stated in their privacy notice. Also no reference to the Cambridge Analytica interference into élections and manipulation of public opinion. I think this was a wake up call to many on the sort of game FB was playing when collecting data and profiling. Facebook is one player in the game, they are other big ones, US corporations have somehow grow so big that they are nous out of control even for the US government. I suggest reading Professor Lawrence Lessig on the point of Lobbying and corruption of the US Congress. Are EU countries much better? Well, surely they don’t have the same power. Plus there is some sort of partnership between EU countries offering some sort of guarantee. The EU is based on free mouvement of people and goods. Therefore the directive 95 came to ensure the free flow of data within member states. The real terror created by the 9/11 tragedy is the rising level of state surveillance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>State surveillance is the real threat to freedom and individual human rights. All Western countries have taken oppressive measures. What US has done is again one level higher with clear segregation against the rights of foreign citizens. Yes, in the EU we do care about our fundamental rights as much as the US is focused on free speech, Unlike the free speech in the US, The right to privacy and data protection are not absolute and have to be balanced with other fundamental rights. The right to privacy and data protection are différent despite being interconnected. Europe is a patchwork of sovereign nations with various cultures and legal systems. \nI fully agree with the authors ‘there are deep cultural differences between EU and US and you definitely need someone on your side that actually speaks and thinks “European” on this one.’\nBoth EU and US need each other. Transatlantic trade is essential but not at the cost of EU citizens rights. We might have woken up a bit late. Not sure we can actually stop the GAFAM with not enough EU competitors. Better late than never? It’s time for the Commission to play it’s role and negotiate a fairer agreement. I don’t believe a code of conduct could be sufficient. It won’t be an easy game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems-II Invalidation of the Privacy Shield by the ECJ','','publish','closed','closed','','schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj','','https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\nhttps://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/','2020-09-02 17:09:31','2020-09-02 16:09:31','',0,'http://datarainbow.eu/?p=975',0,'post','',0),(976,5,'2020-07-20 00:17:34','2020-07-19 23:17:34','','EU','','inherit','closed','closed','','eu','','','2020-07-20 00:17:34','2020-07-19 23:17:34','',975,'/wp-content/uploads/sites/3/2020/07/EU.jpg',0,'attachment','image/jpeg',0),(977,5,'2020-07-20 00:44:20','2020-07-19 23:44:20','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The decision can be summarised as follow :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations world this end of the week. At first read, the invalidated Privacy Shield is to be replaced by two other legal instruments which have been said valid by the ECJ, specifically mentioned Standard Contractual Clauses and by extension, the Binding Corporate Rules. These come with the requirement to implement a case by case analysis, assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated. Thousands of companies who relied on Privacy Shield will have to find another solution.<br> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br>Paragraph 103 of the ECJ decision states : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.<br> para 143 : return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA spying, and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a> was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option today, only IF they are adapted and re-evaluated. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more active concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>What lawyers exchanging data across the channel, will ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce liabilities. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>, <a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or <a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access. Using EU companies as processor, or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called Gaia-X might be the winner of this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third parties such as Google analytics is a mean of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used Tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>, <a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or <a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-20 00:44:20','2020-07-19 23:44:20','',975,'https://datarainbow.eu/2020/07/20/975-revision-v1/',0,'revision','',0),(979,5,'2020-07-20 00:50:15','2020-07-19 23:50:15','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The decision can be summarised as follow :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations world this end of the week. At first read, the invalidated Privacy Shield is to be replaced by two other legal instruments which have been said valid by the ECJ, specifically mentioned Standard Contractual Clauses and by extension, the Binding Corporate Rules. These come with the requirement to implement a case by case analysis, assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated. Thousands of companies who relied on Privacy Shield will have to find another solution.<br> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br>Paragraph 103 of the ECJ decision states : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.<br> para 143 : return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA spying, and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a> was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option today, only IF they are adapted and re-evaluated. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more active concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>What lawyers exchanging data across the channel, will ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce liabilities. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>, <a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or <a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access. Using EU companies as processor, or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called Gaia-X might be the winner of this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third parties such as Google analytics is a mean of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used Tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><br><br><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>, <a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or <a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-20 00:50:15','2020-07-19 23:50:15','',975,'https://datarainbow.eu/2020/07/20/975-revision-v1/',0,'revision','',0),(980,5,'2020-07-20 16:08:14','2020-07-20 15:08:14','{{unknown}}','','','publish','closed','closed','','4930adbaaaa7416f50795ac593149736','','','2020-07-20 16:08:14','2020-07-20 15:08:14','',0,'https://datarainbow.eu/2020/07/20/4930adbaaaa7416f50795ac593149736/',0,'oembed_cache','',0),