After weeks of debate and discussion among experts and the Italian government, Italy is implementing its own social tracing app to (hopefully) stop the spread of Covid-19, which is keeping the whole country (and most of the world) at home. The “Working Group Data Driven for Covid-19 Emergency,” established by the Italian government with the aim of supporting its decisions and actions in the fight against the virus, has selected — from more than 300 proposals — the “Immuni” project submitted by the company Bending Spoons jointly with the Sant’Agostino Diagnostic Center and Jakala.
The app is based on two basic principles: voluntary download of the app and the use of Bluetooth technology, rather than GPS technology. Both elements were required by the European Data Protection Board and set forth in its letter to the EU Commission of April 14 as fundamental conditions (among others) for considering social tracing apps in compliance with the General Data Protection Regulation.
This means that there will be no obligation for Italian citizens to download and use the app and that the technology to be used will be able to track the contacts of an individual who has tested positive for the virus in order to alert those contacts that they have been close to a positive person and carry out further controls. The app will not use GPS technology — which is able to locate the individual in space — which was deemed to be more intrusive and less useful for the purposes of tracking the spread of the virus.
But, as soon as news of the app was reported in newspapers, the already lively debate on the value of social tracing and its compliance with privacy laws grew even more intense. It must be said that, apart from the announcement that the decision had been made, there has been little non-technical information released about how Immuni will function, and the information that has been provided has been fragmented.
The main doubts surrounding this news revolve around whether downloading the app is truly a choice for Italian citizens and whether it will actually be processing “anonymous” data.
As to the first point, there are two main concerns: (i) in order for the app to be useful it needs to be downloaded by more than 60% of the Italian population: this seems to be quite an ambitious goal (though not entirely out of reach) if the app is to be downloaded by free choice; (ii) some public administrators have suggested movement restrictions for those who do not use the app in order to incentivize downloads, which would mean use of the app is not truly voluntary and free.
As to the second point, it seems that the app will use random identification codes and that the contact diary will be stored on the smartphone rather than in a centralized database. This is surely a good news and a proper security measure in light of the minimization principle stated by the GDPR, yet it does not make the data “anonymous,” legally and technically; rather the data seem to be “pseudonymized.”
In addition, a proper legal basis for the app’s processing of data should be established. Even if the app is voluntary, consent would in any event not be the proper legal basis for this processing. If the app is going to process health data or geolocation data, the public interest as it relates to the protection of public health should be detailed by a law duly approved by the Italian Parliament.
Also, in countries where social tracing apps have been implemented, their implementation has been accompanied by a high degree of transparency and a heavy flow of information to citizens. The need for transparency is not something that is “nice-to-have,” but a fundamental right in the EU, as is expressly recognized by the GDPR and EU laws. Any public initiative aimed at providing details on the overall strategy of the Italian authorities as well as details on the functioning of the app is not just highly desirable, but required in light of the accountability principle and in order to ensure respect for the fundamental rights of citizens.
Finally, whether the app will be useful or not will depend on multiple measures that will be adopted by the Italian government to control and stop the spreading of the virus. Large-scale use of tests is required in order for the app to be effective: if the app is not included in a global strategy involving public health authorities and our local and national administrations, it is very likely that it will not hit its target.
