The Norwegian public health agency (FHI) has suspended the use of its coronavirus contact-tracking application following the country’s data protection authority’s orders for the collection and use of user location data. FHI has also deleted all information collected so far by the application.
Norway’s privacy regulator, Datailsynet, expressed concern with the way the application, called Smittestopp, collects GPS location data and Bluetooth data from users. His assessment said the application “could no longer be considered a proportional intervention on the user’s basic privacy rights.”
In a statement, the supervisor said “we believe that FHI has not indicated that it is very necessary to use location data for infection detection” and recommended that the application only uses data collected via Bluetooth, indicating “EU countries have developed application infection tracking only based on on Bluetooth technology, and not GPS location data either. “
What the numbers say: According to Johns Hopkins University, there are 8,639 confirmed cases of Covid-19 and 242 deaths in Norway.
The application is being tested in three regions in the country, but because infection rates in the area are low, health authorities said last week it was difficult to test whether the Smittestopp application notified “those who might actually have been exposed to infection”.
Watchdog also questions the “lack of freedom of choice for users” who register to the application.
According to Datailsynet, the data needed to track infection is also used for analysis and research, according to which regulators are two different purposes and require “different personal information.”
There are also concerns that arise about how the data collected remains anonymous. “Solutions for the anonymization and aggregation of data for analysis also do not exist,” Bjørn Erik Thon, Director of Datailsynet said in a statement. “Still, this application continues to collect personal information from all users,” added Thon.
FHI does not agree with the regulator’s assessment.
In a statement FHI Director Camilla Stoltenberg said that delaying the application would weaken “an important part of our preparedness to increase the spread of infection, because we lost time developing and testing the application.” Stoltenberg warned that the pandemic was not over, adding “without the Smittestopp application, we would be less prepared to prevent new outbreaks that might occur locally or nationally.”
Stoltenberg added: “We hope that it will be possible to find a solution so that infection notification and analysis of infection control measures can be introduced in the long term.”
FHI has until June 23 to fix the problem raised by the regulator.
