The Norwegian Government responded to a notice from the country’s Data Protection Authority, which found that the data collection was no longer proportionate.
Background: The contact-tracing app used in Norway to track and prevent the spread of COVID-19, called Smittestopp (‘Infection Stop’) uses a centralised approach, meaning that data from users’ devices is stored on a server. The app uses both bluetooth and location data to determine whether people have been in contact with someone known to carry COVID-19.
The Data Inspectorate calls for a suspension: On 12 June 2020, the Norwegian Data Protection Authority, the Data Inspectorate, issued a notice to the National Health Institute to temporarily prohibit the collection of personal data through the Smittenstopp app. The Data Inspectorate said that users cannot provide personal data to the app without accepting that the information is also used for analysis and research. Different purposes should have separate consent requests. The Government has also not demonstrated the need to use location data, and why it should depart from the common approach set out in the EU which recommends the sole use of Bluetooth. More worryingly, the Inspectorate says that a solution to anonymise and aggregate the data for analysis is currently not in place. Support for the app among the public is low, since only 14% of the population over 16 years of age is actively using it. This casts doubts over the effectiveness of the app, which may not be able to alert people with the necessary accuracy, also considering that the Health Institute is now saying that infection rates are very low in the country.
What next? The Inspectorate gave the Government until 23 June 2020 to respond, however on 15 June 2020 the Public Health Institute decided to stop data collection immediately, and would erase the data already collected as soon as possible. The Institute disagrees with the Inspectorate’s assessment, and hopes to find a solution so that notifications and analysis of infection control measures can be introduced in the long term.
