This newsflash addresses the applicability of data protection legislation to the tracing app, the need for a legal basis and certain requirements in the context of the app's implementation.

1. Applicability of data protection legislation

The Tracing Ordinance stipulates that all appropriate technical and organizational measures must be taken to prevent participants from being identifiable. Although the participants should thus not be identifiable (and as a consequence no personal data within the meaning of data protection legislation is actually processed), the tracing system remains in the opinion of the Federal Data Protection and Information Commissioner (FDPIC) associated with re-identification risks (see the FDPIC's opinion; in German). Accordingly, the FDPIC considers that the data protection legislation nevertheless applies.

2. Data protection requirements for the tracing app

Provided that data protection legislation is applicable to the tracing system, the following data protection principles in particular must be observed:

2.1 Legal basis

As the tracing app is operated by a federal body, a legal basis for processing is required. To the extent that sensitive personal data (e.g. the information that someone has been infected with the corona virus) is processed, a formal enactment by Parliament is required.

In the Parliament's summer session in June 2020, a respective statutory basis shall therefore be discussed and adopted. Under certain circumstances, however, the Federal Council may authorize the processing of sensitive personal data already prior to the formal enactment coming into force.

As one of the prerequisites for this, a test phase must be indispensable before the formal enactment enters into force, which can be argued here with the technical innovations of the app and the need for evaluation of its impacts. The FDPIC qualifies the Tracing Ordinance as a sufficient legal basis for the implementation of the pilot project.

2.2 Proportionality and purpose limitation

Data processing within the tracing system must be limited in time and scope to the extent necessary to make a significant contribution to overcoming the current crisis. To this end, the Tracing Ordinance stipulates that no location data is to be collected, that as much data as possible is to be stored decentrally on the participants' devices (i.e. not on a central server) and that the data retention period is limited.

The suitability of the tracing app for achieving its purpose (and thus its proportionality) can be questioned in general. First, because the tracing app must be installed and activated by a significant part of the population in order to work effectively; second, because the participants must voluntarily enter a potential infection into the app; and third, because a hardly predictable amount of "false alarms" must be expected.

Data processing within the tracing system must be limited in time and scope to the extent necessary to make a significant contribution to overcoming the current crisis. To this end, the Tracing Ordinance stipulates that no location data is to be collected, that as much data as possible is to be stored decentrally on the participants' devices (i.e. not on a central server) and that the data retention period is limited.

The suitability of the tracing app for achieving its purpose (and thus its proportionality) can be questioned in general. First, because the tracing app must be installed and activated by a significant part of the population in order to work effectively; second, because the participants must voluntarily enter a potential infection into the app; and third, because a hardly predictable amount of "false alarms" must be expected.

Despite these reservations, the FDPIC currently considers the tracing system to be suitable for making (at least) a partial contribution to prevent life-threatening infections. In his opinion, however, the FDPIC reserves the right to come up with a later recommendation to the Federal Office of Public Health to refrain from going live with the app or to discontinue its use, should it become apparent during the pilot phase or later that the tracing app cannot fulfil the expectations put in it.

2.3 Privacy by Design

The instructions regarding comprehensive anonymisation and decentralised data storage made in the course of the tracing app's development are a good example of how Privacy by Design can be implemented in practice. This principle, which is stated in the EU General Data Protection Regulation and in the current draft of the revised Swiss Federal Act on Data Protection, requires that data protection principles and standards have to be taken into account at the earliest possible stage in the selection, definition and implementation of systems for data processing and that they are included in their "technical setup".

3. Conclusion

As far as all data processed with the tracing app is completely anonymised - which should be the aim according to the Tracing Ordinance - data protection legislation would actually not have to be observed. However, even if data protection legislation was applicable, the FDPIC considers the Tracing Ordinance as a sufficient legal basis for the time being and for the duration of the pilot phase, i.e. until a formal enactment by Parliament comes into force.

According to the FDPIC, the tracing system is permissible from a data protection perspective. However, it remains yet to be seen whether the tracing app will in future be able to meet the expectations placed in it to overcome the corona crisis.