The Norwegian Data Protection Authority has reached a decision to temporarily ban the processing of personal data using the Smittestopp contact tracing mobile application. As previously notified, we mean that Smittestopp cannot be considered a proportionate intervention in the user’s fundamental right to data protection.
The purposes of Smittestopp are contact tracing and notification of Covid-19 infection, as well as analysis of anonymous and aggregated data to evaluate the effect of infection control measures, and monitoring of the spread of infection in society. The app has collected large amounts of personal data about the people using it, including continuous registration of movements and information about the users’ contact with others.
The Norwegian Data Protection Authority finds that the Norwegian Institute of Public Health (NIPH) has not documented the benefit of the app. We have looked at the technical solutions chosen for Smittestopp, the low level of adoption of the app (approx. 14% of the population aged 16 or above), and the spread of the infection in the population. We also find that the NIPH has not sufficiently established the necessity of using location data from GPS in contact tracing, which we find is in conflict with the principle of data minimization.
Furthermore, the Norwegian Data Protection Authority has been critical of the fact that users have not had the option to choose to share personal data for just one or several of the purposes. In June, The Norwegian Parliament reached the decision that the purposes have to be separated in the next version of the app.
The NIPH has already decided to stop the collection of personal data, and to erase the collected data. The Norwegian Data Protection Authority will continue to control any new versions of the app.
This press release was originally published on July 7, 2020 (norwegian).