What You Need to Know About GDPR In Relation To Ireland’s Contact Tracing App

As the course of this pandemic progresses it seems we will be required to co-exist with COVID-19 for the foreseeable future.  Remaining in a state of lockdown presents significant challenges for society and government from an economic and social perspective and contact tracing apps have emerged as a complementary measure to ending such lockdown measures.

On 8 April 2020, the European Commission (the Commission) published a recommendation for the use of technology and data to help predict the spread of COVID-19 in a data protection compliant manner.  The recommendation details practical measures that focus on the use of mobile apps to enhance social distancing measures, as well as to help with contact tracing and information sharing to curb the spread of the virus.  It puts these apps forward as the preferred type of apps with the least impact on privacy.

For tracking apps to be a success, the public needs to have trust in how the data will be stored and processed.  Transparency is therefore paramount for significant public uptake of such apps.  Compliance with Articles 13 and 14 GDPR through privacy notices needs to be achieved.  A Data Protection Impact Assessment is also necessary for such apps under Article 35 GDPR to mitigate risks to the rights and freedoms of individuals.  The principle of data minimisation and purpose limitation need also to be complied with, in that the data is highly sensitive and should only be used for specified purposes.  The appropriate legal basis for processing needs to be assessed and consent is the most likely basis for such processing.  Careful consideration should be given to how to obtain consent and the options for withdrawing it.

The Health Service Executive (HSE) has developed the COVID tracker app which has the purpose of supporting the national public health response and members of the public during the COVID-19 crisis.  THE HSE and Department of Health (DoH) are Joint Data Controllers and therefore are jointly responsible for your personal data and responsibilities for compliance with their obligations under data protection laws.  The app has the following functions:

  1. Contact tracing – notifying an individual if they have been in close contact with someone who has tested positive;
  2. COVID Check-in – enabling users to record and upload health symptoms without revealing their identity;
  3. News and Information – providing facts and figures about COVID-19 levels in Ireland;
  4. Other functions – a leave function is available to users permitting users to delete all data held at any time.

The processing of personal data should be limited to the sole purpose of fighting COVID-19 and no commercial use of the data should be made.  It is widely recognised that when combined with other measures such as social distancing, the contact tracing app can contribute to the fight against COVID-19.  Acceptance and widespread voluntary use of the App will depend on the public trusting that any interference with their privacy and data protection rights is kept to a minimum.


Article by: Marie Hynes, Senior Associate Solicitor at Augustus Cullen Law Solicitors. Augustus Cullen Law is based at 7 Wentworth Place, Wicklow. If you would like more information on this topic, call +353 404 67412 or email info@aclsolicitors.ie

You may also like