Source: US Global Legal Monitor
(Nov. 9, 2020) In June 2020 the Italian government implemented a voluntary contact tracing app called Immuni to address the spread of COVID-19. Instead of relying on a centralized database to trace contacts, the new app creates a voluntary system based on citizens’ willingness to download it to their personal smartphone devices. The Immuni app was created by the Ministries of Health and Technological Innovation.
This privately-developed mobile app reportedly “uses Bluetooth short-range radio based on a joint technology standard from Apple and Google to log close contacts securely on the device,” and does not involve identification or geolocation of the user. The Immuni app can be downloaded for free from the Apple and Google stores in English, French, German, Spanish, and Italian.
When a patient tests positive for COVID-19, the treating physician sends a message to all persons who have been in contact with the patient to encourage them to take appropriate measures (get a test, see a doctor, or self-isolate), as that is precisely the purpose of the app.
Privacy concerns have been at the forefront of the national discussion about the expansion of Immuni, with the government stating from the outset that “personal data will not be collected and the app will not geolocate [users].” A law passed in 2020 permanently guarantees the confidentiality, integrity, availability, and resilience of processing systems and also contains measures to avoid the risk of re-identification of parties whose pseudonymized data has been processed. (Decree Law [D.L.] No. 28 of April 30, 2020, art. 6(2)(d).)
Data traced from the Immuni app is already been used by scientists to design potential propagation scenarios in order to assist policy makers in the adoption of preventative and palliative measures vis-à-vis the COVID-19 pandemic.
The government had already introduced a COVID-19 alert system prior to the Immuni app with the April 2020 passage of D.L. No. 28, which created a single national platform for the management of an alert system to be used by those who voluntarily installed a specific app on their personal mobile devices in order to be alerted of persons who have tested positive for COVID-19 and to protect public health in the context of the pandemic. (D.L. No. 28, art. 6(1).) Based on this legislation, the Immuni app was created by private developers and sponsored by the Italian government, as explained above.
Subsequent legislation, including the most recent Decree Law [D.L.] No. 125 of October 7, 2020, on extension of the declaration of the COVID-19-related state of emergency, the operational continuity of the COVID alert system, and implementation of EU Directive 2020/739 of June 3, 2020, ratified the COVID-19 Alert System created by D.L. No. 28. D.L. No. 125 also authorized the interoperability of the Italian platform with other platforms operating in the EU and allocated additional resources for the operation of the platform. (D.L. No. 125, art. 2(1).)
Deletion of Data by December 31, 2020
Data related to close contacts must be kept, even on users’ mobile devices, for the period strictly necessary for its processing as established by the Health Ministry and will be automatically cancelled at the expiration of that period. Pursuant to current regulations, all recorded contact information (logs) will be deleted once the pandemic emergency is under control, or at any rate by December 31, 2020, at which time all processed personal data must be cancelled or permanently made anonymous. (D.L. No. 28, art. 6(2)(e) & (6).)