Privacy & Information Security Law Blog

On May 25 and May 26, 2020 respectively, the Belgian Data Protection Authority (the “Belgian DPA”) published two opinions on draft laws introducing COVID-19-related tracking initiatives: (1) the Opinion 42/2020 on the draft law for the creation of a database by Sciensano, a public health institution (“Opinion 42/2020”), and (2) the Opinion 43/2020 on the draft law for the use of contact tracing apps to fight the spread of COVID-19 (“Opinion 43/2020”).

The Belgian DPA had already issued critical opinions (Opinions 34/2020 and 36/2020, available in French) in April regarding draft Royal Decrees introducing similar initiatives by Sciensano that involved the use of tracing apps and the creation of a database for COVID-19 tracking.

According to the Belgian DPA, the public health institution had failed to demonstrate that the infringements on the private lives of individuals were necessary and proportionate to the purposes of preventing the spread of COVID-19, and the implementation of a contact tracing app was allowed only if it constituted the least intrusive measure to achieve this purpose. In particular, the DPA required more clarity about the source of the data that would be collected, the identity of third-parties with whom it might be shared and what these third parties could do with the data. The Belgian DPA had also requested that a data protection impact assessment be conducted along with the publication of the app’s source code. In addition, the Belgian DPA had indicated that there should be no cross-linking of data collected for COVID-19 tracking with any other type of data, and the data should not be re-used for purposes other than those related to COVID-19 tracking.

Below is a summary of the Belgian DPA’s opinions on the two new draft laws:

Opinion 42/2020 on the Draft Law for the Creation of a Database for COVID-19 Tracking

According to the draft law, Sciensano would be responsible for collecting and saving health and medical data of patients from various sources (e.g., doctors or medical/healthcare organizations) in a database along with personal data of individuals with whom presumably-infected patients have been in contact. The processing activities related to the creation of the database are aimed at: (1) allowing the identification of individuals that have been in contact with presumably infected person(s), in order to inform them about the risk of infection; (2) collecting data for scientific research or statistical purposes or to support future policy decisions, after pseudonymization or anonymization; and (3) sharing the data with regional health inspection services to fight the spread of the negative impacts of the virus. According to the Belgian DPA, the gaps identified in the Royal Decree for the creation of a database for COVID-19 tracking have not been remediated in the draft law.

Below is a summary of some of the Belgian DPA’s concerns and criticisms regarding the draft law. According to the Belgian DPA, the draft law for the creation of a database for COVID-19 tracking:

• Does not comply with the requirements of clarity and foreseeability. According to the Belgian DPA, the purposes of the draft law are neither clearly determined nor explicit.
• Should be better structured and clarify for each of its purposes the categories of data processed, the source(s) of the data, the identity of the controller(s), the retention period of the data and, where necessary, the categories of recipients and reasons why the data may be shared. Restructuring the draft law per these purposes would, according to the Belgian DPA, allow compliance with the principles of necessity and proportionality.
• Is unclear in its objective. As opposed to simply creating a database for COVID-19 tracking, the objective of the draft law is in fact to organize (without a clear justification as to the necessity of this initiative) the centralization of a large quantity of data (including sensitive data such as health data) in the hands of a single actor (i.e., Sciensano) that is not ultimately responsible for achieving the three main purposes of the draft law but is merely an intermediary. According to the Belgian DPA, this is not in line with the principles of necessity and data minimization.
• Does not demonstrate the necessity and proportionality of the data collection and recording in a global database. In particular, the draft law: (1) does not clearly demonstrate the link between the data collected and the purposes for which it is collected; (2) does not demonstrate the necessity (and hence, the lawfulness) of collecting and recording data such as a doctor’s ID number, the type, date and sample number, test results, presumptive diagnosis, results of the individual’s CT scan, etc.; (3) is too vague when it provides that the database can be completed with additional data from other sources without clearly defining what this means, therefore broadening the scope of the data collection indefinitely; (4) does not provide clear arguments as to why data such as a national identification number or social security number is necessary to achieve the purposes of the draft law; and (5) does not exclude from the scope of the collection data of individuals that have tested negative.
• Does not create a legal framework allowing an exception to medical secrecy, which is necessary in this case to allow the sharing of health data by doctors with the database.
• Is not in line with the principle of storage limitation, as it provides that the data will be deleted when a Royal Decree declares the end of the pandemic, which is too vague and hypothetical.

For these reasons, the Belgian DPA provides a negative opinion on the draft law for the creation of a database for COVID-19 tracking.

Opinion 43/2020 on the Draft Law for the Use of Contact Tracing Apps for COVID-19 Tracking

According to the draft law, Sciensano will record in log files the secured keys of app users who are infected and make those files available to other app users, thereby informing them about a potential contact with an infected individual. The technique used would allow the exchange of information on infection risks without the possibility for the app provider or app users to identify other infected users. In its Opinion 43/2020, the Belgian DPA recognizes and welcomes the improvements made to the related Royal Decree (see above) but concludes that efforts must still be made to ensure that the implementation of the app is in line with the EU General Data Protection Regulation (“GDPR”). To that end, the Belgian DPA asks that the draft law be amended.

Below is a summary of the Belgian DPA’s main recommendations and remarks:

• The draft law should provide more information regarding the functioning of the tracing system in order to ensure that the risks related to its use are appropriately mitigated, including the risk of re-identification of app users.
• According to the Belgian DPA, the draft law should clarify the scope of Sciensano’s mission by including a list of the processing activities for which Sciensano is the data controller. Further, the Belgian DPA considers that appointing Sciensano as the data controller for both the processing activities related to the tracing app and those related to the database used to store contact tracing data is risky.
• The source code of the tracing app(s) should be published in their entirety.
• The Belgian DPA also recommends that only one contact tracing app be available at the national level, as opposed to several apps, and that any data protection impact assessments conducted in relation to such app be submitted to the authority.
• The list of processing purposes included in the draft law should be reformulated and epidemiologic research should be removed from the list, as Article 89 of the GDPR already allows further processing of personal data for scientific research purposes, subject to conditions. The Belgian DPA simply recommends indicating in the draft law that any further processing should only take place to the extent the data has been duly anonymized.
• The Belgian DPA recalls the importance for the app to be entirely voluntary and to comply with the principle of data minimization.
• A prohibition on collecting any identifier linked to the terminal of the app users (such as MAC addresses) should be included in the draft law. In addition, the draft law should clarify that the app cannot allow localization of app users.
• The Belgian DPA also asks that data flows be adequately secured, including from the server to the app(s), from the app(s) to the authority in charge of receiving notifications of infected users and as data flows between apps, if applicable.
• The legibility and foreseeability of the draft law should be improved by including definitions of key concepts, such as tracing apps, users, risky contacts, authorization code, secured key, temporary and non-personalized serial number, etc.
• According to the Belgian DPA, the timing for deactivation of the contact tracing app(s) should be more clearly set forth by the draft law.
• Transparency vis-à-vis app users is also a key requirement for the use of contact tracing apps, according to the Belgian DPA.

Read the Opinion 42/2020 and Opinion 43/2020 (only available in French).