{"id":5324,"date":"2023-04-18T12:35:59","date_gmt":"2023-04-18T12:35:59","guid":{"rendered":"https:\/\/exciting-panini.13-37-234-21.plesk.page\/?p=5324"},"modified":"2024-07-03T11:18:55","modified_gmt":"2024-07-03T11:18:55","slug":"stopcovid-itineraire-dune-application-controversee","status":"publish","type":"post","link":"https:\/\/viqtor.eu\/en\/stopcovid-itineraire-dune-application-controversee\/","title":{"rendered":"STOPCOVID: Journey of a controversial application"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"STOPCOVID\u00a0:\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

STOPCOVID: Journey of a controversial application<\/h1>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\n

STOPCOVID: Journey of a controversial application<\/strong>Not a day goes by without the question of "deconfinement" of the population being addressed, in France as elsewhere, in connection with the tracing of the virus and the individuals who transmit it.<\/p>\n\n

Recent developments mention the creation of a file to track infected people, the details of which are submitted to the CNIL for review.<\/p>\n\n

The media also reported a standoff between GAFAM and the government to implement the most virtuous "stopCovid" application.<\/p>\n\n

While parliamentary debates on this application are currently suspended, can we have a clear vision of the issues and impacts of such digital monitoring?<\/p>\n\n

Is it a question of national sovereignty, a question of data control or, more prosaically, \u201csimple\u201d technical choices?<\/p>\n\n

The question is important because it concerns not only France, but most European countries and other states trying to manage the pandemic.<\/p>\n\n

Protocols and their impact on data processing<\/p>\n\n

The PEPP-PT (Privacy Preserving Proximity Tracing) project was originally intended to enable the development of applications in Europe on a harmonized basis, in compliance with the law.<\/p>\n\n

The aim is to inform a person that they have been in contact with an infected person, based on the Bluetooth technology of their smartphone, without geolocating them.<\/p>\n\n

While PEPP-PT initially seemed to gain support, several hundred scientists distanced themselves from it and took a position in an open letter in favor of a protocol based on a decentralized approach such as DP-3T (decentralized privacy preserving proximity tracing), so that the data remains stored locally: this would offer better guarantees in terms of data security and regarding the risks of data misappropriation by third parties or use for different purposes.<\/p>\n\n

Let us remember that the conservation of data locally is a principle of proportionality and Privacy by Design put forward in other contexts such as the processing of biometric data.<\/p>\n\n

\u00a0<\/p>\n\n

The CNIL has a clear position on this subject, which can be found in particular in its communication concerning the use of biometric data by smartphones or in the workplace.\u00a0<\/p>\n\n

The tools implemented by Google and Apple were developed (in particular) with this local storage perspective recommended in the DP-3T protocol, in order to prevent overly intrusive use of data from users' laptops.<\/p>\n\n

Where the problem lies is when France (and initially Germany, which has since changed its mind) develops an application based on the Robert protocol (for ROBust and privacy-presERving proximity Tracing), which cannot work based on the functionalities proposed by Apple and Google, with specific requirements in terms of Bluetooth and data centralization (the details are clearly explained here).<\/p>\n\n

This does not in itself mean that the French application violates data protection principles: guarantees (particularly in terms of pseudonymization) have been provided, and the CNIL, while issuing some observations, has given a favorable opinion.<\/p>\n\n

But where France is taking precautions, how many other more or less democratic countries would take advantage of the "\u00e0 la carte" features offered by Apple and Google to carry out much more intrusive surveillance of their populations?<\/p>\n\n

This explains \u2013 in part \u2013 the reluctance of the web giants and the current deadlock in the situation.<\/p>\n\n

The Presidency of the European Council has put this item on the agenda of its meeting on 5 May, during which EU telecommunications ministers will try to adopt a common approach.<\/p>\n\n

The legal framework<\/strong><\/p>\n\n

Beyond these technical aspects, the management of contact data via this type of application raises common issues with regard to the law: let us specify from the outset that the data is not anonymous but pseudonymised, which leads to the application of the GDPR and the principles of protection of telecommunications data.<\/p>\n\n

In addition to the voluntary nature of using the application, the government can only process this type of sensitive data if it is authorized to do so by a specific legal basis.<\/p>\n\n

Furthermore, transparency of processing must be ensured, data must be secured and their deletion must be planned within strict time limits.<\/p>\n\n

Whether it is the CNIL, the EDPB (group of European "CNILs"), the European Data Protection Supervisor (EDPS) in its hearing in the Senate on April 27, or the Council of Europe, the supervisory authorities point out that no system can completely avoid vulnerabilities and risks of re-identification, whether it is a centralized or decentralized system.<\/p>\n\n

They agree on the precautions to be taken in the design and use of applications, but they also emphasize first and foremost the non-trivial nature of this type of tool, citing the risk of prolonging emergency situations and of the population becoming accustomed to latent surveillance.\u00a0<\/p>\n\n

\u00a0<\/p>\n\n

In the same vein, we can cite students who today have to get used to regular screenshots of their terminal by their teacher when they take a remote exam, and who could eventually find this type of intrusion normal in other contexts.<\/p>\n\n

It is therefore above all a question of not dodging the fundamental question of the necessity of the measure, its impact and its proportionality in the face of the consequences on the fundamental rights of individuals.<\/p>\n\n

And also:<\/p>\n\n