European Commission announced a mobile tracing and warning app to break the chain of coronavirus infections and save lives. EU member states have agreed on a technical solution for the exchange of information between national contact tracing and warning apps that are installed voluntarily on smartphones. The apps will be deactivated automatically at the end of the pandemic but can also be uninstalled by the user at any time.
Contact tracing apps
Since the outbreak of the coronavirus pandemic, Member States, backed by the Commission, have been assessing the effectiveness, security, privacy, and data protection aspects of digital solutions to address the crisis. Contact tracing apps, if fully compliant with EU rules and well coordinated, can play a key role in all phases of crisis management, especially during this time when most countries are gradually lifting social distancing measures. They can complement existing manual contact tracing and help interrupt the transmission chain of the virus. Thereby, they can contribute to saving lives.
eHealth Network – Digital COVID tracing
Member States in the eHealth Network, supported by the Commission, have developed an EU toolbox for the use of mobile applications for contact tracing and warning in response to the coronavirus pandemic, which was accompanied by guidance on data protection for mobile apps. This is part of a common coordinated approach to support the gradual lifting of confinement measures, as set out in a Commission Recommendation. To ensure contact tracing and warning apps work also cross-border, Member States, with the support of the Commission agreed on interoperability guidelines in May, on a set of technical specifications in June, and the Commission adopted an Implementing Decision to provide a legal basis for the set-up of the gateway service.
Interoperability Tracing Gateway Service
EU Commission is setting up an interoperability gateway service linking national apps across the EU. Today, an important milestone has been reached as a group of Member States starts testing the infrastructure. The Commission has kicked off test runs between the backend servers of the official apps from the Czech Republic, Denmark, Germany, Ireland, Italy and Latvia, and a newly established gateway server.
Thierry Breton, Commissioner for Single Market, said: “Many Member States have implemented national contact tracing and warning applications. It is now time to make them interact with each other. Travel and personal exchange are the core of the European project and the Single Market.”
The gateway will facilitate this in these times of pandemic and will save lives.
Thierry Breton, Commissioner for Single Market
Stella Kyriakides, Commissioner for Health and Food Safety, added: “Coronavirus tracing and warning apps working across borders can be powerful tools in our efforts to contain the spread of COVID-19. With cases on the rise again, apps can complement other measures like increased testing and manual contact tracing. If used widely enough, they can help us break the chains of transmission.”
We will not stop fighting on all fronts against the pandemic.
Stella Kyriakides, Commissioner for Health and Food Safety
Tracing and Coronavirus Warning app
In the fight against coronavirus, most Member States have launched a national contact tracing and warning app, or plan to do so. The setup of the interoperability gateway service by the Commission follows the agreement by Member States on technical specifications to deliver a European solution to ensure a safe exchange of information between the backends of national contact tracing and warning apps based on a decentralised architecture. This covers almost all such apps launched in the EU.
Cross-borders Tracing Service
The gateway, a digital infrastructure that ensures the communication of information between national apps’ backend servers, will ensure that apps will work seamlessly also cross-borders. Thus, users will only need to install one app and will still be able to report a positive infection test or receive an alert, even if they travel abroad.
The gateway will efficiently receive and pass on arbitrary identifiers between national apps to minimise the amount of data exchanged and thus reduce users’ data consumption. No other information than arbitrary keys, generated by the national apps, will be handled by the gateway. The information exchanged is pseudonymised, encrypted, kept to the minimium, and only stored as long as necessary to trace back infections. It does not allow the identification of individual persons.
The gateway is developed and set up by T-Systems and SAP and will be operated from the Commission’s data centre in Luxembourg. After testing, it will start to be operational in October.
Do you agree to install a Coronavirus Tracking app to control pandemic?
How does a tracing app work, concretely?
You install the application on your phone. Some limited registration information may need to be provided to start the application. After giving the necessary consent to use Bluetooth for proximity detection, the app will start generating temporary keys that are shared with other devices running a contact tracing app. If you feel sick and get a positive diagnosis for coronavirus, your public health authority will enable you to confirm this through the app. At that moment, the electronic contact tracing triggers an alert to the people with whom you have been in contact. These users will be notified of their exposure and will be advised on the steps to follow, for example self-quarantine or testing. They can also contact the health authority.
Personal Data: Identity – Location
Neither your identity, location nor exact time of contact are ever revealed. This is the same if a contact of yours is tested positive: you will be notified so that you can protect yourself and the people around you. The use of the application is voluntary. It will be deactivated automatically at the end of the pandemic, and you are free to uninstall it at any time.
What is a contact tracing and warning app?
A contact tracing and warning app is voluntarily installed and used to warn users if they have been in proximity for a certain duration to a person who reported to have been tested positive of COVID-19. In case of an alert, the app may provide relevant information from health authorities such as advice to get tested or to self-isolate, and who to a contact.
Coronavirus Tracking Apps
Why do we need these apps?
Contact tracing is an essential intervention, alongside testing and isolation, in the effort to control the pandemic. Mobile tracing will complement traditional tracing that is done manually by public health authorities when they interview patients with symptoms, typically over the phone, to understand with whom they have been in contact over the past 48 hours.
Contact tracing apps may allow warning as many potential contacts as possible, thereby enabling them to take further steps that can help to break infection chains and thus quickly stop the virus from spreading further. Together with traditional tracing and complemented by other measures such as increased testing, voluntarily installed tracing apps can provide a valuable contribution to the gradual lifting of confinement measures.
Are all contact-tracing apps interoperable?
As a first important step towards interoperability of contact tracing apps throughout the EU, Member States, with the support of the Commission, have agreed on a set of technical specifications to ensure a safe exchange of information between contact tracing apps based on a decentralised architecture. This concerns the great majority of tracing apps that were already – or are about to be – launched in the EU.
The Commission continues to support the work of Member States on extending interoperability also to tracing apps with different architectures.
EU toolbox – Coronavirus Tracking
How does interoperability work?
Apps that are interoperable can exchange information between themselves, so people in the EU only need install one app – typically the app of their home country – and still be able to report a positive test or to receive an alert, wherever they are in the EU. Member States will already be able to update apps to permit information exchange between national, decentralised apps as soon as they are technically ready.
To support and further streamline the system, the Commission will set up a gateway service, an interface to efficiently receive and pass on relevant information from national contact tracing apps. This server will minimise the overall amount of data exchanged, thereby reducing users’ data consumption.
What are the guidelines on cross-border interoperability about?
These are common and general principles aiming at ensuring that tracing apps can communicate with each other when required, so citizens can report a positive test or receive an alert, wherever they are in the EU and whatever app they are using. The guidelines will be complemented by a set of clear technological parameters to ensure swift implementation by developers working with national health authorities. The Commission is supporting Member States in finding the right solution to ensure secure, protected and interoperable contact tracing apps across Europe, in line with the principles set out in the EU toolbox and the Commission guidance on data protection.
Tracing apps must be voluntary, transparent, secure, interoperable and respect people’s privacy. Apps will use arbitrary identifiers, no geolocation or movement data will be used. All apps have to be temporary only, so they will have to be dismantled as soon as the pandemic is over. And they should function everywhere in the EU, across borders and across operating systems. Interoperability is crucial, so that wide, voluntary take-up of national tracing apps can support the relaxing of confinement measures and the lifting of restrictions of freedom of movement throughout the EU.
Why do we need these interoperability guidelines?
Interoperable apps will facilitate the tracing of cross-border infection chains, be valuable for cross-border workers, tourism, business trips and neighbouring countries. The voluntary and widespread use of interoperable apps may support exit strategies, the gradual lifting of border controls within the EU and the restoration of freedom of movement.
Member States agreed the interoperability guidelines in the eHealth Network with the support of the Commission. They set out the minimum requirements for approved apps to communicate with each other, so that individual users can receive an alert, wherever they are in the EU, if they may have been in proximity for a certain time to another user who has been tested positive for the virus. For example, apps need to have a common approach to detecting proximity between devices, and they should allow individuals roaming in another Member State to be alerted with the relevant information in a language they understand.
What data will I share when using these apps?
Upon activation, the app generates an arbitrary identifier (a set of numbers and letters). These keys will be exchanged via Bluetooth between phones at short distance. The exchanges make it possible to detect other devices with a similar, running app nearby.
Will I need an internet connection to use my app?
For the tracing functionality as such, a permanent Internet connection is not necessary. Bluetooth, which is used to detect proximity with other users, does not require Internet. However, to check infection chains, to receive alerts, and potentially for additional functionalities, the apps will need to communicate through mobile Internet or Wi-Fi.
How will people be covered who do not have a modern smartphone or do not have a smartphone at all?
Health authorities will continue to operate manual contact tracing, especially for elderly and disabled persons. These manual contacts will be more focused and efficient as the applications will allow to cover most of the rest of the population.
Will personal data be shared between Member States?
The Commission is working with Member States on a privacy preserving interoperability protocol. If one Member State’s app is to work in another Member State, some encrypted data will be shared with the server processing data collected by the app in that other Member State. These servers should be under the control of the competent national authority. Each app must be fully compliant with the EU data protection and privacy rules, and should follow the Commission guidance.
