Bonn/Berlin, 16 June 2020
Press release 12/2020
Sufficient data protection in the Corona warning app
On 16 June, the Federal Commissioner for Data Protection and Freedom of Information (BfDI), Professor Ulrich Kelber, commented on the Corona warning app. The BfDI had accompanied the development process in an advisory manner: From a data protection perspective, I see no reason against an installation. But there are still weak points. Concerning these weak points, the responsible authorities and companies must make adjustments. As the competent supervisory authority, we will verify that our advice will be implemented as soon as possible.
For Professor Kelber, documents on data protection are crucial for the launch of the app: It is important to me that, in addition to the source code, the data protection impact assessment has been made publicly available. The more transparent the whole project is, the more trust the citizens will have.
The BfDI calls for adjustments, particularly in one area:
The media discontinuity, that means the switch from the app to the telephone hotline, is not a good solution. In our view, the reasons why a hotline is being set up are admittedly plausible. It is clear, however, that the route via the hotline cannot keep up with a completely pseudonymous use of the app via the automated procedure.
Through in-depth consultation, the BfDI has averted the inappropriate storage of personal data of all callers on the hotline. The Robert Koch Institute and the Ministry of Health now have to create the necessary conditions as quickly as possible for the automated process to be used by as many app users as possible.
When dealing with the app, there is an important limit for the BfDI: It is under no circumstances permissible for third parties to request insight into the app. I can only urgently warn the owners of shops or public transport services: Don't even try that at all!
With the start of the app, the BfDI assumes the supervision of its operation. Therefore, all possibilities provided by the General Data Protection Regulation are available to the authority: This means that the BfDI’s office performs checks and controls within the framework of its data protection supervision. And – if shortcomings occur – it will intervene.