Norway's public health body (FHI) has suspended the use of its coronavirus contact-tracing app following an order by the country's data protection authority over the collection and use of users’ location data. The FHI has also deleted all information collected so far by the app.
The Norwegian privacy regulator Datailsynet expressed concerns with the way the app, called Smittestopp, collected both GPS location data and Bluetooth data from users. Its assessment said the app “can no longer be regarded as a proportionate intervention on users' basic privacy rights.”
In a statement, the watchdog said “we believe that FHI has not demonstrated that it is strictly necessary to use location data for infection detection” and recommended that the app only used data collected via Bluetooth instead, pointing out “EU countries have developed infection tracking apps based only on Bluetooth technology, and not GPS location data as well.”
What the numbers say: According to Johns Hopkins University, there have been 8,639 confirmed cases of Covid-19 and 242 deaths in Norway.
The app was being tested in three regions of the country, but as the rate of infection in those areas is low, the health authority had said last week it was difficult to test whether the Smittestopp app was notifying “those who may actually have been exposed to infection”.
The watchdog also questioned the “lack of freedom of choice for users” signing up to the app.
According to Datailsynet, the data required for tracking infections was also being used for analysis and research, which the regulator said are two different purposes and requires “different personal information.”
There were also concerns raised about how data collected remained anonymous. “A solution for anonymization and aggregation of data for analysis is also not in place,” said Bjørn Erik Thon, Director of Datailsynet in a statement. “Still, the app continuously collects personal information from all users,” added Thon.
The FHI disagreed with the assessment of the regulator.
In a statement FHI Director Camilla Stoltenberg said that suspending the app would weaken “an important part of our preparedness for increased spread of infection, because we are losing time in developing and testing the app.” Stoltenberg warned that the pandemic is not over, adding “without the Smittestopp app, we would be poorly equipped to prevent new outbreaks that may occur locally or nationally.”
Stoltenberg added: “We hope it will be possible to find a solution so that infection notification and analysis of infection control measures can be introduced in the long term.”
The FHI has until the June 23 to remedy the issues raised by the regulator.