In 2020, governments throughout Europe turned to new technologies to help stop the spread of COVID-19. As this marked the first time most European governments introduced smartphone applications for the common good (in this case, protecting public health), it helped crystallize our understanding of what is and is not legitimate to do.

Concerned citizens and human rights watchdogs need to make sure that we do not end up in a future where the common good justifies all sorts of intrusions into our private lives. We also need to warn governments against pushing out untested technological solutions for political gain. We need to remind them that governmental measures (launching and operating apps included) need to be accompanied by due assessment of the possible effects, both in terms of potential human rights violations and in terms of other social costs.

In order to contribute to such efforts, the Civil Liberties Union for Europe (Liberties) has been coordinating extensive research on EU member states’ tech responses to the pandemic. Liberties has already published a study on the early technological responses to the coronavirus pandemic in Europe. Now, with our members and partners, we are preparing our next study on contact tracing apps in 10 countries in Europe, focusing on questions like:

• how different centralized and decentralized contact tracing apps work;
• what kind of data they collect and how are those data processed;
• how efficient these apps are;
• how transparently they operate;
• how the apps could worsen existing social problems (exclusion, discrimination);
• how the launch and the operation of these apps fit to our concept of responsible governance.

National-level report: Spain

The English-language version of the study, containing 10 country reports and a policy brief on the lessons to be learned, will be published here, on Liberties’ webpage, in September. Some of our members, however, decided for an earlier national launch.

You can read the first of the published country reports, written by Liberties’ Spanish member, Rights International Spain (RIS), here (in Spanish).

According to RIS, in order to understand the peculiarity of the Spanish case, one needs to be familiar to the institutional framework. In Spain, health competences are transferred to the seventeen autonomous communities and two autonomous cities. RIS argues that this circumstance, together with the lack of coordination between these bodies in decision-making processes, has led to a series of delays and significantly affected the efficiency of the digital contact tracing system. For example, significant divergences have been detected in critical elements such as the criteria for providing a code to those who tested positive to type into the app. This made it difficult to carry out general awareness campaigns and facilitate citizens' request for the necessary codes and in turn, negatively affected the general efficiency of the app.

During their research, RIS also found irregularities in the app’s data protection impact assessment and risk analysis. The Spanish Data Protection Agency was informed about the potential data protection infringements.