The position of the National Commission on Information Technology and Freedoms on the mobile tracking app

The French government's plan to de-confer itself goes hand in hand with the deployment of an application whose name is no longer a secret.

While the French government believes that mobile tracing is a solution to stem the spread of the virus, the project has already caused uproar among the class of computer security experts and human rights defenders.

This article will also interest you: Digital Tracing and Covid-19: the risk of cyber-malveillance to be taken into account

On the side of the independent data management regulator (CNIL), it gives its favourable opinion for the deployment of StopCoviD. However, this notice was given under very strict conditions. This clearly reflects the Commission's mistrust of this deployment.

The Commission for Information Technology and Freedoms did not fail to raise the famous principles of respect for privacy and privacy. The condition for it to give its credit to the deployment of StopCoviD is for the government to ensure compliance with these principles."Collecting lists of people who have been visited is a strong attack, which can only be justified if necessary by the need to respond to another constitutional principle, namely the protection of health," the independent administrative authority said at the time. And in other words, the right to health in this case, will take precedence over the right to privacy for now. But the government should do its utmost to avoid overflowing.

Moreover, what was promoted was of course the anonymity of the people involved in this process. In this way, the data that will be collected will not be able to directly identify users, so their information will have to be associated with unique and temporary identifiers. The National Commission for Computer Science and Freedom also highlights the obligation for the French state to "provide adequate guarantees that are all the stronger because technologies are intrusive". Because the very nature of the data they will be collected requires it.

On the other hand, the administrative authority welcomed the principle of volunteerism that covers the use of the StopCoviD application. However, it insists on making the terms explaining this principle more explicit. In addition, those who have chosen not to install the application should not be sanctioned in any way. For example, conditioning the tests on CoviD-19, access to public transit, or issuing certificates from at the installation of the application. Above all, the commission requires the automatic deletion of all data collected once the emergency is passed except in an exceptional setting, within a very limited time frame for statistical definition or global study needs, with the obligation to make all the credentials anonymous. Beyond that, this information should be "deleted as soon as the usefulness of the application is no longer proven."

Moreover, the administrative authority has not failed to reveal a very obvious reality. The deployment of the application alone will not be enough to manage the conference. "While this type of device can potentially help public authorities monitor and contain the COVID-19 pandemic, by complementing traditional contact search methods used to contain the spread of epidemics, it still has limitations." And these limits can clearly be envisaged. Indeed, the application must be able to be downloadable from as many app stores as possible. In addition, several users must download it and agree to use it as described.While "a significant portion of the population does not have adequate mobile equipment or may have difficulty installing and using the app," which are generally the "most vulnerable to disease" or "younger people without a phone," the CNIL explains.

Therefore, the National Commission for Information Technology and Freedoms encourages the state not to rush too much into developing this perspective. By necessarily wanting to find the easiest solution, it is clear that every effort must also be made to prevent further problems in the future.

Now access an unlimited number of passwords: