Latvia introduces a privacy-conscious app with contact-detecting features

In May 29th, 2020, a new app called “Apturi Covid” (Stop Covid – in English) was launched in Latvia. The app is available for devices with iOS or Android operating systems. The technical solution involves activation of Bluetooth Low Energy that under certain circumstances (a distance of less than 2 metres between two users, duration of a contact for at least 15 minutes, both users have downloaded and activated the app on their devices) establishes a contact between two devices. A person infected with COVID-19 infection obtains a unique code from the Centre for Disease Prevention and Control (CDPC) and activates it in the app. When the contact of two devices is established and if one of the users has activated this unique code, a person who has been in contact with the infected person receives a notification about the possible infection risk. Information about possible contacts is saved only in the app and is erased automatically after 14 days.

The data controller for the data processed by the app is the CDPC which processes the following data: a date of the contact, duration of the contact, strength of the signal and a user’s phone number (the last one is optional). The users do not receive any data regarding other users. If a user has chosen to indicate his contact information (a phone number), the CDPC will contact the user in case there is a notification about the possible infection risk. The user can still insert his phone number, even after he has received a notification, to facilitate the identification of the contacts by the CDCP. If the user does not receive any notification, the CDCP will not receive and process any information about the user.

The use of this app is completely voluntary. So far the app has already helped to identify some of the potential COVID-19 carriers.

The Data State Inspectorate of Latvia has provided support in development of this app and continues to monitor that the rights to privacy are properly ensured. It is a good reminder that no matter what impact COVID-19 is having on conduct of business and society in general any data processing shall comply with the GDPR. 

Businesses shall keep in mind and continue to observe other personal data security measures. Taking into account the increase in the processing of personal data, the introduction of teleworking and specifics related to home office, etc., the data security risks are only increasing. Therefore, pursuing these changing trends, we provide assistance to our clients implementing new data processing policies, identifying problems and finding effective solutions related to data security and compliant processing of personal data.