This post is part of a series on contact tracing apps. You can read our introduction to the series here and get links to the other entries below.
Final validation of the StopCovid app
The French contact tracing app StopCovid was tested in laboratory and real-life conditions between 11 and 21 May 2020.
The tests found that, within a radius of one metre for 15 minutes (ie the conditions in which COVID-19 can be transmitted according to epidemiologists), the StopCovid app detects 75 to 80 per cent of users, even in an underground rail system.
Following those tests, on 25 May 2020 the French data protection authority, the Commission Nationale Informatique et Libertés (CNIL), issued its opinion on the final version of the StopCovid app and the draft decree related to this app.
This complements its first opinion of 24 April 2020 on the principle of a contact tracing app, in which it found that the StopCovid app could be rolled-out if certain guarantees are provided (most notably temporary and voluntary use).
In this opinion, it found that the StopCovid app is proportionate to the objective of fighting the spread of COVID-19, given the seriousness of the crisis, its usefulness to complement the contact case tracking process conducted by the French health administration to identify people that are or may have been infected and identify people who have been in contact with them and in view of the guarantees provided to its users.
Indeed, the StopCovid app can only be used on a voluntary basis and for no more than six months. And it now guarantees pseudonymisation of the data collected, has a modified encryption algorithm, offers more security guarantees and has transparent functionality (ie the source code of the app has been published and a control committee, made up of digital, ethical and health experts, will have full access to the operation of the server on which the data collected by the app will be stored and will be able to carry out all the necessary audits to check how the app operates).
On this basis, the CNIL has given the green light to the roll-out of the StopCovid app on several conditions, which include ensuring that there is a right to oppose and delete the pseudonymised data stored, improving user information on the app's conditions of use and data deletion, and providing specific information to juveniles.
Following this second opinion, the French Parliament voted in favour of the release of the StopCovid app on 27 and 28 May 2020.
Legal framework and conditions of use of the app
The government published a decree on 29 May 2020 that provides a legal basis for the app. The decree defines the following purposes for the processing:
- informing a contact of a risk of contamination;
- raising awareness of COVID-19 symptoms and how to prevent the spread of the virus;
- directing contacts at risk of contamination to the right health entities; and
- adapting the parameters enabling the identification of the risk contacts based on the use of anonymised statistics at national level.
The decree also appoints France's health ministry as the data controller.
What should users do when they receive an alert?
If the app alerts the user that they have been in contact with someone who has tested COVID-19 positive, it will recommend that the user isolate themselves and contact their doctor to prescribe a test.
From this point on, the patient will enter the classic contact case tracking process set up by the French health administration.
If the test result is positive, a code (a sequence of characters or QR code) will be given to the patient so that they can report it in the app and the StopCovid users they have been in contact with will in turn receive an alert on their phones.
The decree provides that only users who have tested positive will be able to report themselves as COVID-19 positive in the app. In any case, users remain free to report - or not - a positive COVID-19 test result in the app, and free to activate and share their history of proximity with risk contacts with the central data server, so that these contacts can be informed that they have been in contact with a person that has tested positive for COVID-19.
Pseudonymised data on contacts that are at risk of contamination is stored on the central server for 15 days, but the data stored does not include data on the persons that have tested positive.
The data processing relating to the StopCovid app lasts for no more than six months after the end of the health emergency period (ie six months after 10 July 2020).
Release of the app and remaining questions
The StopCovid app was released on 2 June and has been downloaded by 1 million users so far. It remains to be seen whether its use will spread.
According to experts, even if 60 per cent of the population must use the app for it to be effective, the app could still have a systemic effectiveness if only 10 per cent of the workforce uses it.
Will the app be interoperable with other European apps?
A question remains over the interoperability of StopCovid with other European apps.
Indeed, European countries have followed two different approaches to the architecture of contact tracing apps: a 'centralised' approach followed by countries such as France and a 'decentralised' approach (followed in Switzerland for example).
While the apps do not seem to be compatible with each other for now, EU member states are working on making the centralised and decentralised contact tracing apps interoperable.
What about those who do not have a smartphone?
To help protect people who don't have a smartphone, private companies are working on connected objects (such as a watch) capable of using the StopCovid app protocol.
Other posts in this series:
- Round 1: What’s happening?
- Round 2: Legal considerations for companies that want to use contact tracing
- Round 3: Are companies required to use contact tracing?
