Contact tracing: operators of the app Social Pass implement recommendations of the Edoeb
The operators of the contact tracing app "Social Pass" are implementing - after tough negotiations - the key recommendations of the Federal Data Protection and Information Commissioner (Edoeb).
The Social Pass application is used by hospitality businesses throughout Switzerland and is used to carry out the mandatory "contact tracing" required to combat Covid 19. It consists of the three system components "Social Pass", "Social Scan" and a central database: With the mobile app Social Pass (available for Android and iOS), customers record their contact data on their smartphone. When they visit a restaurant, they scan the QR code of the host establishment. The contact data, enriched with the details of the restaurant, is then automatically sent to a central database and stored there.
Unusually protracted negotiations
Besides the Identification of organizational and technical deficiencies a fact-finding investigation by the Federal Data Protection and Information Commissioner (Edoeb) revealed that the private operators granted the health authorities of the cantons of Vaud and Valais direct access to the central database and, despite a lack of justification, made it available for almost any personal queries, thereby also violating the principle of proportionality. According to media reports, the query options granted in the canton of Valais are said to have led to the processing of personal data for purposes other than those for which they were intended. On the recommendation of Edoeb, the operators have since acknowledged these deficiencies, which were still disputed in April 2021, and have also corrected them, according to their own statements.
Other recommendations concerned the completeness of information provided to users, the export of telephone numbers to the USA as part of number verification, and the configuration of the Microsoft Azure platform on which the central database is located. These recommendations were only partially acknowledged and only partially implemented. Edoeb reserves the right to carry out follow-up checks and, if necessary, to bring an action before the Federal Administrative Court.
Source: Edoeb
