In the fight against the pandemic the use of so-called COVID-19 apps has triggered a lively debate. This contribution analyses different types of COVID-19 apps and their legal implications, focusing in particular on aspects of data protection law. It demonstrates why – at least with regard to proximity tracing and fully decentralised designs such as the DP-3T design – the public uproar is completely unfounded and irrational, rejecting a measure that is so privacy-friendly that it may not even get into the scope of the GDPR, at the price of forcing public and private parties to use much more intrusive methods of contract tracing. The contribution closes by explaining why, paradoxically, it may precisely be the privacy-friendliness of the app and the voluntariness of its use that makes it rather ineffective as a means to fight the pandemic, which in turn has implications for its assessment, as remaining dangers of “function creep” suddenly seem to prevail.

INTRODUCTION

The COVID-19 pandemic has led to a digital boost for Europe. Almost everything that used to require physical presence is suddenly being done remotely and with digital means, ranging from school teaching to conferences to court trials. It does therefore not come as a surprise that the fight against the pandemic itself is being fought with digital means. Among these digital means, the use of so-called COVID-19 apps – i.e. mobile applications to be used by the broad population – has triggered a lively debate. The debate has not just been lively, but surprisingly emotional. While hardly anyone seems to worry about the many thousands of mobile applications used for collecting our data, accessing our cameras, microphones and messages, and possibly disclosing the most sensitive data or any inferences to unknown third parties, COVID-19 apps caused a public uproar in some places. In Austria, for example, a range of political parties agreed to some overdue and innocuous clarifications in the Epidemic Law only under the condition that the use of contact tracing technologies was explicitly prohibited. For some experts, this does still not go far enough, and they are calling for a new law that forever guarantees absolute voluntariness of contact tracing apps. So are contact tracing apps now the decisive step into George Orwell’s 1984, which data protection lawyers must put a halt to?