How contact tracing and warning apps helped during the COVID-19 pandemic

COVID-19 contact tracing and warning apps

COVID-19 was fought in the digital age. The nature of the coronavirus and need for inducing behavioural change pushed us towards social engagement tools to empower and motivate people take measures and combat the virus together. In the early months of the pandemic the digital community started harnessing the potential of new trustworthy technologies (such as Bluetooth proximity technology) to monitor and mitigate the pandemic, facilitate the organisation of medical follow-up of patients, and provide direct guidance to citizens on playing their part in controlling the disease.

22 public health authorities launched national tracing and warning apps as part of a package of measures to prevent the spread of the coronavirus. These voluntary, privacy-preserving, and secure apps offer the possibility of alerting and warning citizens that they have been in close proximity with an individual who tested positive for COVID-19. Contact tracing and warning apps have been an effective tool to help break the chain of infections, nationally and across borders, and to save lives by complementing well-known manual contact tracing.

In October 2020, European countries and the European Commission set up a new service, the European Federation Gateway, to allow national apps to talk to each other and make them interoperable throughout the Union. This meant that Europeans could keep using their national apps even when crossing borders and benefit from full interoperability, secured transmission, and minimised information exchanged across the Union. This service was developed and deployed in a record time, within six months after the first COVID-19 outbreaks in Europe, and it is a great example of European cooperation.

In autumn 2021, at the peak of its success, 19 European countries were exchanging risk contact information through the European Gateway, representing a total number of approximately 206 million unique voluntary downloads, representing tens of millions of active users in Europe and the EU. 

Highlights - European Federation Gateway Service

These contact tracing and warning apps were only used voluntarily, fully respected users’ privacy, and did not allow the tracking of people’s locations.

From their initial set-up, the national apps and the European Gateway were designed to be dismantled once the COVID-19 pandemic was over or the national governments stopped using the service. Several countries passed temporary acts or amended already existing legislation (e.g. data protection, new pandemic laws etc.) to deploy the contact tracing apps. This, together with the favourable evolution of the pandemic, explains why the European countries started to disconnect from the European Gateway as from the end of 2021, either because European countries stopped deploying the national app or the ad hoc legislation ended.

In April 2022, the European Gateway was successfully transferred to the European Centre for Disease Prevention and Control (ECDC). This enabled the EU to reinforce the digital contact tracing capabilities, in line with the ECDC’s new mandate, by pooling the necessary expertise at the ECDC.

By February 2023, all remaining countries participating in the European Gateway offboarded from the system. The European Gateway was subsequently retired. ECDC and Commission have foreseen a reactivation procedure to make the European Gateway available to EU Member States, should the need arise.

Mobile contact tracing apps in the EU - a model for the future?

In December 2022, the European Commission published a study providing an overview of the approach and lessons learned on cross-border interoperability, coordination, implementation and the epidemiological impact of COVID-19 digital contact tracing apps.

There is strong agreement among Member States that EU cooperation through the different working groups on digital contact tracing has helped reducing the burden of cross-border infection detection. Furthermore, it provided technical assistance, peer support, and valuable insights, resulting in the reduction of implementation and operation costs of several national apps.

The efforts related to digital contact tracing demonstrated Europe’s ability to swiftly agree on and deliver an innovative and emerging technology to millions of users in a privacy-preserving manner, enabled by effective coordination and collaboration between participating countries.

Achievements

The tracing and warning apps were adopted at a considerable scale in a voluntary manner and have been downloaded more than 206 million times between 2020 and July 2022, representing tens of millions of active users. Developers and European countries created dedicated websites and promotional material together with awareness campaigns to boost the uptake. 

Changes in the epidemiological situation, different infection waves, and new more contagious virus variants steered the keys traffic through the European Federation Gateway Service with an absolute peak of over 700 thousand keys uploaded on a single day in March 2022.

* Across 7 countries: Finland, Ireland, Germany, Iceland, France, Switzerland, Netherlands
** Across 6 countries: Finland, Ireland, Germany, Iceland, France, Switzerland

Protecting users’ personal data  

In April 2020, The European Commission published an EU toolbox on contact tracing and warning apps, as well as guidance on data protection. These resources defined a series of guiding principles for these apps:

• contact tracing and warning Apps should only be voluntarily installed and used
• the data minimisation principle: only data which that is strictly necessary for the running of the service is collected, nothing more
• apps should use proximity data based on Bluetooth technology
• no location data is requested or utilized by the tracing app
• contact tracing and warning apps do not track people's movements
• the data should not be stored longer than necessary – 14 days
• data should be protected through state-of-the art methods, including encryption
• the applications should be de-activated as soon as the pandemic is over

Health data is considered sensitive data under the General Data Protection Regulation (GDPR) (Article 9) and their processing can therefore only take place under strict requirements. Aggregated statistical data on the use of contact tracing apps that does not enable identification of the concerned natural persons are not considered personal data and therefore the GDPR does not apply.

Background information

On 8 April 2020, the Commission adopted a recommendation to support the gradual lifting of coronavirus containment measures through mobile data and apps, with key principles for the use of mobile applications used for social distancing measures, warning, preventing and contact tracing. Any use of apps and data should respect data security and EU fundamental rights, such as privacy and data protection.

On 16 April 2020, Member States in the eHealth Network, supported by the Commission, adopted an EU toolbox on contact tracing applications in the EU’s fight against COVID-19, setting out the foundations of a common pan-European approach to contact tracing and warning apps. The eHealth Network adopted the interoperability guidelines on 13 May, detailing the interoperability needs at different stages of the digital contact tracing flow.

Building on the previous work, the eHealth Network adopted in June 2020 the technical specifications and guidelines, which set out the architecture for a European Federation Gateway Service that would allow the exchange of contact tracing keys between Member States. This Federation gateway enabled citizens to travel within the countries that joined the Federation gateway with only one contact tracing app. The modalities for processing personal data in the Federation gateway were adopted in July 2020 with the amendment of the Implementing Decision on the eHealth Network.

The development and deployment of the Federation gateway was completed by end of September 2020, just six months after the first outbreaks in Europe. After this, Member States started to gradually connect to the system. At its peak, the Federation gateway connected 19 countries. By February 2023, all remaining countries participating in the European gateway offboarded from the system, and it was subsequently retired.