Covid-19 and Contact Tracing

While France is entering the first phase of its end-of-lockdown plan, the Government’s strategy to combat a resumption of the epidemic is now based on monitoring “contact tracing”, i.e. the swift identification of any person who has been close to a patient in order to also test him/her and, if necessary, isolate him/her to avoid the spread of the disease.

French authorities are planning an “information system” based on two medical databases: Sidep and Contact Covid. As the design of the StopCovid app. is still under way, its deployment was not included in the end-of-lockdown plan presented on April 28, 2020.

StopCovid is a mobile app. project launched by the French government and led by the National Institute for Research in Digital Science and Technology (Institut National de Recherche en Informatique et en Automatique or “INRIA”) with the objective of tracking populations, using the Bluetooth system of phones.

The controversial StopCovid digital tracking app. could be ready in early June, which would then pave the way for a debate on the subject in the French Parliament.

Following the exceptional Council of Ministers meeting on Saturday May 2, 2020, the Health Minister announced that contact tracing of people tested positive for Covid-19 will (for the time being) not be done through a phone app.:

“As of May 11, no, there will not be a StopCovid app. available in our country and the Prime Minister was very clear: if this type of app. were to be introduced, there would be a specific debate in Parliament, nothing has changed from that point of view.”

Following a request from the Minister of State for the Digital Sector on the possible implementation of this app., the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés or “CNIL”) issued its opinion on April 24, 2020^[1].

It considered that the system could comply with the General Data Protection Regulation (“GDPR”) if certain conditions were met.

Insofar as the use of the app., as envisaged by the Government, is voluntary, the CNIL specified that this implies that there would be no negative consequences for those who do not use it, in particular regarding the access to tests and healthcare, or public transportation.

The CNIL considers that the app. can be deployed if its usefulness for crisis management is sufficiently established and if certain safeguards are provided. In particular, the use of the app. must be temporary and the data must be kept for a limited period of time.

Finally, the CNIL considered that the use of a voluntary contact monitoring scheme to manage the current health crisis should have an explicit legal basis in national law. It asked the Government to refer the app. project and the standard governing its implementation back to it once the decision has been taken and the project further specified.

In the meantime, the Government has chosen to set up an official tracing system to enable the National Healthcare Insurance Fund or the Regional Health Agencies, hospital and city doctors to access a maximum of information on the status of the epidemic in France.

In practical terms, the Bill extending the state of health emergency^[2] provides for the creation of “health brigades” which will be responsible for recording positive Covid-19 cases and contact cases to detect chains of transmission.

Three levels of tracing are planned:

• Level 1 tracing carried out by doctors, primary healthcare professionals in cities and hospitals, to define the first circle of cases, potential contacts of patients;

• Level 2 tracing organized by the National Healthcare Insurance Fund. It aims at enhancing the list of potential contacts beyond this first circle, verifying that no potentially infected person has been able to escape the first tracing and giving instructions to the persons concerned;

• Level 3 tracing organized by the Regional Health Agencies. The aim is to identify chains of contamination of chains of transmission, which were at one time called “clusters”.

These data will then be compiled in two national data files: Sidep and Contact Covid^[3].

Sidep will list all persons tested positive for SARS-CoV-2 by medical biology laboratories.

The Contact Covid database, inspired by the National Healthcare Insurance Fund’s website, will notably provide the contact details of the people to be contacted.

Specifically, the Bill provides that “for the sole purpose of combating the spread of the Covid-19 epidemic and for the period of time strictly necessary for that purpose or, at most, for a period of six months from the end of the state of health emergency declared by article 4 of Emergency Law No. 2020-290 of March 23, 2020 to deal with the covid-19 epidemic, personal health data relating to persons infected by this virus and to persons who have been in contact with them may be processed and shared, as the case may be without the consent of the persons concerned, within the framework of an information system set up by a Governmental Decree approved by the Council of State and implemented by the Health Minister.”

The purposes of the data files is the identification of infected persons, the identification of persons at risk of infection, the referral of infected persons and those likely to be infected, depending on their situation, to prophylactic isolation medical prescriptions, as well as the support of these persons during and after the end of these measures, and epidemiological monitoring at national and local levels, as well as research on the virus and the means of combating its spread. The development or deployment of a computer application intended for the public and available on mobile equipment to inform persons of the fact that they have been in close proximity to persons diagnosed with Covid-19 is explicitly excluded from the above-mentioned purposes.

Personal data collected by these information systems for these purposes may not be kept after the end of a 3-month period from their collection.

Personal data concerning health shall be strictly limited to the virological or serological status of the person with regard to the Covid-19 and to evidence of clinical diagnosis and medical imaging, as specified by the aforementioned Governmental Decree to be approved by the Council of State.

The terms and conditions according to which the Bill will be applied concerning the creation of these data files must be laid down within the next few days by Governmental Decrees approved by the Council of State following the positive opinion from the CNIL.

[1] https://www.cnil.fr/en/publication-cnils-opinion-stopcovid-mobile-application-project

[2] Legislative package on the extension of the state of health emergency: http://www.assemblee-nationale.fr/dyn/15/dossiers/prorogation_etat_urgence_sanitaire

[3] Description of the data files of the Ministry for Solidarity and Health: https://solidarites-sante.gouv.fr/soins-et-maladies/maladies/maladies-infectieuses/coronavirus/tout-savoir-sur-le-covid-19/article/contact-covid-si-dep