They open two sanctioning procedures against Radar Covid for lack of compliance in data protection


Rodrigo alonso




The Spanish Agency for Data Protection (AEPD) has opened two sanctioning processes -one to the General Directorate of Public Health and another to the Ministry of Economic Affairs and Digital Transformation- for a possible violation of the General Data Protection Regulation (RGPD) in the coronavirus tracking app, Radar Covid. This measure comes after the presentation of claims filed by the NGO Rights International Spain and Pau Enseñat, executive director of the Reclamadatos platform, in which it is argued that the Government did not share the necessary information – and in the appropriate deadlines – about the development of the application based on European guidelines, including the impact evaluation of the tool and the history of its source code.

In the document sent by the AEPD to the plaintiffs, to which ABC has had access, the agency maintains that “based on the preliminary information available, there are rational indications of a possible violation of the regulations in terms of data protection, without prejudice to what is determined in the course of the processing “.

In the first lawsuit, presented by Enseñat in September 2020, the AEPD was asked to analyze whether Radar Covid complied “with the principles of legality, loyalty, transparency and proactive responsibility (Art.5 RGPD), since the SGAD (Secretariat General de Administración Digital) had not published the Impact Assessment on Data Protection (EIPD), contrary to what was expressly indicated by the European Data Protection Committee ».

It should be remembered that, with the arrival of tracking applications, the European Data Protection Committee shared a series of guidelines for their proper development and implementation. These include the impact assessment of the tools “relating to data protection before their deployment”. Something that would limit the risks of possible privacy failures at the time they were available. As highlighted in conversation with this newspaper the lawyer Sergio Carrasco, in charge of strategic litigation on behalf of Rights International Spain, this study was not done at the right time in the case of Radar Covid.

“We made some requests for information about Radar Covid, because documentation was missing at the beginning of the year, such as the impact assessment. When they hung up, we realized that the data corresponded to the month of January 2021, long after the launch of the application. About a month ago they shared with us what is supposed to be the first impact assessment, which corresponds to August 2020, when the application could already be downloaded since the La Gomera pilot test started in June of last year », he explains Carrasco. “An impact assessment and risk analysis is done to later develop the application, not when it is already available for download,” says the expert.

In the lawsuits filed by Rights International, they also denounce “irregularities regarding the publication of the application code». In this sense, attention is drawn to the fact that, despite the fact that Radar Covid could be downloaded since June, although it was not operational, the Government did not publish the source code of the tool, with which its operation and operation can be verified. the use you make of the data, until September 9, 2020. And, in addition, it was incompletely done. To date, the history since the beginning of development has not been made public, so it is not known if the ‘app’ registered any problem that put at risk the data of the users who downloaded it last summer.

The AEPD has informed the complainants that the sanctioning process will have a maximum duration of nine months; so, possibly, no action will be taken against the Ministry of Economic Affairs and the General Directorate of Public Health until February next year. Be that as it may, in no case will it imply an economic sanction, only a warning. “Unfortunately, article 77 of the Organic Law says that in the case of public entities the financial sanction is replaced by a warning,” explains Carrasco.

Covid radar: a resounding failure

Despite the realization of a promising pilot in La Gomera last summer – in which the tool was more effective than human tracers according to the Secretary of State for Digitalization and Artificial Intelligence – Radar Covid has not managed to convince the Spanish. Not even close. This is demonstrated by the fact that, almost a year after it began to populate the application stores of devices manufactured by Apple and Google, it has less than seven and a half million downloads and has been used to report 64,031 positives.

Experts consulted by this newspaper over the last few months have drawn attention to the government’s lack of transparency as one of the main reasons for the failure of the tracking tool. “The lack of transparency has caused a lack of trust on the part of the citizen. On the other hand, the fragmentation we have had, and the stumbling blocks in development, has meant that the tool took a long time to be functional and that when it began to be functional, people chose not to install it, ”says the lawyer from Rights International Spain.

See them

Leave a Reply

Your email address will not be published.