How it works:

Firstly, the user downloads voluntarily the app approved by the National Health Authority on his/her mobile phone. Then, thanks to the Bluetooth technology, the app will monitor signals from the apps installed by other citizens moving around him/her. It will detect all apps of citizens that have been in proximity for more than 15 minutes and less than 2 meters and keep track of these contacts anonymously for 14 days.

If the user is tested positive for SARS-CoV-2, he/she has the option to enter a code in the app to send this information to the apps of other users that he/she came in contact with. At the end, the user will help people that he/she has encountered, even during his/her trip in another European country, to be informed if they came in contact with the user. At the same time, the user can also receive notifications on the app with instructions on what to do next. In either case, the privacy of the user is fully preserved as no personal data is exchanged or revealed, nor names, locations, profiles, etc.

Technical Information

The contact tracing and warning app informs an app user if he/she has been near a person who has been diagnosed with SARS-CoV-2, for a prolonged period and close enough. This encounter would be considered a high risk exposure.

The app can be voluntarily downloaded by the user on his/her smartphone. The app uses Bluetooth technology to measure the distance and duration of the encounter between people who have installed the app (usually more than 15 minutes within less than 2m). The device produces a random key, which is generated each day for each user who has chosen to use the app. The keys generated by the user’s device during the last 14 days are uploaded on the backend server of the national competent authority. These keys are then sent to the devices of all other app users with whom the user has been in contact with. If people using the app test positive for COVID-19, they are provided a code by the Public Health Authority that they can share in the app, allowing them to inform other users who have been previously in contact with them about the risk of infection, thanks to the exchange of the random keys between devices.

The identity of the user who was tested positive is never revealed to the exposed users, or any other user.

How does it work with the Google and Apple exposure notification feature?

Almost all smartphones used in the EU rely on Android or iOS, the mobile operating systems owned by Google or Apple. Google and Apple have updated their systems with an 'Exposure Notification’ feature that supports a certain type of contact tracing apps. These apps have to be run by public health authorities and are designed to detect potential exposure to the virus using the phone, rather than a central database.

Many Public Health Authorities around the world have decided to design tracing and warning apps that are supported by Android and iOS. Public Health Authorities are in contact with Google and Apple regularly to ensure that any technical problems with apps are quickly resolved.

A recent update on iOS and Android included ‘Exposure Notification Express’ which allows (for a Public Health Authority) a basic exposure notification feature to work on Android 6.0 and iOS smartphones, without the need to install the authority’s custom-built app. No EU country is currently considering using this feature. This does not affect in any way the functioning of the apps.

How does the common EU approach to apps protect personal data?

The apps should be downloaded and activated voluntarily by the users. Personal data are pseudonymised to avoid identifying the personal identity of the user nor his/her geographical location. In addition, MS must ensure short retention period of the data in their back-end server.

How do tracing and warning app work across borders in Europe?

The virus does not stop at borders, and therefore the Commission and Member States are working to ensure that these apps can help break cross-border infection chains by augmenting the information available to manual contact tracing systems, as well as their reach. Member States and the Commission are working on the interoperability of the national Apps, to allow citizens to use one single app in Europe to benefit from the tracing service and be able to report a positive test or to receive an alert.
They have put in place the legal and technical framework to allow the creation of a European Federation Gateway Service (EFGS) for contact tracing and warning applications. The EFGS is a digital infrastructure that allows the national backend servers to exchange information between themselves, while minimising the amount of data exchanged and thus reduce users’ data consumption. The gateway only handles the minimum necessary data, i.e. the randomly-generated keys and associated data, which does not allow for the identification of a user. The information exchanged between national backends is pseudonymised, kept to the minimum necessary, and stored for a maximum period of 14 days in the EFGS, preventing the identification of individual persons and their geographical location.
The Commission has sub-contracted the development and set-up of the gateway to SAP and T-System. The gateway will be operated from the Commission’s data centre in Luxembourg.

How will we know that the apps are working?

Member States are committed to monitoring and evaluating the apps and their contribution to the fight against the pandemic. The Commission, with the European Centre for Disease Prevention and Control, is assisting Member States to identify a series of assessment criteria to evaluate the effectiveness of the apps. Some of those criteria could include, for example, the uptake of the app as a percentage of population and number of users notified of potential exposure.

Key messages

· Tracing and warning apps can help break the transmission chain of coronavirus infections and save lives by complementing manual tracing and subsequently help reduce the spread of the virus.

· The virus does not stop at borders, and therefore the Commission and Member States are working together to ensure that these apps can help break cross-border infection chains by augmenting the information available to manual contact tracing systems, as well as their reach.

· The contact tracing and warning app informs an app user if he/she has been near a person for a prolonged period who has been diagnosed with COVID-19.

· Users have the control over the use of tracing and warning Apps: their use is promoted on a voluntary basis; the user has to enter a code in the system if she/he has been tested positive for SARS-CoV-2; users have to activate the Bluetooth system in order for the app to detect proximity with other users.

· Users’ personal data are protected: only pseudonymised and data are transferred between Apps and between Apps and national backends. Data exchanged in the EFGS are kept to the minimum necessary, and only stored for 14 days in the gateway.

· The Member States and the Commission coordinate efforts to allow the cross-border interoperability of the national Apps and allow citizens to use one single App able to receive exposure notifications and to communicate positive tests wherever they are in Europe.

· The Commission has created a common digital infrastructure to ensure information communication between national application servers, called EFGS. Some of the Member States that have already implemented this application are Germany, Belgium, Slovakia and Latvia.

We are closely monitoring the effectiveness of the apps in contributing to the fight against the pandemic.