(May 6, 2020) On April 16, 2020, the Norwegian government launched a smartphone app to track the spread of the coronavirus in Norway. By downloading the app, users voluntarily allow the app to track their physical location and notify them if they have been in close proximity to a person who later becomes infected with COVID-19.
As of April 17, 2020, the day after the app was launched, close to 1 million people (one-fifth of the total Norwegian population) were reported as having downloaded the app. As of April 30, 2020, the Norwegian Public Health Agency (Folkehelseinstituttet, FHI) had reported that almost 900,000 Norwegians actively use the app (about 20.5% of the population aged 16 and above). The app was developed by the research institute Simula following a request by the FHI and is available from the Google Play and iApp stores.
Specifics of the App
The app collects data on contact tracing, registering the user’s location via GPS and Bluetooth. Information is stored for 30 days, and people using the app are notified if they have been within 2 meters (about 6 feet) for at least 15 minutes within a 24-hour period of another user who later develops COVID-19.
By regulation, the information may be stored only for 30 days (§ 6.) However, information that is used to trace contacts—that is, information on persons who have contracted COVID-19—may be stored for longer than the 30 days. (Forskrift om digital smittesporing og epidemikontroll i anledning utbrudd av Covid-19 (FOR-2020-03-27-475.)
According to the FHI, as of April 27, 2020, users of the app have been able to receive a text message if they have been close to another user who has been diagnosed with COVID-19, but as of April 28, 2020, no notifications had been sent.
Privacy Concerns
On April 27, 2020, the Norwegian Data Protection Authority (Datatilsynet) announced that it was starting an investigation into the use of the Smittestop app because the central registration and collection of the user’s location data may be an infringement of privacy. The Data Protection Authority explained that the purpose of the investigation is to ensure that the app complies with the Norwegian regulation on tracing and epidemic contagion related to COVID-19 (FOR 2020-03-27-475). The regulation was adopted in March 2020, giving the FHI power to establish a system for tracking COVID-19 infections. (§ 2.) The regulation requires that the system be voluntary and include “comprehensive, understandable and easily accessible information, including the processing of personal data.”
There have also been international concerns that the current design of the app is problematic in relation to the international framework for collecting personal data, even though using the app is voluntary. Specifically, the European Data Protection Board, which oversees compliance with the General Data Protection Regulation and the Data Protection Law Enforcement Directive, has voiced concerns that apps that collect and store information in the way the Norwegian app does violate those privacy protections.
On the other hand, the app has also been criticized by IT experts for not collecting and sharing enough data—specifically the app’s establishment of a 15-minute contact requirement for information sharing—arguing that contact for shorter intervals of time may also result in the spread of COVID-19, and that such information must be recorded in order to better develop the app.
As of May 4, 2020, the FHI had reported 7,847 confirmed cases of COVID-19 and 208 fatalities in Norway.