12.06.2020 - After reviewing the NCSC report on Risk Estimation Proximity Tracing published today, the FDPIC has confirmed his assessment that the Swiss proximity tracing system operated by the Federal Office of Public Health and the SwissCovid app are data protection compliant.
Update Proximity Tracing App: technical security of the SwissCovid app confirmed
The FDPIC is aware of the widespread criticism of Google and Apple’s failure to disclose the API (application programming interface) for the SwissCovid app. The situation, however, is not new. The data protection impact assessment of 1 May 2020 and the report from the National Cyber Security Centre (NCSC) of 28 May 2020, which is published today, also make reference to this lack of disclosure.
The SwissCovid app is based on globally standardised interfaces and their underlying operating systems. The source code for the operating systems and the interfaces is partially available in some cases or not available at all. This issue is known and is not specific to the SwissCovid app.
In the FDPIC’s opinion, when compared to other everyday uses that public makes of the smart devices offered by these two manufacturers, the use of the Google and Apple APIs for the SwissCovid app does not represent a significantly greater risk to their personal data. Anyone who assumes that Google and Apple, regardless of their legal responsibilities and the reputational risks, would disregard the restrictions on use they have promised for the SwissCovid app, should be aware of the following: the use of the SwissCovid app would have to be based on Google or Apple operating systems and their general Bluetooth interfaces even if their proximity tracing API were not used.
In order to be consistent, anyone who mistrusts these manufacturers whatever they may do would have to refrain from using not only the SwissCovid app, whatever its design, but also any other smart devices or operating systems offered by Apple and Google. This option always remains open.
For further information, we would refer you to the full text of our assessment:
Last modification 25.05.2023