Contact tracing apps under EU personal data protection law (cepAdhoc)

Apps that only record epidemiologically relevant contacts (proximity recording apps) are a more data protection-friendly alternative to location data recording apps. While proximity recording apps can work without personal data, so that the related data processing falls out of the scope of the General Data Protection Regulation, the e-Privacy Directive inevitably applies. This directive requires the previous consent of the user for the app to store information on his smartphone or to access information already stored on his smartphone. The necessity of the user's consent for the full functioning of the app rules out that Member States can impose it, nor does the E-Privacy Directive suggest that they are empowered to do so based on public interest considerations.