Personal data

"TousAntiCovid" application

The TousAntiCovid app is part of the global strategy for tackling the COVID-19 epidemic and helping people to emerge from lockdown. Use of this application is voluntary.

The application:

The application is part of an overall contact tracing strategy, the goal of which is to break the chain of transmission. It provides a quicker way of notifying contacts, particularly in cases involving individuals who have been infected by people they don’t know, such as on public transport or in shops.

Data controller and purpose

This application, the development of which was overseen by Inria, is the responsibility of the General Health Directorate of the Ministry for Social Affairs and Health.

The data will be used in order to:

1° Inform users of the application who have been in proximity to at least one other user who has since tested positive for COVID-19 and who may have been infected themselves

2° Raise awareness among users of the application of the symptoms of the virus, as well as the social distancing measures and behaviours to adopt in order to prevent the virus from spreading

3° Guide at-risk contacts towards competent healthcare professionals for treatment and testing, as the case may be

4° Compile anonymous statistics for the purposes of improving the performance of the health model used by the application

5° Generate travel exemption forms

6° Share health information relating to COVID-19, with the option of filtering by place of interest

7° Share guidance on self-isolating in accordance with the selected COVID-19 status

A randomly-generated QR code with no information that would reveal the identity of the individual in question will be affixed to the test results sent to individuals who have tested positive for COVID-19. Individuals who have tested positive for COVID-19 will be able to use this QR code in order to identify themselves on the app.

The legal and regulatory basis for data processing

This processing is for the purposes of tasks carried out in the public interest (Article 6.1.e of the GDPR) by the General Health Directorate in tackling health threats. There is also a regulatory framework for processing - the decree of 29 May 2020 pertaining to the processing of data entitled “StopCovid" (since renamed TousAntiCovid) introduced after consultation with the CNIL (the French data protection authority).

Personal data processed on the central server

For informing people who have been in proximity to other users who have tested positive for COVID-19

Personal data processed in the TousAntiCovid application

For travel exemption forms, no information entered into the travel form generator will be processed by the Ministry for Social Affairs and Health. This personal data will only be stored on individual users’ mobile phones, making it easier for them to fill in their next travel exemption form.

When seeking information on COVID-19 relating to a place of interest, the information that is entered will not be processed by the Ministry for Social Affairs and Health. It will only be stored on individual users’ mobile phones.

When seeking advice on self-isolating, the information that is entered will not be processed by the Ministry for Social Affairs and Health. It will only be stored on individual users’ mobile phones.

The recipient of the data

For informing people who have been in proximity to other users who have tested positive for COVID-19

For travel exemption forms

When seeking information on self-isolating

When seeking the latest news on COVID-19 in relation to places of interest

When seeking advice on self-isolating

Retention period

For notifications that you have been in proximity to another user who has tested positive for COVID-19: data will be processed for six months from the declaration of the state of emergency onwards. Proximity history data will be retained for no longer than 2 weeks after being shared.

For travel exemption forms: for a maximum of 24 hours from the validity date onwards.

When seeking information on COVID-19 linked to a place of interest: postcodes will only be recorded in the application, not on the central server. These will be retained until they are modified or deleted by users

When seeking advice on self-isolating: data selected or entered by users will only be stored in the application and will not be shared with the central server. It will be retained until it is deleted by the user.

Exercising your rights

The right to access and rectify data, as well as purpose limitation, cannot be exercised: data is rendered anonymous in order to prevent users from being identified. Exercising these rights would entail identifying the individual in question, which would considerably weaken both the security and the confidentiality of the application as a whole.

However, users will be able to delete this data from their mobile application at any time. They can also delete any data stored on the central server by unsubscribing and uninstalling the application.

Any questions you may have regarding the processing of your data can be addressed to the Ministry for Health, either by email: tousanticovid-rgpd@sante.gouv.fr or through the post: The Ministry for Social Affairs and Health - Data Protection Officer - General Health Directorate - 14 Avenue Duquesne 75350 Paris 07 SP.

If you believe that your data is being processed in a way that does not comply with data protection law, you may submit a complaint to the CNIL (France’s data protection authority) https://www.cnil.fr/fr/plaintes/ CNIL - Service des plaintes - 3 place Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07