Contact tracing app deemed operational, tested by authorities


The app #OstaniZdrav (#StayWell) is expected to be available for download in mid-August or the second half of August, given the experience by other countries which also based their contact tracing apps on Android and IOS mobile operating systems, said Peter Geršak, the ministry's state secretary at today's coronavirus briefing.

Saturday marks the deadline by which the app must be localised on the basis of the German Corona-Warn-App under the contract the government signed with developer RSteam, said Geršak, highlighting that the app would help stem the spread of the coronavirus and urging citizens to use it.

The institute and ministry (MJU) are currently testing the product to ensure the internalisation of the open-source app has been done right and to assess its operations, functionality and information security.

Primož Cigoj, RSteam director and a researcher at the Jožef Stefan Institute, said today that #OstaniZdrav would be easy to use and would require no special skills. After downloading it, the user will get instructions on its use and activation will be only one click away.

"The app requires nothing of you. If you get infected, you enter a 10-digit code given by an epidemiologist, and even that is voluntary," said Cigoj.

#OstaniZdrav will warn the user about the level of risk of contracting the virus using three colours – green will represent low risk, blue an unknown state indicating relevant data is still being gathered, and red increased risk, meaning contact with infected persons.

Both Cigoj and Geršak said that the issues experienced by the German app regarding exchanging data have been resolved in the Slovenian version.

The state secretary pointed out that the app would not be used for geolocation data tracking and would not have access to any personal information stored on the phone which could give away the user's identity.

The Information Commissioner has not yet given the final go-ahead for the app, said Cigoj, but he does not expect any problems. The app is currently available only in Slovenia, he added.

Later in the day, Information Commissioner Mojca Prelesnik reiterated that the legal basis for the introduction of the app was inappropriate.

The ministry's outcome estimate regarding personal data protection which did not stem from the relevant law is not enough to mitigate the shortcomings of the legislation, she said, adding that such a document should have been drawn up before endorsing the law.

She pointed out that the standpoint of all European data protection watchdogs on such legal bases was the same in that respect.

Prelesnik also highlighted that she had been warning about the app's weak points since the debate on the measure started.

"The warnings have not been heeded, which will lead to serious issues in the next implementation phases for the app's subscriber as well as for the MJU, NIJZ and supervisory authorities," said the Information Commissioner, adding that a delay would occur because of that to boot.

Prelesnik has been pointing to ambiguous elements of the law, including the uncertainty whether there is a clear and constitutional legal basis for such processing of personal data. Moreover, the NIJZ is not set down as the authority in charge of data collecting in the law, she said.

What poses another ambiguity is whether the use will be indeed voluntary for the infected persons, noted Prelesnik, pointing out that even if the app was truly voluntary for all, a legal basis would be a must to warrant such a government measure.

Meanwhile, Geršak thinks the app does not pose any data protection risk. Users' phones will exchange random encrypted codes using Bluetooth as well as time of the duration of the contact and the distance between the phones. Neither the location nor the names of the users will be collected. The codes are to be changed every 10 minutes and erased after two weeks, he said at today's briefing.

He also highlighted that using the app was vital and logical while the user was healthy. If they get infected, they have an option to notify other users of that using a random code which again does not give away their identity.

When the app is launched, a helpline will be set up to provide relevant assistance.

Geršak also pointed out that a recent MIT Technology Review study showed that a 14% adoption rate already led to positive results. Some other studies indicate that at least a 60% take-up is necessary for the app to be effective.

The app will be completely voluntary, although it was initially planned that it would have to be downloaded and installed by all persons with confirmed infections and those ordered to quarantine.