Policy Briefing — EU COVID-19 Contact Tracing Recommendation

Executive briefing: On 8 April 2020, the European Commission issued Recommendation (EU) 2020/518 (C(2020)2296) outlining a common EU toolbox for the use of mobile applications and data to support the fight against COVID-19. The recommendation provides privacy, security, and interoperability principles for voluntary contact tracing and warning apps. Member states agreed to coordinate via the eHealth Network, ensuring apps respect EU values while aiding public health authorities.

Execution priorities for digital health leaders

Compliance checkpoints for GDPR and EU toolbox alignment

Record how your exposure-notification design satisfies the Recommendation's principles on voluntariness, data minimisation, decentralised storage, and sunset clauses before launching pilots.Commission Recommendation (EU) 2020/518

Map processing activities against the Commission's data-protection guidance, including lawful basis, transparency notices, and DPIA requirements, so supervisory authorities can verify proportionality.Commission guidance on apps supporting the fight against COVID-19

Operational moves for secure interoperability

Implement the eHealth Network's common toolbox profiles for Bluetooth protocols, cryptographic keys, and federation gateways to enable cross-border roaming.Common EU Toolbox for contact-tracing apps

Set up security monitoring to detect tampering, replay attacks, or false-positive injection, matching the toolbox's requirements for penetration testing and incident reporting.Common EU Toolbox for contact-tracing apps

Enablement tasks for public trust

Engage civil society and public health stakeholders in transparency briefings and publish code or audits where feasible to demonstrate adherence to EU principles.Commission Recommendation (EU) 2020/518Common EU Toolbox for contact-tracing apps

Plan communication campaigns that explain epidemiological triggers for activating or deactivating app features, reinforcing the time-limited and voluntary commitments mandated by the Recommendation.Commission Recommendation (EU) 2020/518

Privacy and data protection requirements

The recommendation mandates full compliance with GDPR, the ePrivacy Directive, and national health data laws. Apps must be voluntary, approved by national health authorities, and use anonymised or pseudonymised data. Data minimisation is essential: only contact tracing data necessary for epidemiological purposes should be collected, with strict retention limits tied to medical needs. Users must receive transparent information on data processing, and consent must be freely given, specific, and informed.

Location data should not be used unless necessary; proximity tracing using Bluetooth Low Energy is preferred. Any centralised processing must incorporate safeguards such as encryption, access controls, and oversight by data protection authorities. The European Data Protection Board (EDPB) issued guidelines endorsing privacy-by-design architectures, reinforcing the Commission’s recommendation.

Interoperability and technical standards

To enable cross-border functionality, the recommendation tasks the eHealth Network with defining interoperability specifications. This led to the EU Federation Gateway Service, allowing national apps to exchange keys securely. Technical guidance emphasises open source reference implementations, Bluetooth-based proximity tracing, and compatibility with both Apple and Google exposure notification APIs.

Member states are encouraged to adopt common protocols for exposure risk scoring, notification thresholds, and user messaging. Testing, certification, and code audits support trust and adoption. Accessibility standards ensure apps serve diverse populations.

Governance and oversight

The recommendation calls for national authorities to establish governance structures overseeing app deployment, including independent audits, security testing, and public transparency. Regular reporting to the Commission and peer reviews within the eHealth Network are expected. Authorities must consult data protection authorities, national cyber agencies, and health experts before launch.

Member states should ensure that app usage does not lead to discrimination or denial of services. Employers and educational institutions cannot mandate app installation as a condition for access. Oversight mechanisms must address misuse, ensure data deletion after the pandemic, and evaluate effectiveness.

Security considerations

Security guidelines include implementing strong encryption, securing backend servers, and mitigating risks such as replay attacks and spoofing. Member states must conduct penetration testing, maintain incident response plans, and share threat intelligence via ENISA. The recommendation encourages vulnerability disclosure programmes and collaboration with researchers.

Data storage should leverage trusted infrastructures with redundancy and compliance with EU cybersecurity standards. Authentication mechanisms must prevent unauthorised access to sensitive health data. Logging and monitoring support forensic analysis and accountability.

Public health integration

Apps must integrate with public health workflows, enabling manual contact tracing teams to validate exposures, issue guidance, and monitor follow-up. Integration with testing infrastructure ensures users receive accurate instructions for isolation or testing. Data analytics support epidemiological modelling, informing policy decisions on containment measures.

The recommendation emphasises accessibility for vulnerable populations, multilingual support, and coordination with traditional tracing methods. Member states should evaluate app effectiveness through metrics such as downloads, active users, notifications sent, and confirmed cases linked to app usage.

International cooperation and alignment

The EU engaged with international partners, including the WHO and OECD, to share best practices. European Economic Area countries participated in the toolbox, and Switzerland joined interoperability efforts. The recommendation aligns with global privacy norms, such as those promoted by the OECD and Council of Europe, reinforcing trust in digital health solutions.

Cross-border travellers benefit from interoperable apps, essential for reopening internal borders. Airlines, hospitality, and employers rely on consistent guidance to manage exposure risks while respecting privacy.

Action plan

1. Immediate: Member states and developers should align app architectures with the EU toolbox, conduct DPIAs, and coordinate with data protection authorities. Organisations integrating apps into workplace policies must ensure voluntariness and privacy compliance.
2. 30–60 days: Implement interoperability testing, establish governance boards, and launch transparency portals publishing source code, privacy policies, and audit results. Train public health staff on integrating app data into workflows.
3. 60–90 days: Evaluate app effectiveness, adjust risk scoring algorithms, and update communications based on user feedback. Coordinate with other member states via the eHealth Network to refine interoperability.
4. Continuous: Monitor security threats, regulatory updates, and epidemiological needs. Plan for decommissioning and data deletion once apps are no longer necessary, documenting lessons learned for future public health emergencies.

Adhering to the EU contact tracing recommendation ensures digital tools support pandemic response while upholding privacy, security, and fundamental rights.

Transparency and public trust

The recommendation stresses the need for transparent governance to build public trust. Member states should publish DPIA summaries, security audit results, and source code repositories. Independent oversight bodies, including civil society and academic experts, can review app performance and privacy safeguards. Transparency campaigns must explain how data is used, stored, and deleted, addressing misinformation and privacy concerns.

Public health authorities should engage with community organisations, accessibility advocates, and minority groups to ensure equitable adoption. Feedback mechanisms—help desks, in-app surveys, and forums—enable continuous improvement and rapid response to issues.

Workplace and sectoral adoption

Businesses integrating contact tracing apps into occupational health programmes must ensure voluntariness, avoid discriminatory practices, and align with employment law. Critical infrastructure operators may incorporate app usage into broader pandemic response plans, coordinating with national authorities. Employers should focus on education and complementary measures such as symptom screening and ventilation improvements rather than mandating app usage.

Sectoral regulators, including aviation and tourism authorities, provide guidance on using exposure notification apps to support reopening. Organisations should align with European Centre for Disease Prevention and Control (ECDC) recommendations and maintain compliance with GDPR and labour law.

Long-term considerations

The Commission recommends planning for eventual decommissioning. Data must be deleted or anonymised once no longer necessary, and legal bases for processing should be reassessed regularly. Lessons learned will inform future digital public health interventions, including potential applications for other communicable diseases.

Member states should evaluate the effectiveness of contact tracing apps against traditional methods, considering cost-benefit analyses and societal impacts. Findings should feed into EU-level reports and preparedness strategies.

Follow-up: The Commission’s interoperability gateway went live in October 2020 and fed into the EU Digital COVID Certificate framework in 2021; by 2023 the contact-tracing network was wound down as Member States pivoted to vaccination and travel-certificate regimes.

Sources

• Commission Recommendation (EU) 2020/518 on a common Union toolbox for the use of technology and data to combat and exit from the COVID-19 crisis — European Commission; The European Commission set principles for voluntary, interoperable, and privacy-preserving contact-tracing applications.
• Mobile applications to support contact tracing in the EU’s fight against COVID-19 — Common EU Toolbox — European Commission; The eHealth Network detailed interoperability, security, and governance measures for national exposure notification applications.
• Guidance on Apps supporting the fight against COVID 19 pandemic in relation to data protection — European Commission; The Commission outlined GDPR compliance expectations for health authorities deploying contact-tracing apps, covering data minimisation and storage limits.