View source for Datatilsynet (Norway) - 20/02058

===Facts===
The temporary ban has its background from Datatilsynet’s decision to control the tracking app “Smittestopp”. Datatilsynet commented earlier on a lacking analysis of the risks and vulnerabilities connected to the use of the app. Datatilsynet decided to evaluate the app after receiving answers by the Institute of Public Health to an order of information connected to questions regarding the usefulness of the app, and if the interference to users privacy was proportional. 

Unlike many other apps, Smittestopp use location data (to track movement) in addition to Bluetooth (to track whom the users’ were in contact with). The personal data is first stored locally, but approximately once an hour it is sent to an Azure server located in Ireland. The app would try to send the data for seven days provided it did not manage to connect to the server. The data was stored centrally for a maximum of 30 days. It was later planned that the data should be stored for a maximum of ten days.

The personal data uploaded was used for two purposes, tracking and limiting the spread of covid-19, as well as being used for research and analysis on aggregated and anonymised data. 

Notification of covid-19 infections were only implemented in three (test) municipalities. A way to analyse, aggregate and anonymise the data was not in place at the time of the decision.

The users could not choose to share the data for one or both purposes.