Norway drop contact-tracing app after Amnesty privacy investigation

Norway has abandoned plans to introduce a contact-tracing app to combat coronavirus after Amnesty investigation revealed its live-tracking capabilities

Amnesty International’s investigation into COVID-19 contact tracing apps across Europe, Middle East, and North Africa showed that Bahrain’s ‘BeAware Bahrain’, Norway’s ‘Smittestopp’ and Kuwait’s ‘Shlonik’ present the biggest threats to privacy due to their live-tracking capabilities.

All three apps are based on a centralised model meaning that data collected on a device is sent to a centralised server, unlike a decentralised model where data stays on the individual’s device. Amnesty International found all three apps were actively monitoring users’ locations in real-time by routinely transferring GPS location data to central servers. According to Claudio Guarnieri, Head of Amnesty International’s Security Lab, these apps are “highly invasive surveillance tools which go far beyond what is justified in efforts to tackle COVID-19”.

On 15 June the Norwegian government announced plans to temporarily abandon use of its app from 23 June after the DPA called for revisions to be made in light of Amnesty’s findings.

However, the Norwegian Institute of Public Health (FHI) announced on 16 June that it will stop uploading data immediately. Camilla Stoltenberg, FHI director said: “We do not agree with the Data Protection Agency’s assessment, but now we have to delete all data and pause work as a result of the notification. With this, we weaken an important part of our preparedness for increased spread of infection, because we lose time in developing and testing the app.”

According to Amnesty’s analysis, it is possible for authorities in these countries to identify an individual using the app. In Norway users are required to give their phone number. In Kuwait and Bahrain, users must provide their national ID number or passport number to register for the service. Once this information has been coupled with relevant location data, an identification of the individual can be made.

The research revealed that ‘BeAware Bahrain’ begins to collect location data as soon as it is installed, and GPS coordinates of the device are automatically uploaded to the backend. Additionally, Bahrain’s app allows users to set a quarantine location, used as a ‘geofence’ to monitor movements to and from their identified quarantine location. Both Bahrain and Kuwait apps can also be paired with a Bluetooth bracelet to track the proximity of the wearer to their phone.

Amnesty International said in a statement: “The Norwegian app was highly invasive and the decision to go back to the drawing board is the right one. We urge the Bahraini and Kuwaiti governments to also immediately halt the use of such intrusive apps in their current form. They are essentially broadcasting the locations of users to a government database in real time – this is unlikely to be necessary and proportionate in the context of a public health response. Technology can play a useful role in contact tracing to contain COVID-19, but privacy must not be another casualty as governments rush to roll out apps.”


Join our free-to-attend digital event, Last Thursday in Privacy, addressing data protection, privacy and security challenges including working from home, COVID-19, global regulations and more. Visit https://digital.privsec.info/.

We have been awarded the number 1 GDPR Blog in 2019 by Feedspot.