Coronavirus: Data commissioner lists rules on CovScan procedures

The CovScan app used to digitally scan EUDCC certificates cannot be made compulsory for children under 14, nor can a business oblige employees charged with carrying out checks to download the app on their personal device, the personal data protection commissioner said on Friday.

Irene Loizidou Nicolaidou issued her written statement in response to queries relating to Thursday’s decree from the health minister regarding the CovScan app, the use of which becomes mandatory for businesses that can host over 10 people and thus require a SafePass as from Monday.

Nicolaidou reiterated that her office had no mandate as regards the constitutionality of the decrees. Rather, her job was to ensure that any processing of personal data within the framework of the decrees is in compliance with the EU’s general data protection regulation (GDPR).

As regards checks on minors and the elderly, after consultation with her office, the decree was amended to exclude from CovScan checks people over 65 and under 18. These people are not required to have an EUDCC and when checked can present a certificate of vaccination or of recovery or a PCR or rapid test without a QR code, she said.

These age groups may change in future decrees, however in no case should CovScan checks be mandatory for people under 14, she said.

The commissioner also clarified that the certificates cannot be checked with any app, as the decree specifically refers to CovScan. Use of any other app would be a violation of the GDPR and should be reported.

She also clarified that the app does not store any information included in the certificates, nor is the individual’s location recorded in anyway. No profile is created nor is there a possibility to print screen.

“Many citizens are concerned that their certificate may be scanned with other apps that may permit storing of their data. In any case, a citizen asked to be checked has the right to check that the scan will be done using the CovScan-Cyprus app and not any other app,” she said.

When a QR code is scanned, the CovScan only shows the name, surname and date of birth of the holder and confirms the authenticity and the type of certificate with a specific colour. Some people have queried whether the date of birth need appear. To this, the commissioner said that the checks aim to ensure than someone is not using the certificate of a different person with the same name. Therefore, in the event that someone is asked to show their ID to confirm they are the real holders of the certificate, there must be a second feature on the screen other than the name.

“Given that the only information recorded on the EUDCC are the name, surname and date of birth, their appearance is necessary, for the purpose of correct identification.”

She also clarified that any member of the public who wished to present a print version of their EUDCC were free to do so.

The CovScan app is currently only available for Android devices and no business can oblige its employee authorised to check certificates to download the app on their personal device, she concluded.