Please use this identifier to cite or link to this item: https://hdl.handle.net/10419/261838 
Year of Publication: 
2022
Citation: 
[Editor:] Gryszczyńska, Agnieszka [Editor:] Polański, Przemysław [Editor:] Gruschka, Nils [Editor:] Rannenberg, Kai [Editor:] Adamczyk, Monika [Title:] Privacy Technologies and Policy - 10th Annual Privacy Forum, APF 2022, Warsaw, Poland, June 23–24, 2022, Proceedings [ISBN:] 978-3-031-07315-1 [Series:] Lecture Notes in Computer Science [No.:] 13279 [Publisher:] Springer International Publishing [Place:] Cham [Year:] 2022 [Pages:] 119–134-
Publisher: 
Springer International Publishing, Cham
Abstract: 
On June 15, 2020, the official data protection impact assessment (DPIA) for the German Corona-Warn-App (CWA) was made publicly available. Shortly thereafter, the app was made available for download in the app stores. However, the first version of the DPIA had significant weaknesses, as this paper argues. However since then, the quality of the official DPIA increased immensely due to interventions and interactions such as an alternative DPIA produced by external experts and extensive public discussions. To illustrate the development and improvement, the initial weaknesses of the official DPIA are documented and analyzed here. For this paper to meaningfully do this, first the purpose of a DPIA is briefly summarized. According to Article 35 of the GDPR, it consists primarily of identifying the risks to the fundamental rights and freedoms of natural persons. This paper documents at least specific methodological, technical and legal shortcomings of the initial DPIA of the CWA: 1) It only focused on the app itself, neither on the whole processing procedure nor on the infrastructure used. 2) It only briefly touched on the main data protection specific attacker, the processing organization itself. And 3) The discussion of effective safeguards to all risks including such as the ones posed by Google and Apple has only insufficiently been worked out. Finally, this paper outlines the constructive criticism and suggestions uttered, also by the authors of this paper, regarding the initial release. As of now, some of those constructive contributions have been worked into the current DPIA, such as 1) and 2), but some central ones still haven’t, such as 3). This paper aims to provide an opportunity to improve the practical knowledge and academic discourse regarding high-quality DPIAs.
Subjects: 
data protection
data protection impact assessment
DPIA
Corona apps
CWA
digital contact tracing
decentralization
GDPR
privacy
Published Version’s DOI: 
Creative Commons License: 
cc-by Logo
Document Type: 
Book Part
Document Version: 
Manuscript Version (Preprint)

Files in This Item:





Items in EconStor are protected by copyright, with all rights reserved, unless otherwise indicated.