On 16 April 2020, EU Member States, supported by the Commission, published an EU toolbox for the use of mobile applications for contact tracing and warning in response to the coronavirus pandemic, together with a guidance on data protection for such apps.

The toolbox sets out essential requirements for such apps, such as their voluntary application, anonymisation, security, data protection compliance, and interoperability across the EU.

The guidance sets out features and requirements which apps should meet in order to ensure compliance with EU privacy and personal data protection legislation as well as to limit the intrusiveness of the app functionalities. It addresses only voluntary apps supporting the fight against the COVID-19 pandemic. The main ideas set out by the guidance include, for instance, ensuring that the individual remains in control; assigning national health authorities as data controllers; providing a legal basis and adhering to the specific purpose principle; and guaranteeing data minimisation.