The Curious Case of LUCA Data and the German Police

Article by Tsaaro

7 min read

The Curious Case of LUCA Data and the German Police

 

German authorities came under fire for their use of a COVID contact tracing tool to investigate a case.The app LUCA  has been plagued by cybersecurity, data protection and even copyright infringement issues since its initial deployment in March 2021, leading to a strong joint statement against its use by hundreds of IT experts.

The instance demonstrates data protection specialists’ concerns. Politicians have cautioned that it plays into the hands of opposition organizations that vehemently oppose all pandemic curbs and express doubt about COVID vaccinations.

What happened?

The incident concerns authorities in the city of Mainz. At the end of November, a man fell to his death after leaving a restaurant in the city, prompting police to open a case.

While trying to track down witnesses, police, and prosecutors managed to successfully petition local health authorities to release data from the Luca app, which logs how long people stayed at an establishment.

Authorities then reached out to 21 potential witnesses based on the data they had unlawfully acquired from the app. The case’s reports, which surfaced last week, prompted considerable outrage.

In a statement, Mainz public prosecutors said they’ve begun an investigation and are working to ensure “that the relevant data will not be exploited further.

To date, no additional examples have been reported in which authorities were able to obtain data from the app in order to conduct investigations.

What does the app do?

The Luca app works by logging the amount of time that patrons spent at a restaurant, bar, or cultural event. Users enter their personal information into the app. They can then scan a QR code at a restaurant or event and log out when they leave.

In the event that someone tests positive for COVID-19, local health authorities can more easily identify and alert people who may have been exposed to the virus.

The use of the Luca app and others like it have relieved some of the paperwork burdens for restaurants, bars, and event organizers — who, in the early stages of the pandemic, were required to have customers write down their contact details on pieces of paper.

The app is also subject to Germany’s strict data protection laws. The only way to retrieve the data is if the local health department and the establishment both give their consent to unencrypt the personal data.

Once it is no longer encrypted, only local health departments are permitted to have access to the personal details of the patrons. Furthermore, the data can only be used in the event of chasing a potential infection chain.

What has the response been?

The app’s developers, culture4life, sharply criticized the actions of authorities in Mainz.

We condemn the abuse of Luca data collected to protect against infections,” the company said in a statement.

Culture4life added that it receives frequent requests for its data from law enforcement — but those requests are routinely denied. Members of Germany’s ruling coalition, which comprises the Social Democrats, Greens, and Free Democrats, have also voiced concern over the case.

Konstantin von Notz, a senior member of the Greens, warned that abuse of the app could undermine public trust and hamper efforts to stem rising COVID-19 cases.

Luca is governed by Germany’s strong data protection laws, which state that information from the app cannot be accessed by non-health authorities or utilized in criminal proceedings.

Despite the fact that there was “no legal basis to do so,” the Mainz public prosecutor’s office confirmed that officers used the Luca app to issue the data inquiry.

It expressed “regret” for the occurrence and promised that such information would no longer be used by police. It said that a preliminary inquiry into the use of the Luca app had not turned up any additional instances of the software being abused.

Is this the first time?

Authorities in Germany aren’t the first to use information collected from coronavirus tracing applications in criminal investigations.

Last year, officials in Singapore admitted to using data from the country’s TraceTogether app in a homicide inquiry, despite the country’s lax privacy regulations. While using applications like Luca is largely optional in Europe, in Singapore, TraceTogether is mandatory to obtain access to many eateries and office buildings.

In response to the uproar, Singaporean officials revised the app’s privacy statement and modified legislation to make it clear that the data might be utilised in a serious criminal investigation. The government of the Southeast Asian state has agreed to discontinue using the app after the pandemic has passed.

Tsaaro Consulting

In today’s fast-paced business environment, organisations are constantly seeking innovative methods to adapt and scale efficiently. Staff Augmentation Consulting services, …

Tsaaro Consulting

INTRODUCTION: In today’s interconnected world, businesses operate across borders, serving customers globally. This inevitably leads to the transfer of personal …

Shubham Bansal

INTRODUCTION: The Personal Data Protection Law No. 6698, known as Kişisel Verileri Koruma Kanunu (KVKK), is Türkiye’s landmark data protection …

Tsaaro Consulting

At the Singapore International Cyber Week 2024, The Cyber Security Agency (CSA) of Singapore released Guidelines on Securing Artificial Intelligence …

Tsaaro Consulting

The European Data Protection Board (EDPB) on 8th October 2024, issued draft Guidelines 1/2024 on processing of personal data based …

SHARE THIS POST

Would you like to read regular updates from Tsaaro.
Subscribe to our newsletter

Our Latest Blogs

Read what the latest hapennings in the cyber world are and learn what the
experts have to say about them