Portugal Enacts Legislation For The Anti-Covid App

Stayaway Covid App is already available


Decree-Law No. 52/2020 has been recently published in Portugal, following a recommendation of the Portuguese Data Protection Commission (CNPD) who called for a specific legal framework that would regulate some of the aspects of the STAYAWAY COVID system.

The STAYAWAY COVID system intends to be a complementary and voluntary tool in the response to the current epidemiological situation. It is now available for download.

As previously commented, the development of contact tracing apps around the world has been perceived as a means of identifying and monitoring contacts between citizens, with a view to interrupting transmission’ chains of the COVID-19 disease.

The STAYAWAY COVID is a digital system, available in personal mobile devices with an “iOS” or “Android” operating system. It uses the “Bluetooth Low Energy” technology as a proximity sensor, notifying the users of their possible exposure to contagion situations.

This recently published legislation has established who is responsible for the data processing, also regulating the intervention of the physician in the STAYAWAY COVID system.

STAYAWAY COVID shall respect European and national legislation regarding the protection of personal data and European recommendations, for instance, the “Union toolbox for the use of technology and data to combat and exit from the COVID-19 crisis” and the Guidelines No. 4/2020 of the European Data Protection Committee on the use of location data and contact tracing in the context of the COVID-19 outbreak.

The Portuguese Health General Directorate (DGS) is appointed as data controller in the processing of data related with the STAYAWAY COVID system. Said DGS will define the functioning of the system, the generation, communication, storage, and processing of data, as well as the articulation between all the parties involved.

In what concerns the intervention of the physician, the same shall obtain and communicate to the user of the STAYAWAY COVID app (who is a confirmed case of COVID-19) the pseudo-random code which may be inserted in the application, in case the user wishes to do so. To obtain said code, the physician must be assigned an access profile to the Diagnostic Legitimation System.

Any physician with an access profile may intervene in the system, regardless of the sector in which said physician is integrated.

Regarding the obtention of the previously mentioned code, the physician shall enter the date of the first symptoms of the user or, if the patient is asymptomatic, the date of the laboratory test. No identifiable data of the patient shall be inserted.

The processing of data related with the STAYAWAY COVID system is exceptional and transitory. Moreover, the use of said data is limited for the purpose of the app, which serves as a complementary and voluntary tool within the response to the pandemic, the use of the data for any other purpose being barred.

The interoperability of the STAYAWAY COVID system with other mobile systems and applications shall ensure compliance with the principles and safeguarding of personal data protection, such as the data minimisation principle.

This recently published legislation appears to satisfactorily respond to the vulnerabilities pointed out by the CNPD in relation to the impact of the STAYAWAY COVID system on the protection of users’ data, at least as regards the call for a specific legal regime for this contact tracing mobile app to be designed.



Caiado Guerreiro’s Life Sciences Department is at your disposal for any clarification on this matter.

The content of this information does not constitute any specific legal advice; the latter can only be given when faced with a specific case. Please contact us for any further clarification or information deemed necessary in what concerns the application of the law.