What is the WARN Law

Legal basis for the Corona warning app

Since Tuesday, June 18, 2020, the German Corona warning app can be downloaded and used on smartphones. There are discussions to what extent an accompanying law would be necessary for the use of the app, for example to limit the use of the generated data. An important point that is made by various, including political parties, is the legal stipulation of the voluntary nature of the app. This is to prevent the app from being made a prerequisite for access to shops, bars or means of transport. In Switzerland, for example, such legal bases have been adopted [I].

In Germany, too, some lawyers published a proposal for such a law at the beginning of March [II]. For a long time, however, no law seemed to be planned in politics. Yesterday, however, the Greens passed a legislative proposal which, among other things, should legally stipulate that the app is voluntary [III]. Experts who have responded to an SMC request also consider a legal basis for the Corona warning app to be sensible and provide information on how such a system could be designed.



  • Dr. Dennis-Kenji Kipker, member of the board of the European Academy for Freedom of Information and Data Protection (EAID), Berlin

  • Dr. Thilo Weichert, member of the "Network Data Protection Expertise" and former long-term data protection officer for Schleswig-Holstein

  • Dr. Sebastian Golla, research assistant at the chair for public law and information law, in particular data protection law, Johannes Gutenberg University Mainz


Dr. Dennis-Kenji Kipker

Member of the board of the European Academy for Freedom of Information and Data Protection (EAID), Berlin

"With the current technical implementation of the Corona warning app, a solution was actually chosen that is very data-saving, so that interference with informational self-determination is avoided. However, it cannot be ruled out that personal data will be processed by both government and private bodies. In addition, it is not only about the current data collection, but also about the further use of data that has already been collected. A law can therefore be useful to regulate the handling of app data, insofar as it is personal, and above all to create security with regard to future intentions to use the app, for example to identify 'virus-free' in public traffic. Such a procedure is fundamentally to be classified as inadmissible, since it not only establishes the personal reference, but it can also lead to unjustified discrimination. "

“The law is by no means important solely because of data protection, which is already regulated by the General Data Protection Regulation (GDPR). This means that even without the law, we are not in a situation where personal data is processed in a legally free area. Even with the new app, it cannot be ruled out that personal data will be processed after all, for example when identifying infected people and when using the telephone hotline. In this case, such a law could contain special data protection rules. Above all, however, the law is important for determining future scenarios for using the app. The Greens parliamentary group has already submitted a draft law that addresses the relevant questions, including the earmarking of the data once it has been collected. In any case, it should be stipulated by law that the use of the app is voluntary. At the moment we have the bare word of the federal government, which can of course also change if, for example, a second wave of infections should come. What we need legally regulated is a precisely described specification of the usage scenarios for the app - and that also in the case of future developments of the pandemic. "

On the question of the extent to which such a law could subsequently regulate an already existing app:
“The fact that the law could regulate the app for the future is not problematic at first, because this is not about the legitimation of past data processing, but about its concretization and secure and transparent design for the future. Nonetheless, the proposals for legislation should be taken up now in order not to postpone the creation process of a possible law on the Corona warning app. "

Dr. Thilo Weichert

Member of the "Network Data Protection Expertise" and former long-term data protection officer for Schleswig-Holstein

"The use of the Corona app should be voluntary. That’s what it is for now. However, voluntariness can quickly become compulsory if third parties ask you to prove that you have installed the app, for example when renting an apartment, visiting a restaurant, an amusement park and so on. "

“In terms of labor law, it should be undisputed that employers cannot request the installation or use of the app. Otherwise, however, for reasons of private autonomy, the conclusion of a contract can be made dependent on conditions, such as the use of an app. A law could make it clear that such a thing may not be required. "

“An App Voluntary Protection Act may make sense, but in my opinion it is probably not necessary as a flash in the pan: Whoever requests the submission of the app would probably trigger a business-damaging shit storm against them. After the Corona app, however, there is a risk of discrimination before the next: The current anti-discrimination law does not apply if someone requests health information for a contractual service. Data donations are currently very popular in many contexts. It would therefore be important to have an anti-discrimination law with regard to the disclosure of health data in general, which also guarantees security, for example against seizure by the police. Such a law would be important, for example, for medical research, which is particularly dependent on data, but which it can hardly get without assured confidentiality. "

Dr. Sebastian Golla

Research assistant at the chair for public law and information law, in particular data protection law, Johannes Gutenberg University Mainz

"A law on the Corona app could help to strengthen legal certainty and the acceptance of the app. The possible content of a Corona App law is limited by the European legal framework for data protection law. However, this does not make a regulation obsolete. While I consider it understandable from a political point of view that a decision has been made against a regulation, it seems to me desirable from a legal point of view. "

“To base the use of the app on the consent of the user without further regulation is a solution with structural weaknesses. The strict requirements for consent according to the European General Data Protection Regulation (GDPR) cannot be solved by repeating the mantra of voluntariness. Whether the consent to the processing of the data in the Corona app is voluntary is extremely difficult to assess and depends on a dynamic reality of life. We just have to look at the cases in which the use could be made indirectly mandatory, for example by employers. A legal regulation could create conditions that reduce the risk of a de facto compulsion to use. However, the fact remains that the consent of citizens to sovereigns is almost always a delicate instrument to legitimize data processing due to the power imbalance between the two sides. "

"In addition to the consent, data processing within the framework of the app can be based on legal powers. At least for public bodies, these powers can largely be specified in national law. A regulation of data processing by the app could be of particular interest if the health dangers of the pandemic increase as part of a 'second wave'. It is conceivable that it would then also be appropriate to expand the functionality of the app. For data processing to protect against 'serious cross-border health threats', for example, a regulation could be created in accordance with Article 9 (2) (i) GDPR. "

Information on possible conflicts of interest

Dr. Thilo Weichert: "There are no conflicts of interest."

Dr. Sebastian Golla: "There are no conflicts of interest."

All other: No information received.

References cited by the SMC

[I] Thier J (June 8th, 2020): The legal path for the contact tracing app is free - but it is not yet a success story. The New Zurich Times.

[II] Engeler M et al. (2020): Proposal for a law to introduce and operate app-based tracking of infection risks with the SARS-CoV-2 (Corona) virus.

[III] Keul K et al. (2020): Draft of a law for civil, labor and service law securing the voluntary use and earmarking of mobile electronic applications for the tracking of infection risks (Tracing-App-Voluntary and Purpose-Limiting Act-TrAppFZG). Bill.

Further sources of research

EU General Data Protection Regulation (EU GDPR).