Feasibility study on digital technology for cross-border contact tracing : final report : version 2.2.
Date: 2024-06-18
Institutions: European Health and Digital Executive Agency
Subjects: European Economic Area, European Union, cooperation policy, coronavirus disease, crisis management, cross-border cooperation, cross-frontier data flow, data protection, digital technology, exchange of information, information security, information system, public health, regulation (EU), report

Feasibility study on digital technology for cross-border 
contact tracing  

Final report 

Specific Contract No SC 2021 P1 03 in the context of the Single 
Framework Contract Chafea/2018/Health/03 

EUHealthSupport Consortium 
September 2023 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

European Commission 
Health and Digital Executive Agency, Unit A2 

Covent Garden Building  
Place Charles Rogier, 16 
1049 Brussels, Belgium  

Contact: 
HADEA-HP-TENDER@ec.europa.eu 

SANTE CONSULT-B2  
SANTE-CONSULT-B2@ec.europa.eu 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Feasibility study on digital technology 
for cross-border contact tracing 

Final report 

Specific Contract No SC 2021 P1 03 in the context of the Single 
Framework Contract Chafea/2018/Health/03 

Corporate Author:  Health and Digital Executive Agency (HaDEA) 

Authors: Tomris Cesuroglu, Ruth Baron, Akke van der Meer, Sanne van der Steen, Anett Molnar, Mary Kirwan, 
Ines Mogami, Johan Hansen, Olivia Lewis, Joeri Buis, Ilgin Arslan, Petra Wilson, Corien Swaan, Mart Stein 

DG SANTE: Laura Gillini, Cinthia Menel Lemos, Martina Karzel 

ECDC: Emmanuel Robesyn, Favelle Lamb, Daniel Cauchi, Ilias Georgousis, Lars Söderblom 

2 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Europe Direct is a service to help you find answers 
to your questions about the European Union. 

Freephone number (*): 

00 800 6 7 8 9 10 11 

(*) The information given is free, as are most calls (though some operators, phone boxes or hotels may 

charge you). 

Manuscript completed in September 2023 

LEGAL NOTICE 

This  report  was  produced  under  the  EU4Health  Programme  under  a  service  contract  with  the  European  Health  and  Digital 
Executive Agency acting under mandate from the European Commission. The information and views set out in this report are 
those  of  the  author(s)  and  do  not  necessarily  reflect  the  official  opinion  of  the  Commission  /  Executive  Agency.  The 
Commission/Executive  Agency  does  not  guarantee  the  accuracy  of  the  data  included  in  this  study.  Neither  the 
Commission/Executive Agency nor any person acting on the Commission’s/Executive Agency’s behalf may be held responsible 
for the use which may be made of the information contained therein. 

EN PDF 

ISBN 978-92-95224-58-2 

doi :10.2925/21434 

HW-05-24-474-EN-N 

Luxembourg: Publications Office of the European Union, 2024 

© European Union, 2024  

The reuse policy of European Commission documents is implemented by  Commission Decision 2011/833/EU of 12 December 
2011 on the reuse of Commission documents (OJ L 330, 14.12.2011, p. 39). Unless otherwise noted, the reuse of this document 
is 
licence 
(https://creativecommons.org/licenses/by/4.0/).  This  means  that  reuse  is  allowed  provided  appropriate  credit  is  given  and  any 
changes are indicated. 

a  Creative  Commons 

International 

authorised 

Attribution 

under 

(CC 

4.0) 

4.0 

BY 

3 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Table of Contents 
List of Abbreviations ..................................................................................................................... 7 

Executive summary ...................................................................................................................... 8 

1.  Introduction .......................................................................................................................... 13 

1.1 Introduction to the EU feasibility study ...................................................................................... 13 

1.2. Introduction to the final report .................................................................................................. 14 

2.  Background: national and cross-border CT and digital technology ........................................... 15 

2.1 Relevance of cross-border CT ...................................................................................................... 15 

2.2 Digital technology for CT ............................................................................................................. 15 

2.3 Legal aspects of cross-border CT ................................................................................................. 18 

2.3.1 Regulation (EU) 2022/2371 and the EWRS .......................................................................... 18 

2.4 CT at national and international level within Europe.................................................................. 19 

2.4.1 National level ........................................................................................................................ 19 

2.4.2 International level ................................................................................................................ 19 

2.5 Potential factors influencing cross-border CT: legal requirement, ability, and national priorities
 ........................................................................................................................................................... 21 

2.5.1 Examples of challenges faced by countries using digital technology for CT ........................ 22 

2.5.2 Legal barriers ........................................................................................................................ 22 

2.5.3 Privacy and ethics ................................................................................................................. 22 

2.6 Summary of gaps in knowledge on cross-border CT ................................................................... 23 

2.6.1 Legislation ............................................................................................................................. 23 

2.6.2 Digitalisation ......................................................................................................................... 23 

2.6.3 Cross-border CT .................................................................................................................... 23 

3.  Methods................................................................................................................................ 24 

3.1. Methods of the study ................................................................................................................. 24 

3.1.1 Literature review .................................................................................................................. 24 

3.1.2 Surveys ................................................................................................................................. 24 

3.1.3 Interviews ............................................................................................................................. 25 

3.1.4 Webinars .............................................................................................................................. 25 

3.2 Study population ......................................................................................................................... 25 

3.2.1 Surveys ................................................................................................................................. 26 

3.2.2 Interviews ............................................................................................................................. 26 

3.2.3 Webinars .............................................................................................................................. 26 

4.  National and cross-border CT practices and digital technology in EU/EEA countries in relation to 
COVID-19: findings ..................................................................................................................... 28 

4.1 Legal basis for cross-border CT data sharing and processing...................................................... 28 

4 

 
 
 
Feasibility study on digital technology for cross-border contact tracing 

4.1.1 Lawful basis for cross- border sharing CT data .................................................................... 28 

4.1.2 GDPR compliance – lawful basis for CT data processing, compliance with Article 5 principles 
and transfer tools .......................................................................................................................... 28 

4.1.3 Regulation (EU) 2022/2371 .................................................................................................. 30 

4.2 Overview of organisation of CT and digital technology implemented in EU/EEA countries ....... 31 

4.2.1 Organisation of CT in EU/EEA countries ............................................................................... 31 

4.2.2 Overview of digital technology implemented in EU/EEA countries ..................................... 33 

4.3 Impact of COVID-19 on national and cross-border CT policy ...................................................... 36 

4.3.1 Challenges experienced during the COVID-19 pandemic and solutions implemented ....... 36 

4.3.2 Legal challenges and solutions developed during COVID-19 ............................................... 37 

4.4 Challenges and facilitators with regard to digital technology ..................................................... 39 

4.4.1 National (regular) CT: Challenges and facilitators of digital CT within the country ............. 40 

4.4.2 Cross-border CT: Challenges and facilitators of digital CT with other countries ................. 40 

4.5 Data protection and ethical challenges ....................................................................................... 41 

4.5.1 Data protection .................................................................................................................... 41 

4.5.2 Ethical Challenges ................................................................................................................. 42 

4.6 National and cross-border CT in other communicable diseases and countries’ future directions
 ........................................................................................................................................................... 42 

4.6.1 Top 5 Infectious Disease Outbreaks that countries carry out CT for, other than COVID-19 43 

4.6.2 Countries’ future directions for CT in cases of different ID scenarios ................................. 43 

4.7 Overall lessons learned from COVID-19 on regular and cross-border CT ................................... 45 

5.  Future of cross-border CT in EU/EEA countries: findings.......................................................... 47 

5.1 EWRS selective exchange module and integration of national tools .......................................... 47 

5.1.1 Perspectives on adoption of new features on EWRS selective exchange ............................ 47 

5.1.2 Opportunities regarding integration of national tools into EWRS selective exchange ........ 49 

5.2 International travel-related CT in Europe ................................................................................... 50 

5.2.1 Use of national and EUdPLF to support cross-border CT ..................................................... 50 

5.2.2 Use of passenger data from airlines ..................................................................................... 52 

5.3 The need for EU-level support for regular and cross-border CT ................................................. 54 

5.3.1 The need for EU-level support in relation to digitalisation of national (regular) and cross-
border CT in EU/EEA countries ...................................................................................................... 54 

5.3.2 EU support needs in relation to improve contact tracing software and platforms for cross-
border CT performance ................................................................................................................. 56 

5.3.3 Policy that can facilitate and/or hinder the integration of data resources for CT ............... 56 

6.  Conclusions and Recommendations ..................................................................................... 58 

6.1  What  are  the  main  challenges  and  facilitators  for  carrying  out  cross-border  CT  in  EU/EEA 
countries? .......................................................................................................................................... 58 

5 

 
 
 
Feasibility study on digital technology for cross-border contact tracing 

6.1.1  Overview  of  challenges  and  facilitators  from  the  perspective  of  organisation  of  CT  and 
related digital technology .............................................................................................................. 58 

6.1.2 Overview, challenges and facilitators from the perspective of legislation and ethics ......... 59 

6.2 What (national and subnational) digital tools could be integrated into EWRS, and how could they 
be integrated to allow a more efficient and effective CT across borders? ....................................... 60 

6.2.1 Regulatory background ........................................................................................................ 60 

6.2.2 Adoption of new features on EWRS selective exchange ...................................................... 60 

6.2.3 Possible integration of different national and subnational digital CT technologies into EWRS 
selective exchange functionality ................................................................................................... 61 

6.3. How do countries envision the future of international travel-related CT? ................................ 62 

6.3.1 What are their experiences and views toward using EU dPLFs or national dPLFs integrated 
with ePLF? ..................................................................................................................................... 62 

6.3.2 What are the experiences and views towards using passenger data from airlines? ........... 63 

6.3.3 What are their views towards linking these tools (EUdPLF and ePLF) with the EWRS? ...... 63 

6.4 What are countries’ future plans regarding use of different digital technologies for CT and their 
utilisation for other communicable disease scenarios? .................................................................... 64 

6.5  In  what  areas  would  EU-level  support  be  valuable  to  enhance  cross-border  CT  in  relation  to 
digital technologies?.......................................................................................................................... 64 

6.5.1 Potential EU-level action for cross-border CT with particular focus on digital tools ........... 64 

6.5.2 Potential developments for EWRS ....................................................................................... 65 

6.5.3 Other potential areas of need .............................................................................................. 65 

References ................................................................................................................................. 67 

Appendix A:  Proposed developments for structured cross-border contact tracing ...................... 69 

Appendix B:  List of references in legal sections .......................................................................... 72 

Appendix C:  Summary of the literature review study methods .................................................. 82 

Appendix D:  Survey .................................................................................................................. 84 

Appendix E:  Summary of the interview study methods ............................................................ 102 

Appendix F:  Topics discussed during webinars 1 and 2 ............................................................. 104 

Appendix G:  Summary tables on challenges of digital CT within the country and digital cross-border 
CT, and main lessons learned regarding cross-border CT for COVID-19 ........................................ 106 

6 

 
 
 
Feasibility study on digital technology for cross-border contact tracing 

List of Abbreviations 

Abbreviation 
API 
CNAM 
COVID-19 
CT 
DG SANTE 
DHIS2 
DPIA 
dPLF 
EC 
ECDC 
EDPB 
EEA 
ePLF 
EU 
EUdPLF 
EWRS 
GDPR 
HSRM 
ID 
IHR 
MoH 
Mpox 
MS 
NFP 
NPLF 
PHA 
PHS 
PNR 
PTC 
SORMAS 
STI 
WHO 
WHS 

Austria 
Belgium 
Bulgaria 
Croatia 
Cyprus 
Czechia 
Denmark 

(AT) 
(BE) 
(BG) 
(HR) 
(CY) 
(CZ) 
(DK) 

Iceland 
Liechtenstein 

Switzerland 
United Kingdom 

Definition 
Advance Passenger Information 
French National Health Insurance 
SARS-CoV-2 virus 
Contact tracing 
European Commission’s Directorate-General for Health and Food Safety 
District Health Information Software 
Data protection impact assessment 
Digital Passenger Locator Form 
European Commission 
European Centre for Disease Prevention and Control 
European Data Protection Board  
European Economic Area countries 
Passenger Locator Form exchange platform 
European Union 
European digital Passenger Locator Form 
Early Warning and Response System 
General Data Protection Regulation 
Health System Response Monitor 
Infectious Diseases 
International Health Regulations 
Ministry of Health 
Monkeypox 
Member States 
National Focal Point 
National Passenger Locator Form 
Public Health Authority 
Public Health Services 
Passenger Name Record 
Pre-travel clearance form 
Surveillance, Outbreak Response Management and Analysis System 
Sexually transmitted infection 
World Health Organization 
Whole Genome Sequencing 

European Union (EU) Member States 

Estonia 
Finland 
France 
Germany 
Greece 
Hungary 
Ireland 

(EE) 
(FI) 
(FR) 
(DE) 
(EL) 
(HU) 
(IE) 

Italy 
Latvia 
Lithuania 
Luxembourg 
Malta 
Netherlands 
Poland 

(IT) 
(LV) 
(LT) 
(LU) 
(MT) 
(NL) 
(PL) 

Portugal 
Romania 
Slovenia 
Slovakia 
Spain 
Sweden 

(PT) 
(RO) 
(SI) 
(SK) 
(ES) 
(SE) 

European Economic Area (EEA) Countries 

(IS) 
(LI) 
Non-EU/EEA countries included in the study 

Norway 

(NO) 

(CH) 
(UK) 

7 

 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Executive summary 

Introduction 
Large scale cross-border contact tracing (CT) was conducted  among European Union and European 
Economic  Area  (EU/EEA)  countries  during  the  COVID-19  pandemic  through  the  selective  exchange 
module of the electronic EWRS (Early Warning and Response System) of the European Union (EU). The 
European Commission’s Directorate-General for Health and Food Safety (DG SANTE) commissioned a 
study to assess the lessons learned from the use of the EWRS and to identify future directions for cross-
border CT. This was done by examining the processes and digital technologies that have been used at 
national, EU and international level for cross-border CT, and by identifying challenges and facilitators, 
including  legal  barriers.  The  Commission  was  interested  in  identifying  areas  where  EU-support  is 
needed,  in  line  with  the  overall  goal  of  contributing  to  the  strengthening  the  EU’s  health  security 
framework, and specifically assess the feasibility of linking national and EU-level digital CT technologies 
to the EWRS. The study was conducted by the EUHealthSupport consortium between June 2022 and 
July 2023. 

Background and approach  
Cross-border CT is defined as CT that takes place between two or more countries. Data that needs to 
be  shared between countries  to facilitate cross-border CT relates to travellers (by  transport modes 
such as air, water, and ground) who tested positive for an infectious disease, such as COVID-19 and 
Monkeypox (Mpox), as well as their potentially exposed contacts. The study focused on cross-border 
CT in the 30 EU/EEA countries, with additional data from two neighbouring non-EU countries, including 
travel with planes as the most common transport method involving CT among the countries.  

Based on the literature review and scoping discussions, which were conducted at the start of 
the study, a conceptualisation and graphic were developed on the flow of data within and between 
two  countries  identifying  the  key  actors  and  categories  of  digital  technologies  used  for  CT  during 
COVID-19 (Figure 1). 

Given that the dataflows identified in the model below are between jurisdictions, the study also 
looked at the key legal instruments of the European Union (EU) and World Health Organisation (WHO) 
that provide the legal basis for international cross-border CT in EU/EEA and non-EU/EEA countries: 

•  WHO International Health Regulations (IHR) 
•  Decision No 1082/2013/EU which was repealed and replaced by Regulation (EU) 2022/2371 

In addition to the above key international legal instruments related specifically to public health, the EU 
General Data  Protection  Regulation  No  2016/679 (GDPR)  as well  as  the  national  laws  and  national 
emergency laws that remain applicable in the case of public health threats were also explored. 

Study questions were the following:  

•  What  are  the  main  challenges  and  facilitators  for  carrying  out  cross-border  CT  in  EU/EEA 

countries? 

•  What (national and subnational) digital tools could be integrated into EWRS, and how could 

they be integrated to allow a more efficient and effective CT across borders? 

•  How do countries envision the future of international travel-related CT in Europe, including 

using EU digital Passenger Locator Forms (EU dPLFs) or national dPLFs? 
In what areas would EU-level support be valuable for facilitating cross-border CT? 

• 

8 

 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Figure 1. Digital tools used for CT in EU/EEA countries during COVID-19  

CT data transmission tools (yellow): Digital technology that contributes to the transmission of CT data between the public 
health institutes or agencies, Public Health Authorities (PHAs) and other organisations. - Outbreak investigation tools (blue): 
Platforms and tools, such as CT case management systems used by PHAs to support the core tasks of CT. -  Digital CT tools 
where  citizens  can  share  data  with/receive  data  from  PHAs  (green):e.g.  Online  forms  (including  dPLF  and  EUdPLF)  for 
collecting and sharing travellers’ data with health authorities and digital contact tracing support (DCTS) tools for citizens to 
share  their  contacts  with  health  authorities.  -  Citizen  to  citizen  warning  and  tracing  apps  (orange):  These  are  mainly 
proximity-based apps for detecting people who have been near to a person with an infection and possibly exposed to the 
infectious agent, using Bluetooth, Wi-Fi or GPS.  

Methods 
For this comprehensive mixed methods study, data were collected by means of the following: 

1.  A literature review on scientific and grey literature;  
2.  A comprehensive survey with largely open answer fields offered to all EU/ EEA countries to 

which 23 countries responded in December 2022-January 2023; 

3.  Semi-structured interviews with nine EU Member States (Austria, Czech Republic, Germany, 
Finland,  France,  Latvia,  Malta,  the  Netherlands  and  Spain)  and  two  non-EU  countries 
(Switzerland and the United Kingdom); and 

4.  Two  webinars  with  participants  from  various  EU/EEA  countries  in  which  members  of  the 
Health Security Committee, Joint Controllers Group on EWRS and ePLF as well as members of 
relevant networks of European Centre for Disease Prevention and Control (ECDC) took part.  

Survey and interview data were mainly analysed qualitatively with open coding followed by thematic 
analysis around research questions. The webinars were used to validate preliminary findings, obtain 
further insights, and discuss future perspectives.  

Findings on national and cross-border CT practices and digital technology in EU/EEA countries in 
relation to COVID-19 
In most countries, national public health institutes or agencies were responsible for cross-border CT 
and regional Public Health Authorities (PHAs) were responsible for subnational and national CT within 
countries.  Countries  used  a  large  variation  of  CT  digital  tools,  which  were  divided  into  the  four 
categories  (see  Figure  1  above  and Table  1,  page  14):  (1)  Outbreak  investigation  and  management 
tools, including CT case management systems (2) Digital CT tools where citizens and PHAs can share 
data,  (3)  Citizen-to-citizen  warning  and  tracing  apps,  and  (4)  CT  data  transmission  tools.  Countries 

9 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

varied in the number of CT case management tools used to register cases and their contacts: from no 
or one main case management system to various case management systems in different regions in a 
country.  

A number of challenges for CT were identified during the COVID-19 pandemic due to the ease 
at which the virus spread, the large number of cases and the high levels of morbidity and mortality. 
The surge in cases led to insufficient human resources to conduct CT within most countries and some 
countries lacked digital technology that could have supported with the registration of all the cases and 
their contacts. Countries found that it could be difficult to obtain contact details from the public during 
CT  especially  in  the  later  phases  of  the  pandemic.  Due  to  the  decentralised  organisation  in  most 
countries  (see  Table  7,  page  32),  CT  was  usually  conducted,  and  relevant  data  stored  at 
regional/subnational level. Several countries reported a lack of integration of policies, CT processes 
and  digital  technology  among  regions,  making  it  difficult  to  share  CT  data  or  agree  on  guidelines. 
Several  countries  also  reported  that  databases  registering  relevant  CT  data,  such  as  test  results  or 
vaccine status, were not linked to the same cases registered in other digital systems. Most countries 
introduced new law(s) to enable the scale of CT that was required during the pandemic, with most of 
them using sunset clauses for legislative acts, meaning that many are now no longer in place. 

To mitigate the transmission of the virus by people travelling between countries, cross-border 
CT was also conducted. Most authorities conducting cross-border CT received data from regional PHAs 
by secure mail or phone. Therefore, a lot of manual work was required, which was time-consuming 
and could be prone to error. They often received no response from other countries regarding the data 
they had sent and therefore did not know how the data had been handled. Several countries reported 
issues with missing information, errors, and delays in the CT data they received from other countries. 
There were also issues when it came to obtaining passenger data from airlines. As airlines were often 
reluctant to share these data, even though most countries confirmed that this practice had a legal base 
in national legislation, the data could also be late or incomplete. Different CT policies in each country 
meant that countries had varying definitions for CT-relevant concepts such as ‘close contacts’, which 
had implications for the type and quantity of data they shared with other countries. Cross-border CT 
practices also varied regarding when data sharing should continue or discontinue, meaning that over 
the course of the COVID-19 pandemic, data sent by one country was sometimes not acted upon by the 
receiving  country.  Doubts  were  expressed  by  countries  as  to the  added  value  of  conducting  cross-
border CT, especially at later stages of the pandemic when all countries faced high numbers of cases.  
To address these issues, countries were compelled to devise strategies for conducting CT as 
efficiently  as  possible  to  try  to  curb  the  transmission  of  the  virus.  Large  numbers  of  additional 
workforce members were recruited from various medical and non-medical fields, and new CT units, 
working  spaces  and  materials  were  created.  Digital  case  management  systems  were  adjusted, 
upgraded, or newly developed to accommodate the rising numbers of cases. Additional tools including 
proximity-based apps were developed and new technology led to improved access to and monitoring 
of lab and vaccination data.  

Special organisations were set up to implement national guidelines to be used across regions 
within a country, with some countries trying to standardise procedures as much as possible. Just over 
half of all countries reported using the same CT case management to register data. When it became 
too difficult to keep up with case numbers, CT policies adjusted to focus more on high-risk cases and 
their contacts. Several countries reported a shift to self-service by citizens to support the CT process 
and relieve the burden on PHAs conducting CT. Instead of lengthy phone calls between PHAs and index 
cases  to  obtain  contact  details,  citizens  were  directed  to  online  forms,  for  example,  to  fill  in  their 
contact  details  and  at  times  they were  asked  to  inform their  contacts  themselves.  PHAs  in  several 
countries  sent  SMS  messages  to  contacts  instead  of  calling  them,  to  inform  them  of  their  risk  of 
exposure and to provide instructions on further steps to take. The evolving pandemic led countries to 
have to adopt a dynamic approach to CT strategies. 

When countries reached a community level transmission and were often overwhelmed with 
cases at the national level, they chose to focus more on transmission within the country and cross-

10 

 
 
 
Feasibility study on digital technology for cross-border contact tracing 

border CT was often deprioritised. Bilateral communication between specific countries was considered 
beneficial, as well as policy decisions that limited cross-border CT only to certain conditions during the 
pandemic. Tools such as the EWRS and the EUdPLF were generally considered useful when it came to 
facilitating  cross-border  CT  with  EU/EEA  countries,  however  most  of  the  countries  also  kept  using 
secure email. 

Findings on the EWRS selective exchange module and integration of national tools 
Despite countries’ positive perspectives on the EWRS for being a safe and generally efficient platform, 
it was considered less efficient in peak periods of the pandemic, as it was labour-intensive. There was 
a need for definition of minimally required data and a standardised structure to share data through 
the EWRS to improve data quality, timeliness, and coordination between countries. According to MS, 
inclusion of dPLF data as part of  the EWRS selective exchange  could  lead to  better coordination of 
sharing data  as well as increase  usability, especially  if all countries used  dPLFs and the dPLFs  were 
completely integrated. 

The integration or linkage of national and subnational digital CT technologies into EWRS was 
considered to be beneficial for countries, to increase efficiency and effectiveness of cross-border CT. 
From the legal perspective, EWRS is a secure and GDPR compliant platform for sharing CT data with 
Regulation (EU) 2022/2371 permitting the continuous development of EWRS allowing for the use of 
modern technologies.  

However, there were  challenges  in terms of organisational  and  policy aspects. There was a 
large variation in number/type of organisations involved in regular and cross-border CT in countries. 
Smaller  countries  excluded,  most  countries  had  a  decentralised  organisation of  CT,  where  regional 
organisations had the most prominent role and managed the digital technologies used for CT, whereas 
guidance on when and how to carry out CT came from national authorities. From an organisational 
perspective, there appeared to be a low feasibility of integration of national and subnational digital CT 
technologies into EWRS, except for smaller countries and a few countries where CT (technology) was 
relatively centralised or being centralised.  

From  a  technological  perspective,  there  was  a  large  variation  in  types  of  digital  CT  case 
management  systems  across  and  within  countries  and  well  known  platforms  such  as  Go.Data  and 
SORMAS had limited use. A national EWRS operator conducting cross-border CT often got the data 
from  (sub)national  actors  such  as  local  or  regional  PHAs  with  secure  email  and  by  telephone  and 
platforms, such as online forms. Having a very large variety and limited integration of national and 
subnational outbreak management  systems used for CT  in EU/EEA countries  significantly limits the 
feasibility of linking them to EWRS. 

For these reasons, the feasibility of integration of (sub)national tools into EWRS is limited at 
this moment. In current circumstances, an option would be to provide access to subnational actors for 
those countries who wish to have this. This can in particular improve timeliness and efficiency of cross 
border CT for larger countries with a decentralised organisation.  

Findings on international travel-related CT in Europe 
During  the  COVID-19  pandemic,  almost  all  EU/EEA  countries  who  responded  the  survey  received 
passenger data from airlines for CT purposes on the basis of national (public health) laws or legislation 
adopted  as  response  to  COVID-19.  However,  this  data  often  came  with  delays  or  were  sometimes 
incomplete or incorrect. Several countries wished to have direct or easier access to passenger data, 
rather  than communicating  requests  for  data  individually  with each  airline,  but  this  is  not  possible 
under current EU and national legal frameworks.  

When direct access to or direct availability of passenger data was not possible, using the dPLF 
(in particular EUdPLF) was often regarded as the next best option during pandemics or other large 
outbreaks. Using the national dPLF or EUdPLF increases efficiency, improves data security, accessibility 
and  quality.  During  the  COVID-19  pandemic,  four  countries  used  EUdPLF,  but  several  countries 
reported they would consider using it if legal barriers were removed or that they were indeed already 

11 

 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

preparing to join the EUdPLF. Legal challenges specific to EUdPLF were related to data storage concerns 
as well as the need for further considerations to amend national laws. The benefits, evidence of the 
effectiveness and efficiency of dPLFs, as well as proportionate use of dPLFs, especially balancing the 
public  health  benefit  with  potentially  infringing  the  privacy  of  travellers,  need  to  be  further 
investigated. Most countries relied on new legislation with a sunset clause to introduce PLFs and would 
again need new legislative acts to re-activate these tools. Decision on whether to use PLFs and under 
what circumstances is an important national competence for pandemic preparedness. 

Recommendations on potential areas of EU-level support to enhance cross-border CT with 
particular focus on digital tools 
Surveys,  interviews  and  webinars  indicated  the  following  potential  areas  where  EU-level  support 
would be valuable: 
Potential EU-level action for cross-border CT: 

•  Developing  evaluation  frameworks  and  examining  the  evidence  for  effectiveness  of 
performing cross-border CT to reduce transmission in the country of origin or destination, and 
during journeys by collective transportation means. 

•  Providing guidance on when to activate/deactivate cross-border CT in EU/EEA countries with 

a risk-based approach tailored to the context and needs of countries. 

•  Sharing  minimum  system  requirements/functionalities  for  (sub)national  CT  technologies  as 
several countries are moving forward with developing national or subnational systems for CT 
for future outbreaks. 

Potential developments for EWRS: 

•  Facilitating  sharing  of  country-specific  and  up-to-date  CT-relevant  measures  and  policies 
through common platforms, such as the EWRS, to support the alignment between countries 
in cross-border CT (while at the same time retaining country autonomy) on which countries 
can decide to send outgoing CT requests during outbreaks, the type of data to share, when to 
send this data, and in the definitions of CT-relevant concepts, such as ‘close contacts’. 

•  Providing a system or development of a module that allows subnational actors to have access 

to EWRS selective exchange to share cross-border CT data. 

Other potential areas of need: 
On legal and ethical aspects 

•  Supporting  the  implementation  of  Regulation  (EU)  2022/2371  in  the  context  of  digital 

technologies through EU engagement and discussions with MS. 

•  Guidance on how to apply GDPR to digital technology used for national and cross-border CT. 
•  Development of codes of practice for ethical CT when using digital technologies, along with 

codes to protect the privacy and fundamental rights of citizens. 

•  Creation of standardised data-sharing templates with the involvement and agreement of the 
European  Data  Protection  Board  (EDPB)  to  build  acceptance  of  CT  data  sharing  as  a  GDPR 
compliant form of data processing. 

On collaboration across EU/EEA countries 

•  Providing an EU platform or other means to exchange good practices among EU/EEA countries 
on national and cross-border CT regarding issues such as organisation of CT with subnational 
actors, collaboration with airlines, standards of digital CT technologies, and ethical principles 
in CT for Sexually Transmitted Infections (STIs) and other diseases transmitted through close 
contact. 

On collaboration beyond EU/EEA countries  

•  Development or identification of a GDPR compliant platform for sharing CT data with countries 

outside EU/EEA. 

12 

 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

1. Introduction 

1.1 Introduction to the EU feasibility study 

The  EUHealthSupport  Consortium  has  undertaken  a  study  commissioned  by  the  European 
Commission’s Directorate-General for Health and Food Safety (DG SANTE) to examine cross-border 
contact tracing (CT) among European Union and European Economic Area (EU/EEA) countries. Cross-
border CT is defined as CT that takes place between two or more countries and the data to be shared 
pertains  to  travellers  (by  transport  modes  air,  water  and  ground)  who  have  tested  positive  for  an 
infectious disease, such as COVID-19, as well as their potentially exposed contacts. The study focuses 
on CT data-exchange carried out in Europe through the Early Warning and Response System (EWRS) 
selective  exchange  module  and  aims  to  examine  the  digital  technologies  that  have  been  used  at 
national,  EU  and  international  level  during  the  COVID-19  pandemic,  to  serve  the  overall  goal  of 
contributing to the strengthening of the EU’s health security framework. To enable this, the European 
Commission (EC) would like to determine the feasibility of linking digital CT technologies to the EWRS.  
To  enable  a  more  effective  sharing  of  cross-border  CT  data,  the  EC  would  like  to  obtain 
information on the digital technology used for CT at national, European Union (EU) and international 
level by Member States (MS). This is needed to shed more light on the results of, a survey conducted 
by the EC in 2022 with national focal points (NFPs). The survey revealed that most of the countries 
recognise the need for a platform, such as the Passenger Locator Form exchange platform (ePLF), to 
enable a faster exchange of passenger data for CT purpose, and that it would be beneficial to connect 
the  ePLF  to  the  EWRS  selective  exchange  module  to  ultimately  improve  the  effectiveness  of 
international travel-related CT in Europe for COVID-19 and other infectious diseases.  

The present study explores overall gaps and challenges in CT practices and highlights where 
there are solutions and windows of opportunity to improve CT practices. Key issues examined were 
the following:  

•  What  are  the  main  challenges  and  facilitators  for  carrying  out  cross-border  CT  in  EU/EEA 

countries? 

•  What (national and subnational) digital tools could be integrated into EWRS, and how could 

they be integrated to allow a more efficient and effective CT across borders? 
•  How do countries envision the future of international travel-related CT in Europe? 

o  What  are  their  experiences  and  views  toward  using  EU  dPLFs  or  national  dPLFs 

integrated with ePLF?  

o  What are their views towards linking these tools (EUdPLF and ePLF) with the EWRS? 

•  What are countries’ future plans regarding use of different digital tools and applications and 

their utilisation for other communicable disease scenarios? 
In what areas would EU-level support be valuable for facilitating cross-border CT? 

• 

The study included the 30 EU/EEA countries, as well as two neighbouring non-EU countries (the United 
Kingdom (UK) and Switzerland (CH)). The EU countries are Austria (AT), Belgium (BE), Bulgaria (BG), 
Croatia (HR), Cyprus (CY), Czech Republic (CZ), Denmark (DK), Estonia (EE), Finland (FI), France (FR), 
Germany (DE), Greece (EL), Hungary (HU), Ireland (IE), Italy (IT), Latvia (LV), Lithuania (LT), Luxembourg 
(LU), Malta (MT), the Netherlands (NL), Poland (PL), Portugal (PT), Romania (RO), Slovakia (SK), Slovenia 
(SI),  Spain  (ES)  and  Sweden  (SE).  Additional  EEA  countries  are  Iceland  (IS),  Liechtenstein  (LI),  and 
Norway (NO). Countries will be referred to with these codes in the rest of the document. 

13 

 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

1.2. Introduction to the final report 

To investigate the research questions, the EUHealthSupport Consortium conducted a comprehensive 
mixed  methods  study.  This  final  paper  provides  the  findings  gained  from  various  sources  of  data 
brought together in the various phases of the study. In the first phase a literature review report was 
conducted,  which  was  used  to  develop  the  frameworks  for  analysing  the  digital  technology,  the 
organisation  of  CT  in  countries  and  legal  aspects.  This  framework  for  analysing  digital  technology 
consisted of four categories of digital technology used by public health services (PHS) and citizens for 
CT (see chapter 2 for more detailed information). Other than this, the literature review yielded limited 
information as it was skewed towards proximity-based apps. Second, a comprehensive survey was 
conducted and completed by EU/EEA countries in December 2022 and January 2023. The survey aimed 
to  collect  data  on  regular  and  cross-border  CT  practices,  experiences,  digitalisation,  and  legal 
frameworks,  and  identify  lessons  learnt  from  the  COVID-19  pandemic  in  relation  to  CT  and 
strengthening of cross-border CT practices at national, EU and international level. Third, interviews 
were  conducted,  from  January  to  March  2023,  with  nine  EU/EEA  and  two  non-EU  countries, 
investigating what national and international level barriers or facilitators impacted countries’ ability, 
willingness  or obligation to conduct  cross-border CT. Finally, two webinars were held on the 6th  of 
March  and  the  21st  of  April  2023,  respectively,  to  validate  preliminary  findings  from  the  literature 
review, survey and interviews and discuss future perspectives for cross-border CT in Europe.  

This final report has been written by combining the four phases outlined above. The outline of 

the final paper is as follows:  

•  Chapter 1 provides an introduction to the general study and this specific report, as well as the 

key questions that will be addressed. 

•  Chapter  2  focuses  on  background  information  that  is  relevant  to  this  study  with  regard  to 

national and cross-border CT, and digital technology for CT. 

•  Chapter 3 provides additional details pertaining to the various methods used in this study, as 

well as a description of the study population that provided the data.  

•  Chapter 4 presents the findings regarding national and cross-border CT practices, digital CT 
technology and legislation in EU/EEA countries. These findings relate to COVID-19, as well as 
other infectious diseases.  

•  Chapter  5  focuses  mainly  on  the  future  of  cross-border  CT  in  EU/EEA  countries.  Several 
subsections  cover  topics,  including  countries’  perspectives  of  the  EWRS  selective  exchange 
module,  the  EUdPLF  and  national  dPLFs;  their  experiences  and  views  toward  obtaining 
passenger data from airlines; and the ways in which countries would like digital technological 
and non-technological support from the EU for national and cross-border CT.  

•  Chapter 6 presents the main conclusions and recommendations.  

This report focuses on presenting the most important findings that serve the overall goals of the study. 
Some sections will refer to appendices in which additional information is given. Further details can be 
found in the separate literature review, survey, and webinar reports of the study. 

14 

 
 
 
 
 
  
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

2. Background:  national  and  cross-border  CT  and  digital 

technology 

2.1 Relevance of cross-border CT  

Contact tracing (CT) is an essential and effective measure when it comes to containing the transmission 
of infectious diseases(1). This process traditionally consists of identifying and notifying the contacts of 
index cases (individuals who have tested positive to an infectious disease), followed by monitoring the 
health of index cases and their contacts. Index cases and their contacts are provided with instructions 
on further steps to take, such as isolating (if having tested positive) or quarantining (if having been 
exposed to an index case). In many countries, local Public Health Authorities (PHAs) are responsible 
for conducting CT, whereas in some countries, centralised organisations are responsible.  

As infectious diseases can spread into other countries via different routes including travellers, 
it is also important that CT enables the timely tracing of individuals who have become infected due to 
exposure before or during travel (index cases), as well as anyone they may have exposed before, during 
or after travel (contacts). Studies have shown that infectious agents spreading to other countries can 
drive  up  infection  rates  substantially  in  those  countries(2).  Collective  transport  vehicles,  such  as 
airplanes,  can  also  lead  to  large  numbers  of  exposed  and  high-risk  contacts,  due  to  the  proximity 
between passengers for lengthy periods of time(3, 4). Timely cross-border CT may not only be essential 
for  infectious  disease  outbreaks  that  may  reach  epidemic/pandemic  proportions,  but  also  in  the 
scenario of a single or few case(s) of imported diseases with a severe impact (such as Ebola or other 
viral haemorrhagic fevers). This will enable early disease recognition, early treatment, if available, and 
the prompt implementation of measures to prevent onward transmission(5). 

2.2 Digital technology for CT 

Digital  technology  is  being  explored  by  many  countries  worldwide  as  a  mechanism  to  assist  with 
different components of CT, as well as with the collection and sharing of CT data. As a result of the 
COVID-19  pandemic,  which  has  overburdened  CT  functions  within  PHA(6,  7),  countries  have  been 
developing  digital  tools  to  facilitate  the  CT  process.  Some  digital  tools  are  geared  to  public  health 
professionals,  such  as  outbreak  and  management  tools  that  enable  the  registration,  storage,  and 
exchange of CT data. Other tools are intended for citizens, such as the proximity-based apps. Our study 
identified four main types of digital tools used for CT (Table 1):  

Table 1. Types of digital technologies used by PHA and citizens for CT 

Outbreak investigation 
and management tools 

Digital  CT  tools  where 
citizens can share data 
with/receive 
data 
from PHAs  

Platforms and tools, such as CT case management systems used by PHAs to support 
the core tasks of CT including the registration of data relating to index cases and 
their exposed contacts, and the storing and sharing of CT data across authorities for 
purposes such as surveillance and international data-exchange. Examples of these 
tools identified during the literature review include the WHO’s digital application 
Go.Data,  which  has  been  used  in  many  countries(8),  the  tools  District  Health 
Information Software (DHIS2)(9) and Surveillance, Outbreak Response Management 
and Analysis System (SORMAS®)(10).  
These include online forms (including dPLF and EUdPLF) for collecting and sharing 
data  on  travellers  with  relevant  health  authorities  and  digital  CT  support  tools 
(DCTS-tools). The digital tools dPLF and EUdPLF are discussed further on. DCTS-tools 
(e.g., websites or mobile apps) mimic traditional CT by enabling citizens to assume 
at least some of the tasks required for CT, such as collecting their contact details 
themselves. This information can then be shared with health services conducting 
CT.  These  tools  can  be  used  for  three  main  phases  of  CT  a)  case  and  contact 
investigation  (supporting  PHA  in  the  investigation  of  cases  and/or  contacts),  b) 

15 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Citizen 
citizen 
to 
warning  and  tracing 
(mainly 
apps 
proximity-based apps) 

CT  data  transmission 
tools 

contact notification (allowing PHA to notify contacts) and c) remote monitoring of 
the health of index case and contacts by PHAs(11). 
Proximity-based apps are mobile applications for citizens that have been developed 
in many countries for detecting people who have been near to a person with an 
infection  and  possibly  exposed  to  the  infectious  agent,  using  Bluetooth,  Wi-Fi  or 
GPS(12). These apps can have functionalities that enable citizens to share data with 
health services conducting CT, but they are generally used outside of the scope of 
these  health  services.  DCTS-tools  (described  earlier)  can  also  fall  within  this 
category when they are used by index cases to notify  their contacts and provide 
them with instructions themselves. 
These types of digital tools have been coined by the EUHealthSupport Consortium 
to refer to the digital technology that contributes to the transmission of CT data 
between  the  public  health  institute  or  agency  in  charge  of  cross-border  data 
exchange  and  other  organisations  in  a  country  such  as  secure  email,  Excel, 
encrypted  server  (e.g.,  FTP  server),  online  form  or  a  secured  communication 
platform (e.g., the EWRS). 

Among the cross-border CT technologies, the EUdPLF and the ePLF were developed during the COVID-
19 pandemic to facilitate the exchange of passenger data across EU/EEA borders. The EUdPLF is an 
online form and database for collecting and sharing passenger data with other countries, and it can be 
customised  to  each  country’s  needs.  PLFs  (in  paper  or  digital  form,  i.e.,  dPLF)(13) had  already  been 
developed  by  the  WHO  (before  the  COVID-19  pandemic)  as  traveller  documents  for  passengers  of 
airplanes and other modes of transportation (e.g., ships or trains). They are used to collect personal 
information (e.g., contact details), so they can be traced in case of exposure for CT purposes. They may 
also be used in combination with other types of data, such as symptoms, vaccine certificates, negative 
test results or quarantine requirements. It is possible to connect many countries’ dPLFs to the ePLF, a 
platform enabling the exchange  of data with other countries. Countries that do not  have dPLFs, or 
who's national dPLFs cannot connect with the EU exchange platform, can make use of the EUdPLF, 
which  is  already  connected  to  the  ePLF.  During  the  COVID-19  pandemic,  only  four  EU  countries 
implemented the EUdPLF (FR, IT, MT and SI), and one additional country joined the ePLF platform with 
their  national  dPLF  (ES).  Reasons  reported  by  EU  countries  for  not  using  the  EUdPLF  or  the  ePLF 
included already having developed their own national PLFs, and concerns about legal aspects, such as 
data protection. Although many countries were interested in using the EUdPLF, there were countries 
that were less interested in the EUdPLF and plan to continue to use only EWRS for cross-border CT(14). 
The graph below depicts where the types of technology presented in Table 1 are used in the 

cross-border CT process, as well as the relevant actors and organisations involved (Figure 1).  

16 

 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Figure 1. Digital tools used for CT in EU/EEA countries during COVID-19 

Digital tools used for cross-border CT include the EWRS selective exchange functionality, the exchange 
platform ePLF and the EUdPLF(15). 

The EU regulatory framework (Regulation EU 2022/2371(16) and before that the Decision No 
1082/2013/EU(17) which will be introduced in following sections) enables PHAs of the EU MS and EEA 
countries to use the EU EWRS and send selective exchange messages with personal data for cross-
border CT purposes. The current selective exchange provides the functionality to exchange messages, 
using  simple  text  and  transfer  attachments,  without  an  agreed  structure.  The  Commission 
Recommendation 2017/1140(18) defines the procedures for the exchange of personal data and the type 
of variables, which can be exchanged using EWRS.  

After the adoption of the new Regulation in November 2022, the EC proposed a number of 
developments for structured cross-border CT. The first development is reviewing the variables that 
can  be  exchanged  for  cross-border  CT,  updating  the  Commission  Recommendation  2017/1140(18). 
Second,  the  EWRS’s  new  architecture  will  support  the  selective  exchange  for  CT  becoming  an 
independent module, which will provide the ability to separate data access to specific users. The CT 
officers will be nominated by the MS Authorities, thus limiting the exposure of the sensitive data. The 
system will enable importing of CT data to the selective exchange messages and will also allow sharing 
with  multiple  recipient  countries,  while  limiting  actual  access  only  to  those  involved.  Appendix  A 
provides a more detailed description of these developments.  

Third, the working hypothesis is about integration of the ePLF to the EWRS selective exchange 
module, which is currently being considered by EWRS managers. The ePLF platform can support the 
exchange of traveller CT data, collected by the national dPLFs, including those countries that are linked 
with the EUdPLF. This integration will allow the EWRS to receive CT data from the ePLF system and to 
display it to the recipient country/countries via the EWRS selective exchange functionality. 

17 

 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

2.3 Legal aspects of cross-border CT 

There are two key international legal instruments (WHO and EU legislation) that provide the legal basis 
for international cross-border CT in EU and non-EU countries: 

o  WHO  International  Health  Regulations  (IHR)(19):  WHO  MS  are  required  to  prevent, 
protect,  control  and  provide  a  public  health  response  to  the  international  spread  of 
certain  diseases.  The  194 countries  that  have  signed  these  regulations  need  to  have  a 
national focal point that is responsible for exchange of health-related data on the diseases 
included in the IHR, using the WHO IHR platform. 

o  Decision No 1082/2013/EU of the European Parliament and the Council on serious cross-
border threats to health(17, 18): Decision No 1082/2013/EU established the EWRS through 
which MS authorities are obliged to notify alerts in relation to serious cross-border threats 
to health to a centralised platform. In cases where personal data need to be shared to 
facilitate CT, the Decision states that sharing personal data for the purpose of CT can only 
be  done  through  the  selective  messaging  functionality,  which  ensures  the  required 
security and confidentiality.  
Decision  No  1082/2013/EU  has  been  repealed  and  replaced  by  Regulation  (EU) 
2022/2371(16)  on  serious  cross-border  threats  to  health.  This  came  into  effect  on  26th 
December 2022, following publication in the Official Journal of the European Union on 6th 
December 2022. The new regulation provides a more robust mandate for coordination 
and obligates EU MS to convey information on communicable diseases and other serious 
health threats with a potential cross-border dimension. Adding to the framework of the 
Decision,  the  Regulation  will  do  the  following:  (1)  Develop  an  EU  health  crisis  and 
pandemic  plan  to  complement  national  plans,  the  Commission  will  establish  a 
preparedness  and  response  plan;  (2)  Enhance  risk  assessments  for  health  threats;  (3) 
Increase  power  to  enforce  a  coordinated  response  at  EU-level;  (4)  Improve  the 
mechanism  for  the  recognition  of  and  response  to  public  health  emergencies  and  (5) 
Strengthen surveillance systems.  

In addition, there are national laws and national emergency laws that are applicable in the case of 
public health threats to establish the main characteristics of legal frameworks essential for pandemic 
preparedness. Data protection and data sharing arrangements across EU/EEA countries form a cross-
cutting element of the legal framework. The requirement for lawful data processing, which is essential 
for CT, is a core part of the General Data Protection Regulation No 2016/679 (GDPR)(20). 

2.3.1 Regulation (EU) 2022/2371 and the EWRS 

Under the Regulation(21), the EWRS ensures that national authorities and the Commission are informed 
about  a  serious  cross-border  threat  to  health  in  a  timely  manner  and  that  a  line  of  permanent 
communication is open (Art.18). It also provides for the continuous update of EWRS allowing for the 
use  of  modern  technologies  such  as  digital  mobile  apps,  artificial  intelligence  models,  or  other 
automated CT technologies. The European Centre for Disease Prevention and Control (ECDC) in close 
cooperation with MS will facilitate interoperability with national systems for the purposes of EWRS. 

The  Regulation  sets  out mechanisms  for the  protection of  personal  data  when utilising  the 
EWRS selective  messaging  functionality  for the  purposes of  CT  only  (Art.28).  A  selective messaging 
functionality will allow personal data, including contact and health data, to be communicated only to 
the national competent authorities involved in CT measures and medical evaluation procedures. The 
sharing  of  personal  data  necessary  for  the  purpose  of  CT  is  permitted  within  the  Regulation  (Art. 
19(3)(k)). Data will automatically be  deleted from the selective message  functionality 14 days after 
posting. 

18 

 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Regulation  (EU)  2022/2371  allows  for  the  exchange  of  personal  data  using  CT  technology,  where 
necessary,  and  specifies  that  data  should  be  retained  for  no  longer  than  is  required  by  national 
authorities in the context of their CT activities (Art.28(5)). Provision for delegated Acts is made within 
the Regulation, which will detail EWRS compliance with the GDPR and lists the categories of personal 
data  that  may  be  exchanged  for  the  purpose  of  CT  (Art.28(6)).  Additional  provision  is  made  for 
implementing Acts which will set out procedures for the interlinking of EWRS with CT systems at Union 
and  international  level  in  addition  to  the  modalities  for  processing  CT  technologies  and  their 
interoperability in compliance with GDPR (Art.28(7)). For the legal provisions, please refer to Appendix 
B. 

2.4 CT at national and international level within Europe 

2.4.1 National level 

At the time of the study, there was limited information available in the literature regarding how CT for 
COVID-19  has  been  conducted  nationally  in  EU  and  EEA  countries  throughout  the  pandemic.  The 
available information stems mainly from 2020(22, 23, 24). In 2020, the organisations conducting CT varied 
between countries and changed over time. CT was mainly carried out by public health services, but in 
some  countries  CT  was  conducted  by  call  centres,  General  Practitioners,  and  other  physicians  or 
hospital staff(23). As the pandemic progressed, particularly when infection rates reached high levels, 
there  were  changes  in  the  ways  that  organisations  conducted  CT.  In  DK,  for  example,  there  was  a 
gradual shift in CT from a central CT organisation (the Danish Patient Safety Authority) to municipalities 
carrying out CT in early 2021. During the second wave of infections after the summer of 2020, many 
countries needed to increase their staff by enlisting volunteers or hiring others (e.g. medical students, 
members from the armed forces and civil servants(24)). The CT approaches were also modified in many 
countries  when  the  outbreak  size  was  large  and  CT  services  were  overburdened.  Index  cases,  for 
example, were asked to identify and inform their own contacts regarding the requirement to go into 
quarantine  and  to  monitor  their  own  health.  CT  activities  conducted  by  CT  health  services  were 
focused on high-risk index cases and their contacts, e.g. index cases who were not able to identify and 
inform all their contacts, or whose contacts already had health issues(23). 

2.4.2 International level 

Information on how cross-border CT was conducted in EU countries during the COVID-19 pandemic is 
even  scarcer  in  the  literature  than  that  of  how  national  CT  was  conducted.  DE  published  a  study 
detailing how they conducted cross-border CT during the first few months of the pandemic in 2020(3). 
The study reported that relevant information on index cases and their contacts were shared by local 
German PHAs with the Robert Koch Institute (RKI), which is the German authority in charge of sharing 
cross-border CT data through EWRS. The EWRS focal point at RKI shared the relevant CT data with 
EU/EEA  countries  through  the  EWRS  selective  exchange  platform.  Data  was  transmitted  by  secure 
email  via  the  IHR  national  focal  point  in  DE  to  WHO  non-EU  member  states.  Personal  data  was 
transmitted to non-EU countries by means of an encrypted exchange server (Cryptshare).  

In NL, data about index cases and their contacts were first registered and stored in the main 
case  management  systems  (HP-zone  and  GGD  Contact)  used  by  the 25  local  public  health  services 
situated throughout the country. The data was conveyed to the authority in charge of sharing cross-
border  CT  data,  the  National  Institute  for  Public  Health  and  the  Environment  (RIVM)  in  the 
Netherlands,  by  secure  email.  This  authority  in  NL  then  shared  this  information  through  the  EWRS 
selective exchange platform with relevant EU countries and by secure email to non-EU countries. More 
country profiles on how cross-border CT was conducted was developed based on the data obtained 
from the surveys and interviews in this study.  

19 

 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Infectious  diseases  can  also  be  transmitted  during  the  journey  by  collective  transportation  means 
(plane, train, ferry, cruise ship). To carry out CT involving such cases, countries may utilise different 
approaches depending on their national legislation. At EU-level, CT for international flights could be 
facilitated with the use of national dPLFs, or through the EUdPLF. Countries may also have used data 
obtained from carriers for international travel, such as airlines. The data can be in the form of Advance 
Passenger Information (API) (for passengers coming from countries outside the Schengen area) and 
Passenger  Name  Record  (PNR)  (for  passengers  from  within  the  Schengen  area)  which  are  used  to 
collect passenger data before boarding (by air, water, or ground).  

Various scenarios are possible when it comes to countries  needing to exchange  data about 
index cases and their contacts who are at risk. Countries also conduct this process in different ways. A 
typical cross-border CT process can be visualised with steps 0-4 in Figure 2.  

Figure 2. Dataflow of cross-border CT between EU/EEA countries and the relevant organisations involved 

A brief description of steps in one typical scenario is as follows: 
1:  A traveller from country B tests positive in country A.   
2:  The  health  services  conducting  CT  in  Country  A  share  the  index  case’s  data  with  the  PHA 
conducting cross-border data exchange in country A. These health services also notify the 
index case’s contacts in country A who may have been exposed. 

3:  The PHA conducting cross-border data-exchange in country A, shares the data of the index 
case via the EWRS selective exchange platform with the PHA conducting cross-border data 
exchange in country B. 

4:  The PHA conducting cross-border data exchange in country B shares the data of the index 

case 

      (including exposed contacts) with health services conducting CT in country B. These health 
services conducting CT in country B, notify the contacts who were exposed to the index case 
before  his/her  departure  and  if  necessary,  instruct  them to  quarantine  and  monitor  their 
symptoms.  Contacts  are  asked  to  test  if  they  have  symptoms,  and  if  positive,  to  go  into 
isolation for a set period of time. 

20 

 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Step 0 applies to countries where procedures using national dPLFs or the EUdPLF are in place.  

0:  Passengers from country B who are going to country A by a collective mode of transport (e.g., 
by airplane, ship, bus or train) complete a dPLF (national or EUdPLF) before departure. This 
information is stored by the relevant health authority in the country of arrival (country A) for 
a set period of time, pre-determined by country A. If a passenger tests positive after arrival 
to country A, this data can be shared automatically through the PLF exchange platform (ePLF) 
with the relevant health authorities in other countries. Passengers who have possibly been 
exposed  to  the  index  case  during  the  journey  are  identified,  notified  of  their  risk,  and 
provided with instructions on further steps to take (e.g., to quarantine, monitor their own 
symptoms and possibly get tested). 

In  the  literature,  there  are  large  gaps  in  knowledge  on  how  national  CT  was  conducted  in  EU/EEA 
countries  during  the COVID-19  pandemic  since 2021, how  cross-border CT  was carried out in most 
EU/EEA countries and on the digital technology that was used for CT in general. Most  literature on 
digital CT tools covers legislation and ethical issues associated with proximity-based apps, and not the 
digital technology in scope for this study. The surveys that have been completed by EU/EEA countries 
and the interviews have provided more insight into these gaps. 

2.5  Potential  factors  influencing  cross-border  CT:  legal  requirement,  ability,  and 
national priorities 

There  are  potential  challenges  that  may  impact  the  effective  sharing  of  CT  data  across  borders, 
including  legislation, governance,  ethics,  political environment,  technology, capacity and resources. 
Based  on  our  findings  from  the  literature  and  the  discussions,  we  have  divided  these  potential 
influencing factors into three general categories obligation, ability, and national priorities (Table 2.) 
Obligation  factors  include  international  and  national  laws  that  countries  are  expected  to  abide  by. 
Ability factors include the resources, technology, governance, and legislation that are available in a 
country. National priorities refer to factors that countries may consider in their own risk assessments 
and priority setting while making decisions on the sharing of data for cross-border CT.  

Table 2. Factors that may impact the effective sharing and processing of cross-border CT data for incoming and 
outgoing requests. 

Obligation 

Ability 

National priorities 

o  International law: 

Resources 

International Health 
Regulations (IHR 2005) 

o  EU legislation: 
Decision 
1082/2013/EU which 
has been replaced by 
Regulation EU 
2022/2371, 
Commission 
Recommendation (EU) 
2017/1140 

o  National law and 
specific policies 

o  Emergency legislation 

o  Human resources  
o 
o 
o  Organisation, efficiency, and 

Financing 
Logistics 

effectiveness of CT at national level 

(Digital) mechanisms 
o  Digitalisation capacity  
o 

Interoperability and compatibility 
between digital platforms and 
software 
Internet connectivity 

o 
o  Technology user-friendliness 
o  Extent of training in using this 

technology 

Governance 

21 

o  Decision-making processes, based on 
risk-assessments considering, among 
others: 
➢  the characteristics of the 

infectious agent  

➢  tests and vaccines (availability 
and population coverage) 

➢  country situation (e.g., 

war/poverty) 

➢  what countries consider a health 

threat, requiring CT 
o  Ethical considerations 
o  Concerns about privacy 
o  Bottlenecks in receiving other 

countries’ CT data 
➢  Delays 
➢  missing/incomplete/unclear 

data 

 
 
 
 
 
 
 
  
  
Feasibility study on digital technology for cross-border contact tracing 

Obligation 

Ability 

National priorities 

o  Travel restrictions/ implementation 

of PLFs 

o  Extent and quality of government 
involvement and leadership  

o  Political environment 

Legislation 

o  Data protection and privacy 

regulations 

o 

Legal infrastructure to support 
implementation of legal obligations 

o 

o 

Fears about implementing new 
technology 
Levels of (dis)trust 
➢  in national authorities of own 

and/or other country 

➢  in technology 
➢  in how other countries collect 

and use CT data 

2.5.1 Examples of challenges faced by countries using digital technology for CT 

The German study examining the first months of the pandemic, reported having technical problems 
and delays with using email and the encrypted platform when sharing data with non-EU countries(3). 
There  were  issues  with  incomplete  data,  such  as  the  number  of  contacts  per  COVID-19  case  and 
whether  they  were  high  or  low-risk  contacts.  The  study  also  reported  there  being  no  standard 
procedures to collect passenger data from conveyance and tour operators, resulting in high costs in 
terms of time and human resources.  

As  cross-border  CT  largely  depends  on  the  digital  technology  used  at  the  national  level  to 
collect CT data, barriers to using digital tools to collect CT data at the national level could influence the 
quality  of  cross-border  CT.  Barriers  have  been  reported,  for  example,  in  using  the  outbreak 
investigation tool Go.Data(8) in several countries (Argentina, Guatemala and the U.S. (Texas)). These 
included fears of new technology, too few human resources, lack of trust in disclosing personal data, 
technological interoperability issues and inefficient internet connectivity(25).  

2.5.2 Legal barriers 

Although EU countries are legally obligated to adhere to the WHO and EU regulations, certain aspects 
may be subject to national interpretation and application within the bounds of national law, especially 
from  a  data  protection  point  of  view.  Countries  faced  a  sudden  onset  and  high  volume  of  data, 
including personal data for CT to be  processed, which in combination with the deployment of new 
technologies, interoperability requirements and data linkage posed some legal challenges. 

2.5.3 Privacy and ethics 

National emergency laws in various fields, including public health, civil and criminal law may not only 
influence a country’s motivation to collaborate legally, but also present ethical challenges. Privacy and 
ethical considerations linked to and rooted in national policies that apply in cross-border health threats 
might  have  an  impact  on  the  willingness  of  MS  to  share  personal  data  for  CT  purposes  across  the 
borders.  In  addition,  the  GDPR  has  not  been  interpreted  in  a  uniform  manner  across  all  MS,  and 
incorporates  national  level  legislation  which  may  vary  significantly  between  MS.  Articles  in  the 
literature have centred on the need to protect the individual privacy versus the need to protect public 
health(26, 27, 28). The focus of these discussions has been regarding the use of proximity-based CT apps 
(not within the scope of this study), which were developed in many countries early in the pandemic.  

22 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

2.6 Summary of gaps in knowledge on cross-border CT 

The literature review (which methods are described in chapter 3) revealed that there are still large 
gaps of knowledge regarding the way that cross-border CT was carried out in each EU country, with 
respect to the underlying legislation, digitalisation and the experienced barriers, facilitators and needs 
in cross-border CT. Information is still lacking with respect to the following points: 

2.6.1 Legislation 

•  National legal frameworks of EU/EEA countries in terms of regular and emergency measures 

in relation to COVID-19 pandemic and other outbreaks; 

•  The  extent  to  which  countries  might  limit  protection  of  individuals’  rights  and  introduce 

measures that relate to the public health laws; 

•  Possible ethical considerations in EU/EEA countries that could prevent data sharing; 
•  How the EU’s General Data Protection Regulation No 2016/679 (GDPR) and related national 
legislation  were  applied  by  EU/EEA  countries  during  the  COVID  pandemic,  and  what  plans 
regarding this legislation may support preparations for future cross-border health threats; 
Legal  barriers  in  some  countries  when  it  comes  to  using  dPLFs  (especially  regarding  the 
requirement for a minimal amount of personal data);  

• 

•  The national legal basis for countries using passenger information (API/PNR) obtained from 

airlines for national CT (as there is no legal basis at EU-level). 

2.6.2 Digitalisation 

•  The digital technology (not including proximity-based apps) that countries use to provide data 

for cross-border data exchange; 

•  Countries’ experiences when it comes to using the EWRS selective exchange module; 
•  Countries’ experiences regarding the implementation of digital tools, such as dPLFs, and their 

integration with EWRS; 

•  How countries can be supported in linking their digital tools to the EWRS platform. 

2.6.3 Cross-border CT 

•  The  experiences  and  current  plans  of  countries  regarding  cross-border  CT  in  Europe,  in 

particular  
o 

the  barriers  and  facilitators  regarding  more  effective  cross-border  CT  in  relation  to 
digital technology, governance, and legislation; 

o  countries’ needs on EU-level support and potential action to improve cross-border CT. 

23 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

3. Methods 

As  previously  mentioned  in  the  introduction  (Chapter  1),  the  EUHealthSupport  Consortium  has 
collected  data  by  means  of  the  following:  (1)  a  detailed  literature  review,  (2)  a  survey  for  EU/EEA 
countries,  (3)  semi-structured  interviews  with  relevant  MS  delegates,  and  (4)  two  webinars  with 
participants  from  various  EU/EEA  countries  (including  members  of  the  Health  Security  Committee, 
Joint Controllers Group on EWRS and ePLF, relevant networks of the ECDC, experts from DG SANTE 
and ECDC, and other experts on CT practices and legislation).  

This  chapter  describes  the  various  methods  used  to  conduct  this  study,  and  then  briefly 
introduces the study population in terms of the respondents of the survey and interviews, and the 
participants of the webinars.  

3.1. Methods of the study 

3.1.1 Literature review 

The scoping review aimed to gain insight into the use of digital CT tools and applications for enhancing 
cross-border CT during the COVID-19 pandemic. We also investigated CT practices and actors involved 
in the execution of national and cross-border CT in EU/EEA countries. Additionally, due to the ongoing 
monkeypox (Mpox) outbreak in Europe, Mpox was included in the review. The review was guided by 
the  methodology  of  an  extensive  scoping  review,  which  included:  (1)  identifying  the  scope  and 
approach,  (2)  searching  for  relevant  literature  (scientific  and  grey),  (3)  selecting  literature  (164 
publications included), (4) analysis of the literature, and (5) synthesis of the report.  

The scope and approach were identified in the inception phase of the study, as reflected in the 
introduction and background chapters (chapters 1 and 2). Although the proximity-based apps were 
not part of the main scope of the study, relevant publications were included to give insight on legal 
and ethical aspects. A summary of literature review study methods is presented in Appendix C. The 
results were presented in the ‘Literature Review Report’ deliverable of the study in November 2022. 

3.1.2 Surveys 

The survey for EU/EEA countries consisted of a mix of open-ended and closed-ended questions. The 
respondents (see section 3.2.1) started the survey by answering open questions about what country 
they were representing, and what their current role was in the organisation. The following topics were 
covered in 51 questions:  

•  Challenges encountered and solutions implemented during the COVID-19 pandemic;  
•  National and cross-border CT actors and practices in each country;  
•  Digital technology used for national and cross-border CT in each country and the challenges 

and facilitators experienced with these tools;  
Legislation associated with CT and the use of digital tools;  
Lessons learned from the COVID-19 pandemic;  

• 
• 
•  CT practices for other communicable diseases including Mpox;  
•  Future strategies and EU-level support needs. 

The digital technology examined in the survey study included platforms and tools that provide data for 
cross-border  CT  and  involve  public  health  authorities  (PHAs).  Digital  technology  that  does  not 
contribute directly to the CT process conducted by PHAs, such as proximity-based apps and tools used 
solely for surveillance, was excluded from the survey study. 

Responses  were  analysed  qualitatively  and  quantitively  with  the  aid  of  the  tools  excel  and 
MAXQDA (2022). Countries’ actors, CT practices and digital technologies were aggregated and mapped 

24 

 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

in country tables. For the qualitative analysis of the open-ended questions, thematic analyses were 
conducted. First open coding was conducted, where codes were assigned to fragments of raw data. 
Similar  codes  were  then clustered  into  categories,  and  similar  categories were  then organised  into 
more interpretative themes. These themes were described and illustrated by the various responses 
provided by countries. Comprehensive results were presented in the ‘Draft Survey Report’ deliverable 
of the study in April 2023. For more details on the survey questions, please see Appendix  D. Please 
note that although the majority of questions in the survey were analysed, a few questions that were 
deemed less relevant for this study on hindsight were excluded from this final report. 

3.1.3 Interviews 

Interviews  were  conducted  with  nine  EU/EEA  (AT,  CZ,  DE,  ES,  FI,  FR,  LV,  MT,  NL)  and  two  non-EU 
countries (CH, UK) to investigate what national and international level barriers or facilitators impacted 
countries’ ability, willingness, or obligation to conduct international travel-related CT. Countries were 
selected  in  such  a  way  that  they  could  be  as  representative  as  possible.  The  selection  of  EU/EEA 
countries  was  based  on  key  country  characteristics,  data  from  the  literature  review,  data  from  a 
parallel study for the EC regarding digital tools used by MS at citizen-to-citizen level, EU-level data on 
EWRS and EUdPLF use, and on data from an EU-level survey regarding the EUdPLF. Selection of non-
EU countries was based on their relevance to EU countries in terms of international travel. Selected 
countries’ NFPs were contacted by DG SANTE by email requesting their participation with an invitation 
to be forwarded to experts on relevant areas. 

Relevant  topics  discussed  during  the  interviews  were  COVID-19  experiences,  subsequent 
developments  and  future  plans  for  national  and  international  CT  systems,  practices,  digital  tools 
(including the EWRS and EUdPLF), governance and legislation.  

Interviews were conducted via MS teams and were recorded after participants had given their 
informed  consent.  A  short  summary  of  the  key  components  was  sent  to  the  participants  for  their 
review  (member  check).  The  interview  recordings  were  pseudonymised  and  then  transcribed.  The 
analysis of the transcripts was done using open coding followed by thematic analysis, using MAXQDA 
(2022). Codes were analysed and grouped into categories. Categories were then analysed for overlap 
and merged where possible to create key themes and subthemes. Interview findings are integrated 
into the findings of this report. A summary of the interview study methods is presented in Appendix E. 

3.1.4 Webinars 

The invitation emails for the webinars were sent out by DG SANTE and ECDC to relevant groups and 
networks, such  as  the  Health  Security Committee,  Joint  Controllers Group on  EWRS  and  ePLF,  and 
relevant networks of the ECDC. Participants included these groups, as well as experts from DG SANTE 
and ECDC, and other experts on CT practices and legislation. The invited countries could register via an 
online event link (which was included in the invitation email). Webinars were held online via the online 
meeting program ‘Webex Meetings’. Introductory presentations were provided by DG SANTE and the 
EUHealthSupport Consortium, followed by interactive discussions in plenary and breakout sessions. 
The questions that were addressed during each webinar were asked via a live polling program ‘Slido’, 
which presented the responses of the participants as word-clouds or poll results. Please see Appendix 
F for the topics that were discussed during the webinars. 

3.2 Study population 

This section gives a brief description of the participants who provided data for this study by partaking 
in the surveys, interviews, and webinars. Within the text of the report, the country codes are used to 
indicate  the  countries  of  participants  who  responded  to  the  questions  in  the  various  study 
components, in particular in relation to factual and operational issues (see the list of abbreviations on 

25 

 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

page 6 for country codes used). The information on challenges, facilitators and lessons learned are 
presented in an aggregated level, without reference to specific countries. When relevant, quotes from 
interviews  and  survey  responses  are  presented  to  illustrate  the  perspectives  of  EU/EEA  countries, 
without referring to specific countries.  

When  reading  the  report,  it  should  be  noted  that  country  codes  reflect  information  collected  via 
surveys, interviews, and webinars, which may have been provided by different people from the same 
country  at  different  times  throughout  the  data  collection  period  (December  2022  -  April  2023). 
Furthermore,  Regulation  (EU)  2022/2371  came  into  force  in  December  2022  replacing  Decision 
1082/2013/EU, which might also have influenced answers in relation to applicable legal provisions. As 
pandemic preparedness is a fast-moving field involving various actors in countries, factors mentioned 
above may have led to (minor) discrepancies in the findings, despite all the efforts of the study team 
to avoid them. 

3.2.1 Surveys 

The  surveys  were  sent  out  to  the  30  EU/EEA  countries  and  completed  by  representatives  of  23 
countries (77%) within the period of December 2022 to January 2023. The respondents came from 20 
different EU countries (AT, CY, CZ, DE, DK, ES, FI, FR, HR, HU, IE, IT, LT, LU, MT, NL, RO, SE, SI, SK) and 
the three EEA countries (IS, LI, NO). Nine respondents (39%) had a profession within the Ministry of 
Health (MoH) or worked in their NFP. Four of the respondents (17%) had a profession in public health 
at  a  national  level.  Three  of  the  respondents  (13%)  were  epidemiologists  and  two  (9%)  of  the 
respondents had an advisory role. Four of the respondents (17%) had other professions, i.e., officials 
working with regular and/or cross-border CT in different departments.    

3.2.2 Interviews 

For the interview study, participants represented nine EU countries (AT, CZ, DE, ES, FI, FR, LV, MT, NL) 
and two non-EU countries (CH, UK), and the interviews took place from January 2023 to March 2023 
online through MS TEAMS, except for the interview with ES. ES provided written responses to all of 
the interview questions. NL participated in the online interview but also provided written responses to 
questions on legal issues.  

Interview  respondents  included  people  with  knowledge  on  the  organisation  of  CT  at  the 
national  level,  legal  frameworks  for  regular  CT  and  international  travel  related  CT,  and  digital 
technologies for CT. Overall, the number of participants per interview ranged from one to five.  

3.2.3 Webinars  

The first webinar took place on the 6th of March 2023 and the second webinar on the 21st of April 2023. 
In total, 102 and 74 participants attended webinars 1 and 2 respectively, with 29 EU/non-EU countries 
represented in the first webinar and 28 EU/non-EU countries in the second webinar (see Table 3). A 
third webinar is planned for June 2023 to present the final study findings described in this final report. 

26 

 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Table 3. Participants attending webinars 1 and 2 

Participants 

Total number of participants 
Number of participants 
representing EU/non-EU countries 
Number of participants from 
other organisations (EC, ECDC, 
EUHealthSupport Consortium) 
Number of different EU countries 

Number of different non-EU 
countries 

Webinar 1 (Monday 6th March 
2023: 11-13.00 hrs CET) 
102 
84 

Webinar 2 (Friday 21 April 
2023, 14.00-16.00 hrs CET) 
74 
59 

18 

15 

26  
(AT, BE, CY, CZ, DE, DK, EE, EL, ES, 
FI, FR, HR, HU, IE, IT, LT, LU, LV, 
MT, NL, PL, PT, RO, SE, SI, SK) 
3 
 (IS, LI, NO) 

25 
(AT, BE, CY, CZ, DE, DK, EE, ES, FI, 
FR, HR, HU, IE, IT, LI, LT, LU, LV, 
MT, NL, PL, PT, SE, SI, SK) 
3 
(CH, IS, NO) 

27 

 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

4. National  and  cross-border  CT  practices  and  digital 
technology  in  EU/EEA  countries  in  relation  to  COVID-19: 
findings 

This section presents various aspects of regular and cross-border CT practices and digital technology 
used  in  EU/EEA  countries  during  the  COVID-19  pandemic:  legal  background  for  cross-border  CT, 
overview of organisation of CT and digital technology used in EU/EEA countries, impact of COVID-19 
on national and cross-border CT, challenges, and facilitators with regard to digital technology, data 
protection and ethical challenges, and national and cross-border CT in other communicable diseases. 
This information was collected from the surveys, interviews, and webinars.   

4.1 Legal basis for cross-border CT data sharing and processing 

The data on legal basis for cross-border CT was mainly obtained by the surveys in which 22 countries 
responded  to  legal  questions  in  varying  degrees  of  detail.  These  findings  were  complemented  by 
information obtained from the interviews and the discussions in webinars. Due to the limitations of 
the data collected, the analysis below does not provide an exhaustive list of national legal provisions. 

4.1.1 Lawful basis for cross-border sharing CT data 

In  terms  of  lawful  basis  for  sharing  CT  data  across  borders,  the  study  sought  to  identify  which 
laws/regulation/policies  were  in  place  across MS  to implement  cross-border  CT  sharing obligations 
under  IHR  2005(19),  specifically  to  non-EU/EEA  countries.  Twenty-two  countries  responded  to  the 
relevant  questions  in  the  survey  (96%)  and  all  confirmed  that  law  is  in  place  underpinning  CT 
obligations. It is evident that there is a wide range of national laws, regulations and policies facilitating 
non-EU/EEA cross-border  sharing. There  are  in excess of 66 different  laws,  policies  and regulations 
across MS revealing a complex legal web. A dynamic legal picture also emerged with additional legal 
notices  and  laws  required  particularly  during  COVID-19.  This  adds  complexity  in  relation  to  data 
sharing.  

Regarding  the  lawful  basis  for  sharing  within  the  EU/EEA,  all  countries  relied  on  Decision 
1082/2013/EU(17, 18) which had direct effect at national level, and which has now been replaced with 
Regulation (EU) 2022/2371(16), which is also directly applicable in each MS, meaning that no further 
action  is  needed  at  MS  level  to  implement  it  into  national  law.  This  does  not  mean  however  that 
national or regional level guidelines as not adopted to support stakeholders in carrying out their duties 
that arise under the Regulation.  

4.1.2 GDPR compliance – lawful basis for CT data processing, compliance with Article 5 
principles and transfer tools 

Having established that each MS had a lawful basis for CT data sharing, the study then went on  to 
examine  the  data  protection  lawful  basis  for  processing  under  Articles  6  and  9  GDPR.  Additionally, 
compliance with Article 5 GDPR(29) principles both within and outside the EU/EEA when carrying out 
cross-border CT was examined. Countries were also asked to describe their legal approach in relation 
to third countries in the absence of GDPR adequacy decision which would allow for data sharing with 
a third country on the same legal bases as GDPR. This was explored further in the second webinar. For 
the legal provisions, please refer to Appendix B. 

28 

 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Lawful Basis  
An important finding was that all countries that responded to the survey reported using one of the 
legal bases for processing personal data cross-border under Articles 6 and 9 GDPR when sharing both 
within the EU/EEA and outside the EU/EEA. The lawful basis remained consistent.  

Of the 20 responses, eight gave further detail on which specific bases in articles 6 and 9 GDPR 
they relied upon. All eight (DK, FR, IE, LU, NL, SE, SK and NO) cited Article 6(1)(e), which allows for 
processing necessary for the performance of a task in the public interest or in the exercise of official 
authority. LU and SK also cited Article 6(1)(d) which allows for processing of data when to do so is in 
the vital interests of the data subject; and SK also mentioned Article 6(1)(c) which refers to processing 
in compliance with a legal obligation. This was a surprising finding as at the outset of the study it was 
expected most countries would rely on Article 6(1)(c) in compliance with their legal obligations under 
IHR 2005 and Regulation (EU) 2022/2371. 

More differences were found between countries when it came to lawful basis for processing 
under Article 9 of GDPR. Note that when sensitive data such as health related data are processed, the 
processing must be based on a legal provision in Article 6 as well as one found in Article 9 GDPR. All 
countries that responded sharing such level of detail (DK, FR, IE, LU, NL, SE, SK and NO) to the survey 
indicated they rely on Article 9(2)(i) which is the public health basis for processing. DK and SK also listed 
two additional lawful bases: Article 9(2)(b), which allows for compliance with a legal obligation and 
9(2)(g) which allows for processing of sensitive data where there is a substantial public interest to do 
so. NO was the only country that listed 9(2)(h), which allows for processing which is necessary for the 
provision of healthcare and management of the healthcare system. It is important to note however 
that the legal basis in Article 9(2)(h)(i) and (j) all require the MS to reply on EU law or national law 
which permits the data processing in question.   

There was an unexpected amount of unity between countries in relation to the application of 
GDPR for CT both within EU/EEA and outside. On the whole, the same Article 6 and 9 lawful basis is 
used  by  MS  which  indicates  GDPR  is  robust  despite  wide  margin  of  manoeuvrability  available  to 
countries.  It  also  helps  to  facilitate  the  free  movement  of  data  and  interoperability  between  EU 
countries. 

GDPR Principles   
Countries  were  asked  about  compliance  with  Article  5  GDPR  principles  of  lawfulness,  fairness, 
transparency,  purpose  limitation,  data  minimisation,  accuracy,  storage  limitation,  security  and 
accountability (20 responses). 

Most countries in the survey gave the same or very similar replies within the context of CT with 
third countries as well as EU/EEA countries. The answers listed below represent examples of GDPR 
compliance measures that some countries had in place.   

CY, DK, LU, SE and NO stated that GDPR compliance documentation, routines, policies are in 
place. IE referred to a data protection impact assessment (DPIA) having been undertaken. LU indicated 
that  data  protection  officers  review  data  sharing  processes  before  they  are  applied.  CY  requires 
approval  of  the  local  GDPR  commissioner.  FR  said  there  were  limitations  to  processing  strictly 
necessary data, storage period applied, and security measures implemented. LU stated that, only data 
relevant for the protection of public health would be shared. ES, FR, IT, MT, and SK referred to EWRS 
as a tool that provides a GDPR compatible solution. 

Data sharing agreements were not common. Encryption and data minimisation were identified 
as important along with use of secure platforms for sharing such as EWRS. Only one country mentioned 
transparency. Only IE and NL stated that data sharing agreements in place when necessary. NO stated 
that there are no specific data sharing agreements in place, other than the provisions provided by the 
EC through EWRS, EU legislation and national legislation.  

In  general,  the  findings  of  the  survey,  interviews  and  webinars  data  protection  problems 
relating to cross-border CT seem to show that issues specific to COVID-19, such as high volume of data, 
new  technologies,  interoperability  and  data  linkage  were  the  primary  cause  of  concern  for 

29 

 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

respondents. It was indicated in the surveys and webinars that guidance from national data protection 
authorities along with the European Data Protection Board (EDPB)(30) was required during COVID-19, 
as  there  was  uncertainty as  to the  application  of GDPR  into  the  pandemic which  created  an  initial 
hesitance to share data. Many countries also required new laws/regulations/guidance during COVID-
19 to facilitate new methods of CT data sharing such as specific law for dPLF. It is important to note 
that most of these laws have now expired. 

Data transfer to third countries tool  
The GDPR allows for transfer of data to third countries which have received an Adequacy Decision from 
the EU, which in practice means their national legislation is equivalent to GDPR. At present adequacy 
decisions have been issued for Andorra, Argentina, Canada (commercial organisations), Faroe Islands, 
Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United 
Kingdom and Uruguay. Where an adequacy decision does not exist, Article 46 GDPR provides that data 
may  be  transferred  if  appropriate  safeguards  have  been  adopted  which  are  reflected  in  binding 
corporate rules or standard data protection clauses. Article 49 GDPR allows that in specific situations 
where  an  adequacy  decision  does  not  exist  and  the  specific  measures  of  Article  46  have  not  been 
adopted, a MS may still transfer data to a third country under certain specific circumstances. One such 
circumstance is that provide for in Article 49(1)(d) which allows for transfers necessary for important 
reasons  of  public  interest.  All  countries  that  referenced  a  transfer  tool  in  the  survey  (6  out  of  15 
responses, 40%), rely on Article 49(1)(d). It should be noted however that Article 49(1)(d) requires that 
the public interest must recognise Union or MS law. Furthermore, the derogation shall not become 
“the rule” in practice but need to be restricted to specific situations and each data exporter needs to 
ensure that the transfer meets the strict necessity test. None of the respondents cited the relevant 
national law, although it is possible that they found the legal justification in the IHR to which they are 
subject.  

Only one country was the only country who noted the possible use of both Article 46 and 49. 
It specified that Article 49 can be used in the absence of appropriate Article 46 safeguards. In the survey 
another country indicated it is currently having internal discussions about the lawfulness of CT based 
on Article 46 GDPR. It stated that based on a practical approach, Standard Contractual Clauses are not 
the most practical means due to the fact they have to be closed with all participating members of the 
IHR.  

Further exploration of transfers utilising Article 49 took place during the webinars, in particular 
if safeguards were in place. One country has a basis assessment of privacy impact, but indicted bilateral 
agreements are not feasible. Another country mention that they do not have agreements with third 
countries and that transfer of data outside of EU/EEA is very cautious. Reflecting the findings of the 
survey they mentioned that a discussion is needed on whether Article 49 can apply to special medical 
data. One country state that an extra ruling EU/or national law is needed on this point.  

4.1.3 Regulation (EU) 2022/2371 

During  the  study  Regulation  (EU)  2022/2371  was  introduced  replacing  Decision  1082/2013/EU. 
Questions relating to how the Regulation could facilitate CT and the operations of EWRS separate to 
were raised during the interviews and Webinars. 

When  asked  about  the  new  regulation,  understanding  of  the  effects  of  its  implementation 
were quite vague across MS. Some participants were unaware of the regulation or the specifics of the 
regulation. The main comment regarding countries ideas for how the regulation may change or aid 
them in conducting cross-border CT was their hope for it to incentivise or improve digitalisation of CT, 
either by new technologies or developments to or integration of existing ones. A discussion on the 
implementation of this legislation amongst MS has also been brought up. 

30 

 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

4.2 Overview of organisation of CT and digital technology implemented in EU/EEA 
countries 

This section provides an overview, as reported by countries, on the various actors involved in CT, how 
the CT data flowed between organisations, and the types of digital technology that were used by each 
country  for  both  national  and  cross-border  CT  during  the  COVID-19  pandemic.  The  data  is  mainly 
obtained by the surveys; all 23 countries provided varying levels of information on these topics. These 
findings were complemented by information obtained from the interviews and webinars. 

4.2.1 Organisation of CT in EU/EEA countries 

The execution of CT during the COVID-19 pandemic varied greatly between countries, as well as with 
regard to the  actors  involved. The primary actors and the  relationships between these actors have 
been  identified  during  the  literature  review.  Generally,  governments,  public  health  institutes  or 
agencies and private organisations have been part of the CT process, but also the military, universities 
and  telephone  companies  are  actors  that  have  been  entangled  with  this  process,  according  to  the 
literature. Notably, the literature covering the COVID-19 pandemic, was not clear regarding the digital 
technology used for CT (such as outbreak investigation and management tools, digital CT tools where 
citizens can share  data with/receive  data from the PHA, citizen-to-citizen warning and tracing apps 
(mainly proximity-based apps) and CT data transmission tools; see Table 1 for classification), as well as 
how CT data was shared between actors. Therefore, we asked countries in the surveys and interviews 
about the actors involved in conducting CT, their CT practices, and the digital technology they used for 
CT during the COVID-19 pandemic. The main findings are described in this chapter.   

Actors involved with CT, CT practices, and flow of data for CT in EU/EEA countries  
All 23 countries  provided answers to the questions on actors, CT practices, and flow of data in the 
survey, as well as all of the countries in the interviews. Below, a summary of the findings is presented.  

1.  Actors  

Most countries mentioned that, during COVID-19, public health institutes or agencies were responsible 
for the execution of cross-border CT and national CT, whereas the regional/local health authorities 
were  responsible  for  CT  at  the  sub-national  level. In  four  countries,  the  MoH  had  the  most 
responsibilities when it comes to CT. See Table 4 below for an overview of the specific countries.  

Table 4. Execution of CT at different levels for actors that countries indicated 

Countries  where  Ministries  of  Health  (MoH) 
had most responsibilities when it comes to CT 
institutes/ 
Countries  where  public  health 
agencies  were  responsible  for  execution  of 
cross-border CT 
institutes/ 
Countries  where  public  health 
agencies  were  responsible  for  organizing/ 
executing national CT 
local  health 
Countries  where 
authorities  were  responsible  for  organizing/ 
executing CT in subnational level 
Countries  where  MoH  was  responsible  for 
decisions on guidelines and policies for national 
and cross-border CT 

regional/ 

CY, CZ, ES, IT 

FI, HR, IE, LT, LU, MT, NL, RO, SI, SE, SK and IS, LI, NO 

CZ, DK, ES, HR, FI, IE, LT, LU, MT, RO, SE, SI, SK and IS, 
LI, NO 

AT, CZ, DE, DK, ES, FI, FR, HR, HU, IE, IT, NL, RO, SE, SK 
and NO 

AT, CY, CZ, DE, ES, FI, FR, HR, IT, LT, MT, RO, SK, SI and 
IS, LI, NO 

31 

 
 
 
 
 
 
 
  
 
Feasibility study on digital technology for cross-border contact tracing 

 Other actors that are mentioned by countries include the following: border sanitary inspection (HR), 
(border)  police  (HR,  RO),  university  (CY,  FI),  ministries  other  than  MoH  (CY,  CZ,  FI  and  LI),  health 
insurance agency (FR) and hospitals/health care institutes (IE, SE).  

There was a wide variety in types of actors involved in CT processes. To illustrate, six countries 
had more than five different actors/organisations that play a role in CT (FI, FR, HR, IE, NL, RO) and only 
one country had a single actor/organisation involved in the whole CT process (IS). This is also related 
to  the  size  of  the  country,  as  there  are  fewer  actors/  organisations  that  are  involved  in  smaller 
countries.  

During the COVID-19 pandemic, five countries set up a special crisis/emergency centre or team 
for COVID-19 CT (ES, FR, HR, IE, LU).  Other data controlling functions1 for various actors that countries 
indicated were organised into different levels of CT (i.e., cross-border, national and subnational). See 
Table 5 below for an overview of data controlling functions for actors at the different levels. 

Table 5. Data controlling functions1 at different levels of CT activities 

Ministry of Health 
Public 
institutes/ agencies 

health 

Cross-border level 
AT, CY, CZ, ES, FR, HR, IT 
FI, HU, LT, MT, RO, SI, SE, 
SK and IS, LI, NO 

Regional/local 
authorities 

FI, FR, IE 

National level 
CY, CZ, ES, FR, HR and IS 
CZ, DE, FI, HU, IT, LT, MT, 
NL, RO, SE, SI, SK and IS, 
LI, NO 
AT, FR, IE, SE 

Subnational level 
ES, FR, HR and IS 
HU, IT, LT and IS 

AT, CZ, DE, DK, ES, FI, FR, 
IE, RO, SE, SK and NO 

Overall, we see that most countries had a decentralised organisation of CT, where subnational actors 
had the most prominent role and hosted and managed the digital tools, with the exception of smaller 
countries where one centralised organisation was in charge of the execution of CT. Nevertheless, the 
guidance  almost  always  and  policy  on  when  and  how  to  conduct  CT  often  came  from  national 
authorities. 

2.  CT practices/flow of data for CT  

Data about cases/contact persons were almost always gathered via phone, online forms, information 
systems  or  email.  See  Table  6  for  an  overview  of  these  different  ways  and  country  specific  data 
gathering approaches.  

Table 6. Countries’ ways to gather data about cases/contact persons 

Phone 
Online forms 
Information systems 
Email 

AT, CY, DK, ES, FI, FR, HR, HU, IE, IT, MT, NL, RO, SE, SI, SK and IS, NO 
AT, FR, IE, SE 
CY, DE, FR, LU 
CZ and IS 

Countries  did  not  always  provide  a  clear  description  about  how  the  data  really  ‘flows’  from  one 
actor/system/level to another. The organisations between which the data flows, depends on the roles 
of the different actors/organisations involved in CT. 

3.  Centralisation and decentralisation  

The  majority  of  the  countries’  organisation  of  CT  was  categorised  as  decentralised  meaning  that 
subnational actors carried out CT in line with the subsidiarity principle. Digital systems are also often 
organised at the subnational level. Data is often stored at this level and can be accessed only by the 

1 Data Controller within the meaning of Article 4 of GDPR refers to the natural or legal person, public authority, agency, or 
other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. E.g., 
which agency, authority of body decides “why” and “how” CT data is processed. 

32 

 
 
 
 
 
  
  
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

relevant subnational actors. Eight countries are categorised to have a centralised organisation of CT 
where  CT  responsibilities  mainly  lied  on  central  actors,  and  one  country  is  considered  to  have  a 
combination. See Table 7 below for an overview of the different countries’ organisation of CT.  

Table 7. Countries’ organisation of CT 

Decentralised 
Centralised 
Combination  

AT, CZ, DE, DK, ES, FI, HR, HU, IT, NL, RO, SE, SK and NO 
CY, IE, LT, LU, MT, SI and IS, LI 
FR 

It is observed that countries with a centralised system are mostly small countries that have a 

population size smaller than three million, with the exception of IE that has a population of five 
million. Considering the total population the countries represent, the organisation of CT in EU/EEA 
appears to be predominantly decentralised, with the exception of smaller countries. This means that 
the EWRS operator in charge of cross-border CT is not close to the CT authority, with several steps in 
between them. The data also indicated that the EWRS operator in charge of cross-border CT often 
does not have direct access to digital CT systems. CT data is frequently exchanged between the EWRS 
operator at the national/cross-border level and CT authorities at the subnational level through 
secure email, encrypted systems or an online form, which are separate from the national system of 
CT data. Only in smaller countries with a relatively centralised organisation of CT, the EWRS operator 
can obtain CT data from the (national) digital CT system. Unlike the organisation of CT, guidance on 
when and how to conduct CT mostly comes from national authorities.  

4.2.2 Overview of digital technology implemented in EU/EEA countries 

Countries were asked in the survey to provide information regarding the digital technology used in 
their own countries for CT. For each digital tool, they were asked to provide the name and the type of 
tool,  the  actors  or  organisations  that  use  the  tool,  a  brief  description  of  the  tool,  and  to  indicate 
whether  the  tool  was  used  for  national  and/or  cross-border  CT.  We  have  divided  this  technology 
reported by countries into the four different types of tools (also see chapter 2, table 1):  

(1)  Outbreak investigation and management tools (including digital CT case management systems, 

in which cases and their contacts are registered);  

(2)  Digital CT tools where citizens share data with/obtain data from PHAs; 
(3)  Citizen-to-citizen warning and tracing apps (mainly proximity-based apps), and; 
(4)  CT data transmission tools.  

Many countries also provided information about any future plans they had regarding the development 
of  digital  tools,  in  particular  CT  case  management  tools.  Twenty-two  countries  completed  the 
questions  regarding  their  digital  technology  for  CT.  Additional  information  obtained  from  the 
interviews and webinars has been added to this section. An overview of general observations regarding 
these digital tools is provided below. 

General findings regarding the reported digital CT technology 
Outbreak investigation and management tools  
EU/EEA countries reported large variations in the number and types of CT digital technology (Table 8). 
Two countries reported having no digital CT case management systems (HU, RO) and several reported 
various case management systems in different regions (DE, ES, FR, and NO). Over half of all countries 
reported having one main national case management system, although this data was generally not 
accessible to those working in cross-border CT. Countries generally all made use of their own types of 
CT case management systems. A few of the more commonly known case management systems are 

33 

 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

presented in Table 8. Go.Data was reported by three countries, either as being used in some regions, 
or for a limited time at the start of the pandemic. Four countries reported SORMAS, as either their 
main case management system, as only being used in some regions of their country, or as a tool the 
country was planning to switch to. Just one EU/EEA country (NO) reported the use of DHIS2, as one of 
three different case management systems used in their country, the other two being their own case 
management systems. Five countries reported that excel sheets were used either as a main system to 
register CT data, or just in some regions of their country, or at the start of the pandemic, before a CT 
case management system had been developed.  

Table 8. Some well-known tools used for outbreak investigation and management 
Go.Data 

3 countries 

SORMAS 

4 countries 

DHIS2 
1 country 
Excel Spreadsheets 

5 countries 

ES: Go.Data only used in some regions  
FR:  Used either Go.Data (at the beginning of the pandemic) or SORMAS  
MT: started with Go.Data, moved on to another system (Dynamics) later to handle the 
large outbreak size 
DE: SORMAS used in some regions (information obtained from interview) 
FR: used either SORMAS or Go.Data 
LI: SORMAS was main case management system 
LU: are planning to switch from CarePlus to SORMAS 
NO: one of three case management systems used in different regions 

CY: to collect and store COVID-19 cases and their contacts information 
ES: used multiple methods to collect data, including excel sheets  
IS: started with excel sheets to collect data, they also sent excel sheet questionnaires 
to cases for them to fill in their own contacts 
IT: to gather CT data 
LI: used excel sheets until SORMAS was available 

Future suggestions/plans regarding digital technology for CT 
When countries were asked if their country had any plans to move to another type of software and 
platform for CT, nine countries indicated there were no such plans, eight countries indicated they were 
considering switching to another type of CT software or platform and three countries indicated there 
were  plans  to  switch  to  other  CT  software  or  platform.  For  several  countries  that  had  been  using 
different  types  of  systems  in  different  regions,  the  focus  of  future  plans  was  mainly  to  create  one 
national integrated system, so that data could be shared easily between regions. Two countries also 
expressed the need to integrate data  from different systems monitoring other CT-relevant medical 
data pertaining to cases and their contacts. Seven countries reported that the focus of future plans 
was mainly to develop a new generic system to accommodate CT for multiple infectious diseases, as 
their  CT  case  management  system  had  been  too  specific  to  COVID-19.  The  status  of  these 
plans/suggestions varied, with some only being suggested by the survey respondent as being a good 
idea to some plans currently being in consideration for the future and others already being at the start-
up phase of implementation. 

CT data transmission tools 
Transmitting data to other EU/EEA and non-EU/EEA countries  
All EU/EEA countries reported using the EWRS, selective exchange module to transmit data to other 
EU/EEA countries. Besides the EWRS, 12 countries (AT, CY, FI, FR, IT, LT, LU, RO, SE, SI, and LI, NO) 
reported also using secure mail to transmit data to other EU/EEA countries. When asked why secure 
email  was  used  between  EU/EEA  countries  in  the  second  webinar,  one  country  expressed  that 
sometimes the structured format of EWRS was more of a practical barrier and it was easier to transmit 
the desired information to other countries using the more unstructured format of secure mail. Other 
platforms mentioned for cross-border CT were EGRESS for exchanging data with the UK, and TECH2, 

34 

 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

an intermediate program to extract data for BE, DE and FR. LI reported using various tools for different 
countries to share CT data with neighbouring countries (AT, DE and CH).  

Twenty  countries  reported  using  secure  mail  for  transmitting  data  to  third  countries  (non-
EU/EEA)  (see Table 9). During the  second webinar one  country  reported some difficulties  they had 
experienced with having to unlock the data sent by secure mail by other countries, often leading to 
delays in being able to act on the data received. 

For travel-related CT, four countries made use of the EUdPLF, and one was connected to the 
ePLF  with  their  national  dPLF;  several  others  expressed  interest  in  joining  the  EUdPLF  once  legal 
barriers are resolved. Many countries used various types of dPLFs for collecting passenger data; these 
varied in function, preventing or minimising the chance that passengers were infected upon arrival to 
the country and needed to isolate, to enabling cross-border CT to be conducted with co-passengers, if 
needed (see Table 9). 

Transmitting data from regional health authorities to EWRS operators 
In most countries, the cross-border CT organisations using EWRS did not have direct access to CT data 
collected by regional health authorities. This data was usually transmitted from the regional health 
authorities to EWRS operators within the country by secure mail, or by telephone. Eleven countries 
(AT, CZ, DK, FI, FR, HU, IE, IT, NL, SE, and NO) reported using secure mail to transmit this data. Several 
countries  reported  other  tools  including  a  password-protected  online  form,  secure  servers,  and  a 
separate online platform accessible to both CT services and EWRS users. Nine countries marked N/A 
to this question; a reason for this was expressed by some of the smaller countries. They reported that 
CT health services and EWRS users are the same actors and therefore have access to the same data. 

Table 9. Data transmission tools used at the cross-border level 
EWRS 
(23 countries) 

All EU countries reported having used the EWRS 

EUdPLF 
(4 countries) 

ePLF 
(1 country) 

National  dPLFs  used 
for  CT  and/or  other 
purposes  (e.g.  travel 
related 
isolation/ 
quarantine) 

Secure mail 

Other 

Four countries implemented the EUdPLF: IT (May 2021 live); MT (connected with ePLF 
July 2021); SI (Aug 2021 live); FR (Dec 2021 live) 
DE (and LT) are on the verge of onboarding to EUdPLF 
ES: the only country to have sent data via the ePLF 

o  Pre-Travel-Clearance Data (AT) 
o  National PLF (developed for COVID-19) and linked to ISIN (CZ) 
o 
o  Digitale Einreiseanmeldung (DEA): contact details of travellers transmitted 

Finentry & Lapland Entry (FI) 

directly to the competent authority (DE). 

o  Health Declaration forms (NL) 
o  National PLFs: IE, LT, CY, CZ, RO and IS (passenger questionnaires) 
o  dPLF connected to ePLF (ES) 
o 
o  eHranica (eBorder): for the registration of people who cross the state border (SK) 
o  12 countries reported using secure mail for transmitting data to other EU/EEA 

Flight information forwarded by Switzerland to LI 

countries (AT, CY, FI, FR, IT, LT, LU, RO, SE, SI, and LI, NO) 

o  20 countries reported using secure email for transmitting data to non- EU/EEA 

countries (AT, CY, CZ, DK, ES, FI, FR, HR, HU, IE, IT, LU, NL, RO, SE, SI, SK, and IS, LI, 
NO) 

o  EGRESS for data-exchange with the UK 
o  TECH2: intermediate program to extract data for BE, DE, and FR (used by LU) 

35 

 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

transmission 
regional 
CT 
and 

Data 
between 
(subnational) 
authorities 
EWRS operator 

o  Secure mail: reported by 11 countries (AT, CZ, DK, FI, FR, HU, IE, IT, NL, SE, and 
NO) to transmit data between regional CT authorities and EWRS operators (AT 
moved to using online forms for data-transmission in December 2021) 
o  Telephone calls: reported by 6 countries to transmit data (besides email) 

between regional CT authorities and EWRS operators (FI, IE, SE, SI, SK, and NO) 

o  Online form, using a standardised data set (AT) 
o  Secure servers and file sharing platforms; within the MoH where the different 

central authorities can share information (DK) or among national and subnational 
health authorities (DE). 

o  Regional level share data with the national level through the platform of the 

National Network for Surveillance (ES). 

o  4 countries report that contact tracers and EWRS operators have access to the 

same data (CY, LU, MT, and IS). 

4.3 Impact of COVID-19 on national and cross-border CT policy 

This section presents the findings reported by countries regarding the strategies they applied when 
the number of infectious cases surged, as well as other challenges they encountered during the COVID-
19 pandemic and the solutions that they implemented. This data was mainly obtained from the survey; 
all  23  countries  responded  in  various  levels  of  detail  to  the  main  questions  on  the  challenges 
experienced and the strategies/solutions they had implemented.  

4.3.1 Challenges experienced during the COVID-19 pandemic and solutions implemented 

The SARS-CoV-2 virus was unprecedented in its ability to spread rapidly and easily, making it necessary 
at times for health services to conduct CT at enormous scales. Countries reported the challenges they 
had experienced mainly due to the surges in infectious cases during the COVID-19 pandemic, as well 
as  solutions  and  strategies  they  had  implemented  to  counter  or  mitigate  these  challenges.  These 
challenges are summarised in the themes below. See Table 15 in Appendix G for more details. 

(1)  Recruiting and retaining sufficient human resources 

The surges in case numbers led to countries having to hire new people from a range of medical and 
non-medical  fields  to  assist  with  CT.  The  new  human  resources  most  frequently  mentioned  by 
countries  were  students,  medical  doctors,  public  health  workers  and  volunteers.  Several  countries 
mentioned  recruiting  members  of  their  military  force  for  CT  and  police  staff,  staff  from  other 
organisations  such  as  the  MoH  and  aviation  companies,  and  citizens  with  other  non-medical 
professions. To retain more  staff, a few countries reported solutions such as lowering qualification 
requirements, offering flexible working hours and relatively high salaries, as well as efforts supporting 
the health and wellbeing of staff. Continually having to train staff to be able to conduct CT throughout 
the evolving pandemic was very time-consuming. Limited staff led to being more selective about the 
type of CT data to collect, and to focusing CT activities more on high-risk index cases and their contacts. 

(2)  Difficulties collaborating with the general public 

Countries described issues that they encountered with the public, such as not always wanting to pass 
on their contact details. Countries reported difficulties in obtaining accurate, relevant, and complete 
information  from  citizens,  regarding  their  contacts.  One  country  mentioned  technological  literacy 
issues in citizens, particularly in older people. Other issues were not wanting to isolate or quarantine 
and general pandemic fatigue. One country mentioned having lawsuits from citizens who felt wronged 
at being obligated to quarantine. A few countries mentioned trying to communicate with the public to 
make them more aware of the importance of CT and the necessary measures such as quarantining. 
One country also mentioned carrying out extra evaluations to ensure that the contacts identified in 

36 

 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

the CT process, really were at risk. One country reported that quarantine frustrations only stopped 
when quarantine was no longer required. 

(3)  Obtaining relevant data for CT was time consuming and difficult 

Besides the difficulties reported in obtaining data from citizens, countries mentioned other issues 
that could make CT time-consuming and difficult, including the collection of contact details from 
large gatherings of people, receiving the lab results of testing too late, missing information and 
delays in cross-border CT, and not knowing which countries passengers had travelled to. Some 
solutions mentioned were advising or requiring organisers of large events or cafes to keep guest lists 
and digital processes being set up for receiving lab results. As case numbers increased, countries 
reported shifting to methods and tools to allow the self-service of citizens to support CT. These 
reduced lengthy periods of time spent on phone calls by contact tracers to retrieve this information. 
One country describes a ‘List your contacts’ portal, for example, for citizens to fill in relevant data 
including their contacts’ details. SMS messages were also sent to contacts with instructions, instead 
of calling them by phone.  

(4)  Different regions within countries have their own policies, CT processes and technology  
Many countries mentioned that there was a lack of integration of CT processes and technology among 
regions, even if policies were similar, making it difficult to share data or agree on guidelines. Countries 
also expressed a need for different systems related to CT, such as systems containing vaccination and 
lab  data  to  have  their  data  integrated.  Solutions  mentioned  by  countries  included  the  linkages  of 
different  databases,  by  for  example,  the  creation  of  a  unique  COVID-ID,  and  the  establishment  of 
organisations that identified best practices and implemented common strategies or national guidelines 
to be used across regions within a country. One country, for example, reported that national guidelines 
were published, and regular meetings were held with contact tracers in the 21 different regions to try 
to align CT processes throughout the pandemic. 

(5)  Constantly needing to adjust their CT processes, guidelines, and technology 

The  dynamic  nature  of  the  pandemic  meant  that  countries  constantly  needed  to  update  their  CT 
processes,  guidelines,  digital  technology,  and  their  legislation.  New  CT  units,  working  space  and 
materials were created to accommodate surges in cases. Special organisations were designated to do 
technical  reviews  and  provide  advice  and  recommendations.  CT  procedures  were  standardised  as 
much as possible in some countries to increase the efficiency of CT.  

(6)  Other challenges  

Other challenges mentioned were the lack of legislation readiness and GDPR obstacles and the lack of 
units dedicated to analysis and research. Solutions mentioned were the strengthening of legislation 
and improvement of surveillance due to better COVID-19 CT systems and other scientific studies such 
as wastewater monitoring. 

4.3.2 Legal challenges and solutions developed during COVID-19 

This section investigates some key aspects of the legal frameworks that countries had in place prior to 
the  COVID-19  pandemic  to  address  challenges  that  may  arise  during  cross-border  health  threats, 
especially  regarding  large  scale  CT,  as  well  as  solutions  that  have  been  implemented  during  the 
pandemic.  Analysis is primarily based on the survey with various degrees of response rate per topic.  

Legal frameworks to declare a public health emergency 
The majority of the countries (80% of the survey respondents, n=18/22) had legal frameworks in place 
to declare a public health emergency, while only five countries reported not having such laws in place. 
Respondents  explained  in  mixed  level  of  granularity  how,  based  on  these  laws,  public  health 

37 

 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

emergency  can  be  declared  and  what  measures  can  be  implemented  in  such  extraordinary 
circumstances. 

Sufficiency of pre-pandemic legal frameworks  
Countries can be categorised by their approach to tackling the legal challenges during the pandemic, 
more specifically, by establishing if they introduced new law(s) and whether these laws are still in place 
or were time limited by applying sunset clauses. An overwhelming majority of the countries (82% of 
the survey respondents, n=19/23) introduced new law(s) to manage the scale of CT that was required 
during  the  pandemic,  with  most  of  them  (56%  of  the  survey  respondents,  n=13/23)  using  sunset 
clauses for legislative acts, meaning that many are no longer in place. Only four countries indicated 
that it was not necessary to introduce new laws. See Table 10 for an overview. 

Table 10. Sufficiency of the pre-pandemic legal frameworks to manage large scale CT 

Sufficiency of the pre-pandemic legal frameworks to manage large scale CT 

1. It was not necessary to introduce new law(s).   

4 countries (CZ, HR, RO, SE)  

2. It was necessary to introduce new law(s).   
It is still in place.  
3. It was necessary to introduce new law(s).   
It is not in place now. It was time limited.    

6 countries (AT, CY, DK, SI, SK and LI)  

13 countries (DE, ES, FI, FR, HU, IE, IT, LT, LU, MT, NL, and 
IS and NO)  

(1)  It was not necessary to introduce new law(s). (4: CZ, HR, RO, SE)  

Among countries that did not introduce new laws, in some cases, it was still necessary to update certain 
legislative  acts.  One  country  explained  that  national  legal  framework  gave  the  relevant  actors  the 
necessary legal mandate and therefore laws were not adopted to large scale CT, however, a special 
investigator is currently reviewing if there is a need for new provisions for the future.  

(2)  It was necessary to introduce new law(s). It is still in place. (6: AT, CY, DK, SI, SK and LI)  

Updating public health and data protection laws have been named as the main drivers to introduce 
new laws among the group of countries that reported these laws still being effective (at the time of 
data collection).   

In relation to public health laws, two countries reported that COVID-19 had to be included on 
the  list  of  notifiable  diseases,  whereas  others  described  in  general  terms  the  need  to  create  new 
provisions  to  protect  public  health.  Furthermore,  introduction  or  refinement  of  competences  for 
various authorities have been mentioned as well.  
In relation to data protection, GDPR compliance for travel related documents and anonymisation and 
sharing of sensitive data were provided as justification for new legal provisions.   

(3)  It was necessary to introduce new law(s). It is not in place now. It was time limited. (13: DE, ES, 

FI, FR, HU, IE, IT, LT, LU, MT, NL, and IS and NO) 

Sunset clauses have been applied to laws by countries to allow the introduction of dPLFs, to support 
epidemiological surveillance as well as data collection and sharing, to clarify responsibilities, to make 
use  of  digital  CT  tools,  or  to  justify  the  restriction  of  fundamental  rights,  such  as  access  to  certain 
locations with proof of a negative test. Some countries gave a generic answer by implying that there 
have  been  gaps  in  public  health  laws  that  needed  to  be  addressed.  The  sunset  clauses  have  now 
entered  into  force,  meaning  that  the  legislation  is  no  longer  applicable.  Of  note,  some  countries 
reported various type of laws being introduced during the pandemic with some having sunset clauses 
and some being permanent, therefore the distinction between groups 2 and 3 is not a definite black 
or white question. Also, there is also a wide range among countries who applied sunset clauses when 
it comes to the timeframe of the legislation with most of them being limited to 2020- mid-2022 and 
others just recently being repealed (in December 2022 or January 2023). 

38 

 
 
 
   
 
  
 
 
  
Feasibility study on digital technology for cross-border contact tracing 

When  countries  were  asked  whether  their  legal  frameworks  were  sufficiently  robust  to 
manage  the  scale  of  CT  required  during  the  COVID-19  pandemic  overall,  overwhelming  majority 
reported  that  their  legal  frameworks  were  sufficiently  robust  (78%  of  the  survey  respondents, 
n=18/23) with only five countries admitting that it was not the case. However, this finding does not 
correspond to new legislation being introduced, suggesting that “sufficient robustness” is subjective 
and can be  interpreted different ways within the meaning of applicability of legal frameworks that 
provide room for emergency or subsidiary legislation.   

National professional codes of practice and ethics 
Most  of  the  countries  (71%  of  the  survey  respondents,  n=15/21)  reported  that  national  codes  of 
practice  and  ethics  were  adequate  during  COVID-19.  The  rest  of  the  countries  had  to  introduce 
amendments to these codes primarily to support access to and sharing of sensitive personal data. 

Countries pointed out the need to allow sharing of medical information, for instance to access 
CT data bases in general term, or to share medical data in an ethical way, or in case of one country, 
share medical data with the police. The other major driver was to enable non-healthcare professional, 
such as in the hospitality industry, to process health related data, or at the border crossings to arrange 
for accommodation for foreigners who were infected.  

Data protection challenges raised by COVID-19 
During  the course of this study, various aspects of data protection have been examined within the 
context of data processing for CT purposes. In this section data protection challenges that arose during 
COVID-19 are discussed as well as questions addressed in other sections, such as legal basis for data 
sharing (section 4.1), data protection barriers related to cross-border data sharing, and ethical reasons 
for not to share CT data (section 4.5).  

Most countries (59% of the survey respondents, n=13/22) reported data protection challenges 
in relation to COVID-19 and gave insights into how these were overcome. The most common reasons 
were related to establishing data protection rules when setting up IT-systems for large scale CT data 
processing. Countries were primarily concerned with their national CT systems and processes, with 
only a few mentioning issues in relation to cross-border aspects. Within this context, no concerns were 
raised  about  applicability  of  GDPR  provisions,  with  the  exception  of  raising  awareness  about  how 
labour-intensive it is to ensure necessary agreements and documentations are in place.  

For further insights: in relation to establishing data protection rules and practices when setting 
up IT-systems, especially under time pressure, country responses shade light on challenges such as 
organisational data protection when data controller receives assistance from other authorities, legal 
analysis of the proportionality and sensitivity of the networks , consideration of the balance between 
individual rights and public interest, legality and necessity of CT tools, taking into account the limitation 
it could impose on fundamental rights as well as  use of databases and linkage of different information 
among them and use of mobile apps.  

Data collection and processing of personal data on a massive scale posed a major challenge for 
most countries. To overcome this challenge, countries  reported solutions such as  legal frameworks 
with  safeguards  required  by  GDPR  such  as  data  minimisation,  specified  data  retention  periods, 
limitation on recipients, specific controls, or updating IT systems to ensure that access was restricted 
based on the need for the different CT services. For personnel carrying out CT, trainings were organised 
on GDPR, or non- disclosure agreements were signed. 

4.4 Challenges and facilitators with regard to digital technology 

Countries were asked in the surveys to state the main practical challenges and facilitators that they 
had experienced with digital CT for COVID-19 within their country and with digital cross-border CT with 
other  countries.  Twenty  countries  (87%)  provided  responses  to  the  question  on  challenges  and 
facilitators of digital tools within their country and 21 countries (91%) responded to the question on 

39 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

challenges and facilitators of digital tools with other countries. Additional information obtained from 
the  interviews  and  webinars  has  also  been  incorporated  into  these  findings.  Challenges  that  were 
expressed  will  be  discussed  below,  followed  by  some  of  the  facilitators  of  digital  tools  that  were 
mentioned by countries. Please see Tables 16 and 17 in Appendix G for more details. 

4.4.1 National (regular) CT: Challenges and facilitators of digital CT within the country 

Challenges 
At the start of the pandemic, most countries reported a lack of digital technology for CT, leading to a 
lot of manual work. Digital technology had to developed extremely quickly, and constantly adapted to 
the pandemic, while taking scientific, medical, and legal aspects into account. One country in which 
different regions had been using excel sheets to register data, reported that there had been no time 
to discuss the development of a new tool or to implement it. Technological issues were reported due 
to the overload of index cases and users of the digital tools. A few countries reported a lack of funding 
for digital technology. 

Different regions often had different CT case management systems that were not compatible; 
data therefore could not be shared across or accessed by other regions. It was also not possible in 
every country to identify individuals across different systems necessary for CT, due to the lack of a 
unique ID identifier. Various databases relevant for contact tracing such as those that register vaccine 
status  and  test  results  were  often  not  linked  to  the  cases  registered  in  the  CT  case  management 
systems. Different  data sources  also varied in quality and standards, making it difficult to integrate 
them. 

Certain CT tools, such as proximity-based apps, were not widely adopted by the public, mainly 
due to privacy concerns. The Bluetooth signal of proximity-based apps was also reported to be limited, 
leading to low use by citizens. Some countries reported no challenges with digital tools, mainly because 
they were not used in their countries; one country reported that there was no need for a digital CT 
system. 

Facilitators 
Countries reported various digital tools for CT to be facilitators during the pandemic. Existing digital 
systems were upgraded to be able to monitor vaccination and lab data quickly, and new systems were 
developed, such as CT case managements systems and passenger locator forms. Although countries 
generally mentioned their proximity-based apps were not widely adopted, several countries referred 
to their proximity-based apps as a positive solution in helping to curb the infection. Many countries 
reported having their central CT database accessible to multiple actors to be a facilitator. 

Contact with citizens was facilitated with SMS messages, and digital tools enabling the self-
service of citizens were considered a facilitator to relieve the burden on PHAs conducting CT. Citizens 
were directed to a website, for example, to record their own contacts as well as inform them of their 
exposure risk. This information was then often transmitted to regional health authorities, saving them 
many and lengthy phone calls. Other facilitators mentioned were the customs treaty for joining efforts 
in implementing SORMAS between an EU and non-EU country  and the strong legal requirement in 
another country to conduct CT in all cases.  

4.4.2 Cross-border CT: Challenges and facilitators of digital CT with other countries 

Challenges 
Several  countries  reported  experiencing  an  overload  of  work,  especially  manual  work,  when 
conducting cross-border CT during peak times. Besides causing extra work, this manual work was also 
prone to errors. When they were overwhelmed with cases at the national level, cross-border CT was 
de-prioritised. Most countries also reported issues with missing data and incorrect data, when it came 
to important details such as addresses or telephone numbers. There were frequent delays in receiving 

40 

 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

data from other countries as well as from airlines, to the point that nothing could be done with the 
data received. Some countries reported to having received no or a late response from other countries 
on  the  cross-border  data  that  were  exchanged, so  they  did  not  always  know  if the  data  were  well 
received or how the data were handled. 

Some  countries  reported  not  being  aligned  with  other  countries  in  how  to  conduct  cross-
border CT, for example, with respect to the type of data that should be prioritised and shared between 
countries and with policy decisions regarding when to discontinue with or resume cross-border CT. 
This meant that the data received or sent may not be  acted upon. During the second webinar  one 
country mentioned challenges due to countries having different definitions of concepts, such as ‘close 
contacts’. As their definition was broader than that of other countries, this meant they may send data 
to other countries who may not act upon the data, due to them not defining the contacts as being 
‘close’. One country mentioned in the survey they did not register citizens becoming infected abroad 
in non-EU/EEA countries, so nothing was done with those incoming notifications. 

Various countries mentioned that the different tools countries had used for cross-border CT 
had compatibility issues, as well as differing degrees of security. Although they did not specify the exact 
tools  they  were  referring  to,  it  is  possible  that  proximity-based  apps  were  meant  or  issues  with 
encrypted information sent by secure mail. One country mentioned in the survey that not all countries 
were  able  to  use  the  encryption  tools.  During  the  second  webinar,  one  country  reported  that  it 
sometimes took days to be able to unlock the encrypted cross-border CT information.  

For  travel-related  CT,  there  were  also  difficulties  in  having  access  to  passenger  data  from 
airlines, and airlines often provided this data too late. The EUdPLF passenger data was sometimes also 
lacking in completeness and quality. Several countries questioned the added value of cross-border CT 
in general, particularly when it came to collecting airline passenger data. They expressed that cross-
border CT made the most sense at the start of the pandemic when the numbers were still very low and 
community level transmission had not started. 

Facilitators 
For cross-border CT, nine countries mentioned the EWRS as being a facilitator. It was regarded as being 
safer (GDPR compliant), faster and easier to use, than having to send password protected or encrypted 
emails. The EUdPLF was also reported to be one solution to the lack of interoperability of digital tools. 
A  few  countries  mentioned  bilateral  communication  and  assistance  between  specific  countries  as 
being functional and beneficial. Policy decisions like limiting cross-border CT only to certain conditions 
during the pandemic were also considered facilitators.  

4.5 Data protection and ethical challenges 

4.5.1 Data protection 

Countries were asked if they had experienced any data protection barriers when sharing CT data both 
within  EU/EEA  and  also  to  third  countries  under  IHRs  obligation.  Again,  the  majority  of  barriers 
experienced were during COVID-19 as discussed in section 4.1 and 4.3.  

Only five countries noted specific barriers outside of the pandemic situation. For instance, one 
country pointed out that transfer of personal information could only be in accordance with national 
and European legislation, meaning that data should be minimised and not to be ascribed to individuals 
unless necessary. Another explanation revealed that national law as a condition of sharing outside the 
EU/EEA stating that sharing data should be necessary or desirable for the prevention of spread or the 
removal of conditions favourable to such infection, but this was not raised particularly as a barrier. In 
case of one particular country, disclosures of health information always require patient's consent but 
that this is due to be reformed with the introduction of new legislation. 

41 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

The issue of proportionality of prospectively gathering citizens data for CT purposes has been 
mentioned on various occasions, highlighting the importance of balancing the right to privacy against 
the public interest of protecting public health: 

“….it  was  accepted  to  keep  out  the  first  patient,  but  in  later  stages  it  was  seen  as 
unproportionate to start register personal information and send it cross-border. This is a GDPR 
issue. Common sense is needed to do this or not if not necessary.” 

4.5.2 Ethical Challenges 

Countries were asked if a decision not to share CT data be taken. Context was given to clarify that a 
decision might be made where an ethical or fundamental rights concern arises, such as punitive or 
criminal sanctions for non-adherence to quarantine laws or sexual orientation. In these circumstances 
most countries prefer the application of a balancing test on a case-by-case basis with the disclosure 
indicating an anonymous direct contract with the affected person. 

Specifically relating to sexually transmissible diseases or Mpox, one country pointed out that 
in their case, NFPs can decide not to share CT data and indicated that this situation has arisen. Some 
countries apply a balancing test where a balance of interest can always be done between protecting 
public health and data protection. In the event that sharing CT data could pose a threat to a person’s 
wellbeing it could be decided that CT data are not shared, at least not the personal part of the data. 
As said above, however, with more sensitive data (like with the Mpox outbreak), direct contact with 
the person is preferred.  

It has been noted that if cross-border sharing may have significant implications for a person, 
risk assessment against the public health implications would be required. If formal CT through the NFP 
was not considered safe, if possible, informal communication would be encouraged from the index 
case to the contact to inform them so as they are aware to seek care if needed.   

Other practices included case-by-case basis assessment, as well as keeping participation in CT 
voluntary in order to maintain trust and ensure validity of data. It was explained that data supplied is 
shared as a general rule, but in theory, very specific concerns regarding an infected person could entail 
data not being shared.  For instance, if it is known that sharing of CT data can impose a substantial risk 
for the data subject, the choice can be made not to share this CT data.   
In case of another county which has a different legal approach, the legal basis obliges citizens to share 
personal data if asked by the authority and the authority is free to decide whether or not the sharing 
of data is necessary and adequate to the possible risks for the data subjects. Therefore, the risks can 
be addressed in each case individually.   
The interesting finding from this section is the importance of scope at individual MS level to make an 
assessment on whether to share CT data or not in these types of circumstances. It can be deduced that 
many MS see a greater public  interest  in ensuring that affected individuals are not  dis-incentivised 
from,  firstly  seeking  proper  medical  attention  out  of  fear  of  having  their  health  status  disclosed 
because of stigma or criminal sanctions attached to their sexual orientation and secondly ensuring that 
people are not dis-incentivised from being honest about their sexual partners or practices out fear of 
the implications such a disclosure may have.  

4.6  National  and  cross-border  CT  in  other  communicable  diseases  and  countries’ 
future directions  

Contact tracing is an integral part of infectious disease control methods for various diseases. While this 
study  focused  mainly  on  COVID-19,  open  questions  were  posed  in  survey  to  obtain  better 
understanding  on  CT  practices  in  relation  to  other  infectious  disease  (ID)  outbreaks.  In  total,  22 
countries  (96%)  responded  to  these  questions,  providing  the  basis  of  the  subsection  below.  These 
findings were also validated in the second webinar with further insights on future plans.  

42 

 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

4.6.1 Top 5 Infectious Disease Outbreaks that countries carry out CT for, other than COVID-
19 

The  EU/EEA  countries  who  responded  to  the  survey 
listed  Tuberculosis,  Measles,  Mpox, 
Meningococcal  Meningitis  and  various  sexually  transmitted  infections  (STIs)  as  the  top  5  disease 
(groups) for which they carried out regular CT in the last five years, other than COVID-19. The top 5 for 
cross-border CT is slightly different, in particular for STIs. Both rankings are shown in the tables below. 

Table 11. Top 5 other infectious diseases countries carry out regular CT and cross-border CT for 
Top 5 other infectious diseases countries carry 
out regular CT for (N=22) 

Top  5  infectious  diseases  countries  carry  out 
cross-border CT for (%**) 

• 

Tuberculosis (N=18) 

•  Measles (N=13) 

1. Measles (100%) 

2. Monkeypox (Mpox) (79%) 

•  Monkeypox (Mpox) (N=14) 

3.Tuberculosis (78%) 

•  Meningococcal Meningitis (N=13) 

4. Meningococcal Meningitis (77%) 

• 

Sexually transmitted infections (STIs), 
including HIV, Chlamydia, Gonorrhoea, 
Hepatitis, Shigella* (N=11) 

5. STIs (36%) 

* Not an STI but can be transmitted during sex and has been reported among STIs by two countries 
** % of countries that carry out cross-border CT for the infectious disease they also mention in the top 5 for regular CT 

4.6.2 Countries’ future directions for CT in cases of different ID scenarios 

To report CT practices of countries for ID other than COVID-19, a distinction has been made between 
‘CT’  and  ‘cross-border  CT’.  National  CT  covers  both  regular  (peace  time)  CT  and  CT  during  large 
outbreaks.  Additionally,  two  categories  have  been  made  within  other  ID:  1)  ID  with  respiratory 
transmission, such as Tuberculosis, Measles and Meningococcal Meningitis, and 2) STIs and ID that are 
transmitted through close contact and shared environment, such as Mpox2.  

National CT in the country and future outbreaks 
In terms of regular national CT, seven countries indicated that they used no different CT-system for 
COVID-19 compared to Mpox or other ID (AT, ES, FI, HR, IT, MT, RO). On the contrary, 10 countries (CY, 
DK, IE, LT, LU, MT, NL, SE, SI, and NO) used or developed a different CT-systems for COVID-19. Two 
countries, however, mentioned that legislation hampers the use of the COVID-19 system for other ID. 
Two countries stated that they do not have, or do not use, CT-systems for other ID than COVID-19 at 
all. There was not much specific information provided on the difference between national CT-systems 
or cross-border CT systems, but when countries mentioned a ‘different system used for CT’ they meant 
their national CT-system, unless specifically described otherwise. 

Only five countries mentioned having a digital CT tool being under construction for other ID 
(based on the system used during the COVID-19 pandemic). Almost half of the 22 countries stated that 
they have learned from COVID-19 in a way that they (would like to) use their knowledge and system-
developments for other ID as well. For example, using EUdPLF, and SORMAS for other ID as well.  

2 Mpox is not classified as an STI. It is transmitted in humans through close contact with someone who is infectious or contact 
with contaminated materials. However, due to the level of close contact required for transmission of Mpox, majority of the 
Mpox cases during the outbreak in 2022 were infected during sexual activity. Nevertheless, other routes of transmission were 
also reported, such as non-sexual close contact or, less frequently, through fomites. 

43 

 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

In the survey, countries were asked to compare their CT approaches for Mpox in comparison 

to COVID-19. They described the following main differences: 

•  Countries could handle the number of cases during Mpox, during COVID-19 this number was 

too high to handle; 

•  During Mpox, it was possible to handle the cases case-by-case; 
•  During  Mpox,  there  was  no  need  for  use  of  additional  (digital)  CT  systems,  since  CT  was 

conducted via phone and/or email and executed manually. 

In  the  survey,  as  well  as  during  interviews,  countries  were  specifically  asked  about  their 
strategies  and  future  plans  for  CT,  in  particular  in  relation  to  digital  tools,  which  were  reported  in 
section 4.6.2. Nevertheless, the answers did not yield further concrete future plans. During interviews, 
which  were  mainly  held  in  January-February  2023,  it  was  stated  that  countries  were  investigating 
future directions and digital solutions, however, did not yet have concrete plans that could be shared. 
Therefore, countries’ future plans in the case of different ID outbreak scenarios (i.e., ID with respiratory 
transmission, and STIs and ID transmitted through close contact or shared environments) were brought 
to the second webinar as a breakout room discussion on 23 April 2023. During this breakout room 
discussion at  the  second webinar, countries were asked about  their future  plans for CT  for ID with 
respiratory transmission during new outbreaks. As a response, two countries stated that they would 
re-activate digital CT tools. Specifically, one country mentioned to digitalise outbreak investigation on 
contacts and the systems for the managements of contact persons. The use of proximity-based apps 
was not something that countries foresee during other outbreaks of respiratory diseases. The reasons 
given for this were constraints related to legislation, acceptability issues among the general public, and 
unclarities about the efficacy of such an app. Furthermore, ID with respiratory transmission require 
different objectives for CT compared to others. Digital citizen-to-citizen CT tools can be useful when 
there is need for massive CT or large-scale contact warning due to very high numbers of cases but 
relatively little consequences of the infection (e.g., COVID-19).  

During  this  breakout  session  at  the  second  webinar,  countries  were  also  asked  about  their 
current and future plans for the use of anonymous digital partner notification for STIs and diseases 
that are transmitted through close contact. No country indicated the use of such platforms or plans to 
develop  them,  and  some  mentioned  various  difficulties  with  using  them.  Difficulties  that  were 
mentioned included not being able to ensure perfect confidentiality, fears related to data protection 
and privacy, STIs being too sensitive to notify digitally and the risk of discrimination for individuals in 
some countries, contact persons not always being known, and difficulties in convincing the public to 
participate digitally. Some countries reported having anonymised notification systems in place through 
STI clinics, which notify the contacts about their risk of infection and also provide recommendations to 
get tested.  

Cross-border CT 
Table 11 indicates that only 36% of the countries who reported carrying out regular CT for STIs included 
STIs in the top five ID for cross-border CT. In terms of cross-border CT, most of the countries (n=18) 
reported  no  information  about  cross-border  CT  for  STIs.  Four  of  these  explicitly  mentioned  not  to 
conduct cross-border CT for STIs at all. During the second webinar, one country also mentioned not 
doing cross-border CT for STIs and diseases that are transmitted through close contact. In addition, 10 
countries  did  not  (yet)  conduct  or  mention  cross-border  CT  for  Mpox.  Of  those  countries,  three 
explicitly stated that they do not conduct cross-border CT for Mpox.  

When  the  reasons  for  the  discrepancy  between  regular  and  cross-border  CT  for  STIs  were 
asked in the second webinar, the answers indicated that CT for STIs were carried out through STI clinics, 
GPs or other relevant physicians, and not through regular public health services. CT relies heavily on 
cases  informing  their  contact  persons  themselves.  After  evaluating  the  risk,  the  professionals  may 
contact partners directly, even if the partners are situated across borders. Thus, they do not necessarily 
follow the route for CT for ID through the EWRS. 

44 

 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

When countries were asked in the survey whether there could be a decision not to share CT 
data, two countries indicated that such a situation had already arisen in relation to STIs. One country 
explained further that in such a case when handling more sensitive data (e.g., with the Mpox outbreak), 
direct contact with the person is preferred. During the second webinar, further information was given 
that a risk assessment is made to determine which notification mechanism to use (notification via the 
index  case  or  anonymous  notification)  and  only  in  high-risk  situations,  the  existing  notification 
mechanisms would be used to share the CT information with another country. 

To  obtain  more  insights  on  decision-making  with  regard  to  cross-border  CT  in  the  second 
webinar, countries were asked via on online poll: “What factors do you consider when deciding which 
diseases  to  do  regular  CT  for  in  your  country?”.  They  were  asked  to  mark  their  top  3.  The  most 
important  factors  were  hospitalisation  and/or  case  fatality  rate  (67%),  transmission  level  (sporadic 
cases, clusters of cases, community transmission) (67%) and availability of post exposure prophylaxis 
(67%). Incubation period (52%) and attack rate (52%) were chosen thereafter and ethical issues (19%) 
and ‘other’ (19%) last. Societal acceptability was not chosen by any country as a relevant factor.  

When countries were asked about their future plans for cross-border CT for ID with respiratory 
transmission, it was apparent that the current systems and procedures (including the use of EWRS) 
work well and countries do not have any plans to change their approach.  

Legal aspects for other ID 
In terms of legal aspects, a majority of countries have indicated laws put in place during COVID-19 have 
proven  useful  for  other  ID.  Nevertheless,  several  of  these  laws  have  possibly  been  temporary  for 
COVID-19. 

During  the  second webinar, two countries mentioned having plans to enforce or adapt  the 
legal regulations on new (urgent) outbreak responses to be able to make use of digital tools for CT in 
other ID as well.  

Some countries state that ethical concerns can arise in relation to sharing data that may lead 
to  a  risk  to  the  rights  and  freedoms  of  the  data  subject  particularly  where  it  may  relate  to  the 
individual's sexual orientation. A risk benefit approach is often taken on a case-by-case basis in these 
circumstances. These were both findings from the survey as well as from the second webinar. 

4.7 Overall lessons learned from COVID-19 on regular and cross-border CT 

Countries were asked in the survey to list the main lessons learned in relation to cross-border CT, for 
peak  times  as  well  as  for  the  future.  Twenty-one  (91%)  countries  provided  responses  to  these 
questions in the survey. Additional information from interviews and webinars were also added to these 
analyses. These lessons were combined and categorised into the following themes. Please see Table 
18 in Appendix G for more examples. 

(1)  The necessary CT digital technology should already be in place 

For the future, digital solutions were mentioned as important for various purposes: to be able to share 
CT data across regions within countries; to enable the efficient sharing of data between regional health 
authorities and cross-border CT authorities, as these now were separate systems; to connect other 
systems relevant to CT within the country (e.g. databases containing vaccination status and testing 
results); to increase the speed of CT, by replacing the manual work conducted at the cross-border level; 
to be able to upscale CT activities when needed; and to increase the speed of receiving cross-border 
data (regarding passengers as well as cases and their contacts in other countries).  

(2)  Review if and when cross-border CT is effective 

Countries often  expressed  that  conducting  cross-border  CT,  in  particular collecting  passenger  data, 
may not actually contribute to bringing the pandemic under control. Several countries (five) expressed 
the lack of evidence of its effectiveness, in particular when cases have increased in number and there 

45 

 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

are high incidences of cases in all countries. During times that countries were already struggling to 
carry out CT at the national level, conducting CT at the international level, seemed less of a priority. As 
cross-border CT is time-consuming and labour-intensive, and can get in the way of other necessary 
work, several countries advised reviewing the recommendations when to conduct  cross-border CT. 
During the second webinar, when the participants were asked in what areas the EU could provide the 
most  support,  aside  from  technological  assistance,  the  option  ‘Evidence  of  the  effectiveness  in 
conducting  cross-border  CT’  was  the  most  frequently  chosen.  One  opinion  shared  was  that  it  was 
important  to  ensure  that  cross-border  CT  should  be  carried  out  when  necessary,  and  based  on 
scientific evidence, to avoid becoming a political instrument. 

(3)  Ensure there is sufficient human resource support  

Many countries mentioned it being important to have sufficient human resources in place, trained and 
readily deployable if needed. 

(4)  Good CT practices are needed to increase efficiency and reduce delay 

Most countries mentioned specific challenges encountered in CT that needed to be addressed. Delays 
(in data received from the EWRS and from passenger data) were considered a common obstacle to 
conducting  CT  on  time.  Needs  were  expressed  such  as  facilitating  the  collaboration  with  the 
international public transport, placing more focus on fragile and vulnerable populations and addressing 
technical problems with regard to registering foreign cases without the ID of the country. 

(5)  Clear agreements are needed on what cross-border CT information is needed  

Countries often appeared to be misaligned regarding expectations of the type of data to share with 
each other. It was also unclear what was done with the data that they shared with other countries, 
and they also did not always conduct CT with the data they had received from other countries. One 
country expressed that they would appreciate an obligation by countries to act upon requests sent 
through the EWRS on time. A need was expressed for clear agreements on what is needed and what 
is expected from countries, in terms of what data to share and when to share this data. During the 
second webinar it was suggested that risk assessments are needed to determine the criteria for when 
to make use of dPLFs. One participant suggested the option of developing an algorithm to determine 
when cross-border CT should be conducted. The need for CT could be different per country and be 
based on geographical factors (e.g., islands may need to be stricter with incoming travellers) or on the 
epidemiological situation or vaccination coverage of each country. Such a risk-based approach tailored 
to  countries’  needs  could  be  more  useful  instead  of  activating/deactivating  cross-border  CT  in  a 
uniform way across EU. What was less clear to the participants, was who should carry out these risk 
assessments. 

(6)  Good collaboration with cross-border countries and regions is needed 

Several countries mentioned the  importance of establishing good relationships early on with other 
neighbouring countries and regions, to ensure smooth cross-border CT. 

(7)  Action plans and procedures should be in place.  

Countries mentioned the importance of investing in health infrastructure, with the necessary human 
resources and other facilities, as well as cross-border action plans and procedures already in place.  

46 

 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

5. Future of cross-border CT in EU/EEA countries: findings 

5.1 EWRS selective exchange module and integration of national tools 

Despite being generally an efficient platform, during peak times of a COVID-19, EWRS was experienced 
as less efficient as it could create a labour-intensive process (see section 4.4.2). This was particularly 
tough for small countries or countries with limited human resources to allocate to EWRS. Furthermore, 
countries had different  policies  and priorities on cross-border CT  and sometimes  received delayed, 
missing or incomplete data through EWRS (see section 4.3.1).   

This section investigates how the EWRS selective exchange module can be improved with 

adoption of new features and explores possibilities on the integration of national digital 
technologies.  

5.1.1 Perspectives on adoption of new features on EWRS selective exchange 

In  this  section,  the  perspectives  on  the  adoption  of  new  features  on  EWRS  selective  exchange  are 
discussed. These are based on the results from the survey (87% of the EU/EEA countries responded, 
n=20), interviews (all EU/EEA countries interviewed, n=11) and webinars 1 and 2.  

Definition of the minimum data required for CT as part of EWRS contact tracing  
The survey and interview data indicate that the majority of the respondent countries (65%) shared 
positive  perspectives  on  the  adoption  of  minimum  data  requirement.  There  is  a  clear  need  for  EU 
alignment on definition of minimum required data for CT. This can improve  quality (completeness, 
accuracy and timeliness) of data exchange via EWRS, while improving efficiency and reducing strain on 
human resources.   

“National CT systems, which have parameters in IT systems, should also be to send the 
variables to EWRS (without having to retype). They prefer a copy/paste-function. If data 
would be standardised in EWRS, the risk on forgetting data would also decline. This is more 
efficient because MS do not have to send messages if things are missing.” 

Some of the responses noted the following considerations when adopting this feature:  

•  Definition of minimum data required should not be adopted in a too restrictive way. This could 
prevent relevant data from being sent, especially in cases of emerging infectious diseases, as 
can be seen during the Mpox outbreak. Even limited information can be useful to signal and 
help understand the spread.   

•  CT data as part of EWRS selective exchange needs to be suited to a varied range of diseases 

• 

for which cross-border CT is conducted.  
It might be the case that not all of the required variables are collected during regular CT of the 
country. One country mentioned that national legislations might need to be changed in order 
to collect the required data.  

Of note, adoption of the definition of the minimum data required for CT as part of EWRS contact tracing 
is currently being undertaken at the EC level by defining the variables that can be exchanged for cross-
border CT, replacing the Commission Recommendation (EU) 2017/1140(18) on personal data that may 
be exchanged through the Early Warning and Response System (see Appendix A for details).   

Structured cross-border CT data as part of EWRS selective exchange   
The survey and interview data indicate that the majority of the respondent countries (65%) shared 
positive  perspectives  for  adoption  of  structured  cross-border  CT  data  as  part  of  EWRS  selective 

47 

 
 
 
 
 
 
  
  
  
  
  
Feasibility study on digital technology for cross-border contact tracing 

exchange.  Discussions  and  poll  responses  of  the  first  webinar  also  resonated  with  these  findings. 
According to the responses, there is a clear need for adoption of standardised and structured cross-
border CT data to optimise CT through EWRS. This also meets the need to use EWRS selective exchange 
as a single platform used only for cross-border CT and no other purposes (e.g., MEDEVAC). During peak 
times of COVID-19, the selective exchange module was used very heavily, leading to an overload of 
messages  for  some  countries.  There  were  times  that  they  were  not  able to keep  up  with  the  new 
exchanges  received.  Countries  agreed  that  the  adoption  of  structured  cross-border  CT  data  could 
prevent such situations by enhancing information sharing and streamlining data formatting, leading to 
improved efficiency.   

“Would be nice to have ‘selective exchange’ not full of CT like during COVID-19.” 

Some of the responses noted the following considerations when adopting this feature:  

• 

In relation to applicability, this feature needs to be suited to a varied range of diseases for 
which cross-border CT is conducted.  

•  Usefulness of adoption of structured cross-border CT data as part of EWRS can be investigated 

on a scientific basis.  
In-depth analysis on legal aspects might be necessary.  

• 

Of note, a new EWRS architecture is currently being explored through another study to make selective 
exchange for contact tracing an independent module, which will provide the ability to separate data 
access to specific users and for different purposes, e.g., MEDEVAC (see Appendix A for details).   

Inclusion of data from EU or national dPLFs as part of EWRS selective exchange  
During COVID-19, the EUdPLF or national dPLFs (via the ePLF) were sometimes used to exchange data 
between countries. This meant having two separate platforms for exchanging CT data for countries: 
ePLF and EWRS. Exchanging EU or national dPLFs through EWRS can simplify cross-border CT during 
pandemic situations by providing a single platform to exchange data. In terms of the data types within 
this context, during COVID-19, the countries relied on Commission Recommendation (EU) 2017/1140 
which determines what personal data may be exchanged through EWRS. Going forward, Regulation 
(EU) 2022/2371 delegates the power to the Commission to adopt a delegated act in this respect. 

Adoption of inclusion of data from the EU or national dPLFs as part of EWRS selective exchange 
received positive comments in a quarter of the responses from the survey and the interviews (27%). 
This relatively low rate is possibly related to the fact that all countries use EWRS, but only a few them 
used  EUdPLF  and  national  dPLFs  during  COVID-19,  to  a  varying  degree.  According  to  responses, 
inclusion  of  the  EU  or  national  dPLF  data  as  part  of  EWRS  selective  exchange  could  lead  to  better 
coordination of sharing data. In particular, the usability will be increased if all countries use (EU)dPLFs 
and the dPLFs are completely integrated.   

“Every EWRS country should use (EU)dPLFs to get the data as smooth as possible into EWRS.” 

Some of the responses noted the following considerations when adopting this feature:  

•  EU  or  national  dPLFs  should  be  analysed  by  the  receiving  country  and  there  must  be 

confirmation that a positive case is in the country concerned.  

•  There might be legal challenges in relation to the inclusion of EU or national dPLFs as part of 

EWRS selective exchange.  

•  A few countries provided general reservations on the necessity and cost benefit of using EU or 

national dPLFs.  

Of  note,  integration  of  EU  or  national  dPLFs  into  EWRS  selective  exchange  is  currently  part  of  the 
definition of the minimum data required for CT as part of EWRS contact tracing. This is currently being 

48 

 
 
 
  
  
  
  
  
 
  
  
Feasibility study on digital technology for cross-border contact tracing 

undertaken at EC level by defining the variables that can be exchanged for cross-border CT, replacing 
the  Commission  Recommendation  (EU)  2017/1140(18)  on  personal  data  that  may  be  exchanged 
through the Early Warning and Response System (see Appendix A for details).   

Additional features that EWRS could have in the future   
Several features and  perspectives were  brought  up as a response  to the question in the survey on 
additional features of EWRS. The following themes emerged as options for new features and issues to 
be considered:  

1.  Useful features to EWRS – improving selective exchange  

•  Adding unique identifiers for each procedure/exchange between countries can improve 

• 

the efficiency and traceability of CT data.  
Implementing new selective exchange message types: Implementing permissions for data 
protection  could  improve  communication  by  preventing  CT  efforts  being  divided  into 
different messages. Separating urgent and general information is also mentioned by one 
country. Due to high information flow, urgent messages can be missed.   

•  One response mentioned that there should be a common file with all countries to increase 

interactions and see whether actions are being taken after an exchange.   

2.  Additional features to EWRS  

•  Connecting national platforms with EWRS   
•  Combining EpiPulse and EWRS platforms  
•  A separate section for MEDEVAC  
•  Registering up to date information of control measures of countries   

3. 

Identification of new functions and features  
•  The need for a robust governance structure to handle MS’s suggestions on EWRS  
•  The need for more discussion among countries in relation to useful features of EWRS   
•  Keeping EWRS user-friendly  

4.  Other topics raised  

•  Two-factor authentication to access EWRS   

5.1.2 Opportunities regarding integration of national tools into EWRS selective exchange 

In this section the opportunities regarding the integration of national and subnational tools into the 
EWRS selective exchange module are discussed. This section is based on results from the survey (65% 
of countries, n=15), interviews (55%, n=6) and webinars 1 and 2.   

Several  countries  indicated  their  wishes  and  opportunities  to  integrate  national  case 
management  systems  and  data  sources  into  EWRS.  To  improve  management  of  data,  the  unique 
identifier in the national system (ID) needs to be linked to the unique identifier in EWRS. This would 
immensely improve the efficiency of cross-border CT.   

Nevertheless, there are a number of challenges ahead to integrate national tools into EWRS 
selective exchange. The first one is the organisation and governance of CT in countries, as indicated in 
section 4.2. The discussions during interviews and the first webinar indicated that CT is often governed, 
organised, and conducted at a subnational level in most of the countries, with the exception of smaller 
countries. In line with the subsidiarity principle of EU law, national or regional health authorities are in 
charge  of  how  they  organise  and  conduct  CT  and  what  digital  technologies  they  use  for  it.  Where 
countries operate a regionalised healthcare competence, national level CT policy and guidance, almost 
always  exists.  Most  subnational  authorities  provide  data  to  the  national  outbreak  response  and 
management systems mainly for surveillance purposes. The EWRS operators in charge of cross-border 
CT do not appear to have direct access to the CT data and therefore exchange CT data with subnational 

49 

 
 
 
 
  
   
   
 
 
  
  
Feasibility study on digital technology for cross-border contact tracing 

levels  (or  authorities  who  carry  out  CT)  through  platforms  such  as  secured  email,  online  forms  or 
encrypted  servers,  which  are  outside  the  outbreak  response  and  management  systems.  From  a 
governance perspective, integration of CT technologies used at subnational level to EWRS could be a 
possibility, but this would require involvement and commitment of several subnational authorities, 
which reduces the feasibility of linking all of them to EWRS.   

Smaller countries (e.g.,  CY, LT, LU, MT,  SI and IS, LI) often have  a rather centralised system 
where contact tracers and EWRS operators are situated in the same organisation and can use the same 
electronic systems. In addition to smaller countries with centralised systems, integration of national 
systems to EWRS can potentially be an option in countries where there is one national organisation 
that organises or supports CT (e.g., FR, National Health Insurance), or countries who are preparing to 
have CT platforms that can operate in national level (e.g., IE).   

Nevertheless, various technical challenges remain with respect to the integration of national 
or subnational CT technologies into EWRS, as there is a very large variety of outbreak management 
systems used at national and subnational level, most of which are developed within the country for 
their specific needs. Internationally known platforms, such as WHO’s Go.Data were only briefly used 
by some countries or regions at the beginning of the COVID-19 (e.g. MT and some regions of ES and 
FR) but later discontinued and replaced by CT systems developed nationally or sub nationally. Some 
countries reported having very manual CT methods, which cannot be integrated into EWRS. Having a 
very large variety of national and subnational outbreak management systems used for CT in EU/EEA 
countries significantly limits the feasibility of linking them to EWRS.   

5.2 International travel-related CT in Europe  

Transmission  of  infectious  disease  agents  can  happen  during  travel  using  collective  transportation 
between countries, such as airplanes, trains, ferry, etc. To carry out CT involving such cases, countries 
may  utilise  different  approaches  depending  on  their  national  legislations,  including  use  of  national 
dPLF or EUdPLF during large outbreaks (pandemic or crisis time), as well as obtaining passenger lists 
from  airlines  during  large  outbreaks  and  ‘peace’  time.  This  section  present  findings  of  surveys, 
interviews and webinars on obtaining passenger lists from airline companies and related legal aspects, 
and use of the EUdPLF and national dPLFs, based on results from the survey (70% of the respondents 
of EU/EEA countries who responded the survey (n= 16)) and interviews (all EU/EEA and non-EU/EEA 
countries interviewed) and webinars 1 and 2. 

5.2.1 Use of national and EUdPLF to support cross-border CT 

In the absence of having direct access to passenger data, a next best solution to CT for transmissions 
during journey with collective transportation means is use of dPLFs during large outbreaks which reach 
epidemic or pandemic scale. As presented in section 4.2.2, EUdPLF was used by four countries during 
the COVID-19 pandemic and many other countries used dPLFs for collecting passenger data but not 
always for CT purposes. This section summarises the potential benefits and potential challenges of EU 
and national dPLFs used for CT purposes, as well as provides an overview of legal aspects on the use 
of dPLFs.  

Potential benefits of EUdPLF  
Respondents  from  several  countries  shared  that  the  EUdPLF  could  (potentially)  support  efficiency 
through easier and faster execution of CT. This included data collection (e.g., of infected passengers), 
exchange between stakeholders, finding contacts, reducing workload, automating, and implementing 
measures for infected people amongst others, depending on the context of the disease outbreak.  

50 

 
 
 
  
  
  
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

“An easier and more rapid data collection and exchange between stakeholders, making CT 
more effective and efficient if risk areas are declared and using the digital tool will be 
mandatory for travellers.” 

According to come countries, EUdPLF also provided improved data security, accessibility and quality. 
The  handwritten  PLFs,  for  example,  were  difficult  to  decipher  during  the  pandemic.  EUdPLF  was 
regarded  as  having  the  flexibility  to  adjust  to  national  needs  and  was  available  in  many  European 
languages. As a common EU tool, EUdPLF could improve interoperability, minimise misunderstandings, 
and prevent duplications involved in cross-border CT.  

A key facilitator mentioned in promoting / encouraging the use of both dPLF / EUdPLF was its 
use in preventing the need to gather passenger data from airlines for CT. Additionally, it can be linked 
to the EWRS. 

The dPLF was considered a useful tool, particularly in the early phases of the pandemic when 
transmission levels were low, and in an island setting. This indicated the importance of having national 
decisions on when to implement dPLFs according to the epidemiologic status and other needs of the 
country. 

During the interviews, several EU/EEA countries stated that they would consider joining (if legal 
barriers are removed) or were preparing to join the EU dPLF. Although not in the EU, CH also expressed 
being keen to join the EU dPLF for future pandemic preparedness. 

Potential benefits of national dPLFs over EUdPLF 
During the pandemic, several countries used their own national dPLF for CT and/or other purposes 
such as travel-related quarantine. Some countries who used a national dPLF for CT purpose indicated 
their preference to stay with it, instead of moving to the EUdPLF, as this provided the opportunity to 
shape the form according to the country’s needs and priorities and enabled the country to integrate 
the dPLF into their national CT case management system.  

Potential challenges of national dPLFs and the EU dPLF  
For  both  national  dPLFs  and  the  EUdPLF,  various  challenges  were  stated.  First,  collecting  data 
individually  from  passengers  was  prone  to  error  and  required  their  compliance,  digital  literacy  and 
access to relevant digital tools. Countries using the EU dPLF reported issues with data quality, including 
passengers sometimes deliberately excluding certain data to avoid quarantine. Seat numbers were also 
often not included in the form, as passengers filled in the form prior to check-in and seat allocation. 
Overall, the dPLF was considered to be a burdensome procedure for passengers to fill in on a routine 
basis.  

Concerns about data security and potential leakage and the locations where data was stored 
and managed were also raised. Also, if there was a lack of coordination in relation to how countries 
should respond and for which communicable diseases these EU digital tools could be applied, there 
could be a random usage of the tool, depending on the epidemic situation.  

“Without a defined list of which communicable diseases this applies to, the system may be 

exploited or cause an unnecessary burden on the epi service.” 

Other challenges mentioned in the survey, interviews, and webinars: 

• 

Legal  challenges  for  using  EU  digital  tools  in  relation  to  GDPR,  national  law,  and  data 
protection arrangements 

•  Evidence of the value, effectiveness, and efficiency of use of dPLFs 

51 

 
 
 
 
 
  
 
 
Feasibility study on digital technology for cross-border contact tracing 

•  Costs as a barrier to use dPLF (one country) 

One country stated not using PLFs directly because they have no entry points by air or sea. 

Legal aspect of dPLFs  
Out  of  the  17  countries  that  used  dPLFs,  the  majority  (64%)  had  adopted  new  laws  allowing  the 
introduction of PLFs, while others (CZ, ES, FI, HR, MT, SI) relied on existing legislation. At the time of 
data collection, with the exception of four countries (AT, IS, LI, SK) who indicated their newly adopted 
laws are still in place, it was reported that most national laws (CY, DE, FR, IE, IT, LT, RO) were subject 
to sunset clauses and are no longer in place, meaning that new legislative acts would be required for 
the re-introduction of PLFs. 

To illustrate compliance, nine countries, about half of those that operated dPLFs,  explained 
that they carried out data protection measures to be in line with the GDPR principles of lawfulness, 
fairness,  transparency,  purpose  limitation,  data  minimisation,  accuracy,  storage  limitation,  security 
and accountability. Three countries specifically pointed out that they carried out a DPIA, while others 
said that they were compliant with GDPR through other measures.  

As mentioned above, legal challenges have been noted by countries in relation to PLFs. Some 
of the concerns shared by countries stem from the need to balance public health protection measures 
with safeguarding privacy and rights of the individuals. For instance, when PLF is a pre-condition for 
travel, there should be a solid justification for such CT measure based on evidence that it effectively 
reduces transmission in order to collect personal data on a large scale and in certain cases, to restrict 
freedom of movement. Other related challenges, such as the administrative burden on the citizens as 
well  as  on  public  health  authorities,  including  having  data  protection  processes  in  place  have  been 
noted by many as well.  

Specifically in relation to EUdPLF, some countries shared hesitancy based on data protection 
and  security  concerns  due  to  the  location  of  the  EUdPLF  servers,  as  well  as  the  need  for  further 
consideration to amend national laws to match the complexity of the decentralised national CT systems 
or to justify using EUdPLF by demonstrating its real benefits. Retaining  autonomy to make  national 
decisions based on the epidemiological situation and national needs plays an important role too. Lack 
of appropriate agreements with the EU was also reported to be a legal barrier in the case of one of the 
EEA countries, although there is a clear interest to overcome these due to the Schengen area. 

5.2.2 Use of passenger data from airlines 

This section covers national practices to obtain passenger data from airlines in order to improve CT of 
cross-border  travellers,  the  legal  base  rooted  in  national  laws  to  support  such  data  sharing,  and 
possible future strategies that countries envision. Findings are based on survey, interview and webinar 
data with various levels of response rate per topics. 

National practices  
Although there is no legal base at EU-level to make passenger data held by airlines available for the 
purpose of CT, 24 countries - all but one respondent indicated receiving passenger data from airlines 
(AT, CY, CZ, DE, DK, ES, FI, FR, HR, HU, IE, IT, LT, LV, LU, MT, NL, RO, SE, SI and IS, LI, NO, as well as UK).  
The  majority  of  the  countries  (62%  of  the  respondents)  did  so  through  the  organisation  in 
charge of sharing cross-border CT data via the EWRS, while others received the names through other 
public  administration  channels.  However,  this  data  often  came  with  delays  or  were  sometimes 
incomplete or incorrect. The data is available in airlines only for a limited period of time after landing, 
meaning it is not always available. The quality of the data also varied across airlines, as not all airline 
offices in all countries were willing or able to cooperate. The cooperation of the PHA was usually good 

52 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

with the flag carrier airlines as they have a stronger team in that country and better knowledge of 
national legislation, but this might not be the same for other airlines. Furthermore, the airlines might 
ask for the identity of the index case from the PHA in order to provide other passengers’ data, which 
was not possible.  

"If we don’t have … pandemics … we can handle this with the semiautomated systems. We 
can ask from the airline companies … and there is enough time to do the contact tracing. 
However, when you have a lot of cases, it’s not anymore possible to do that... If we had this 
kind of structured and valid passenger information available, that would have been more 
easily, more efficient ..." 

Important to note that most countries explained receiving passenger data from airline companies as 
per request. No country reported routinely receiving passenger lists.  

The interviews revealed that obtaining data from airlines for CT was not easy, due to differing 
priorities  of  the  airlines  and  PHAs.  The  PHAs  had  public  health  interests  in  mind,  whereas  airlines 
represented  the  commercial  interests  of  the  company  and  needed  to  balance  that.  This  made  it 
difficult to establish the cooperation, even in the case of appropriate legal background. 

Most answers implied that data sharing was a mandatory obligation for the airline companies 
based on national legislation,  although the success  rate of obtaining such information varied, even 
within countries, depending on the cooperative willingness of airlines. One country specified that they 
didn’t impose obligation and relied on voluntary collaboration. Some countries also shared that their 
obligations were not specific to airlines, as they requested collaboration from other types of travel 
operators as well.  

By comparing airline data sharing practices with usage of dPLFs, we can conclude that those 
countries who did not introduce dPLFs seemed to have relied on data from airlines as their main source 
of passenger data, whereas the others made use of both data sources. In some cases, data from airlines 
helped to complement incomplete dPLFs. 

National legal base to support such data sharing  
All 20 countries that provided information on the legal base for receiving passenger data from airlines 
referred to national rules (AT, CZ, DE, DK, ES, FI, FR, HR, HU, IE, LT, LV, LU, MT, NL, RO, SE, SI, and LI, 
NO), either by pointing towards national public health laws, – which was the most common answer – 
or  by  referring  to  COVID-19  related  emergency  legislation.  However,  some  countries  phrased their 
answer in a generic way pointing towards public health reasons. Interestingly, GDPR Article 6.1 e was 
referenced  in  one  case.  Important  to  note  that  when  describing  the  national  legal  context,  three 
countries pointed out that their actions are in accordance with IHRs (2005).  

Most  countries  referred  to  laws  that  pre-date  the  pandemic,  while  only  three  countries 
specifically  pointed  to  enabling  legislation  adopted  as  response  to  COVID-19.  Furthermore,  four 
countries mentioned the distinction between pandemic and non-pandemic situations implying data 
sharing practices that may not have been specific to a cross-border health threat situation, although 
further research would be needed to establish how national laws apply under different circumstances.  

Possible future strategies countries envision  
Countries expressed their interest in coming up with a coordinated approach in preparation for future 
threats, such as the standardisation of data that PHA can request from airlines, or the development of 
means  to  rapidly  and/or  directly  access  airline  data.  Nevertheless,  due  to  the  current  legislative 
framework within the EU, such suggestions should be addressed at the MS level with the involvement 
of national security authorities.  As an example, one country  indicated that they were  developing a 

53 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

system whereby airlines can easily share data with national public health authorities. The legislative 
framework within the EU includes the following: GDPR restrictions in relation to secondary use of data; 
the recent EU Court ruling in relation to the PNR Directive(31); and the EU Directive related to the use 
of  API  and  PNR(32)  which  is  applicable  for  security  use  only.  There  is  a  lack  of  mandate  to  make 
passenger data held by airline companies available to public health authorities.  

5.3 The need for EU-level support for regular and cross-border CT 

Regarding  EU/EEA  countries,  EU-level  support  is  needed  to  facilitate  national  (regular)  and  cross-
border  CT  in  various  aspects.  This  section  is  based on  results  from  the  survey  (78%  of  the  EU/EEA 
countries that responded, n=18), interviews (all EU/EEA countries interviewed, n=11) and webinars 1 
and 2.   

5.3.1 The need for EU-level support in relation to digitalisation of national (regular) and 
cross-border CT in EU/EEA countries  

The  survey  and  interview  data  and  the  discussions  at  the  webinars  indicated  that  there  are  some 
aspects of CT that need to be tackled at a national level while other aspects can be supported at -EU-
level. In the section below, the analysis of these aspects is described by categorising them into national 
and EU-level.  

National level 
Some countries responded that there are different CT practices that need to be tackled by national 
governments and/or at national level. According to the responses, there is a clear need for an increased 
digitalisation  and  automatisation  of  CT  systems,  as  well  as  the  coordination  and/or  integration  of 
systems. This would apply to subnational, national, and international level and can improve usefulness 
and efficiency. Often subnational authorities are in charge of how they organise and conduct CT and 
what  digital  technologies  they  use  for  it,  although  guidance  and  policies  come  from  national 
authorities. EWRS operators responsible for cross-border CT often do not have direct access to CT data, 
which  makes  the  exchange  of  CT  data  with  subnational  levels  (or  authorities  performing  CT),  for 
example via secure email, online forms or encrypted servers that are outside the outbreak response 
and management systems, more difficult. Connecting local data resources and allowing national public 
health authorities to directly access CT data will improve the effectiveness of national CT procedures. 
However,  there  is  a  very  wide  variety  of  outbreak  management  systems  used  at  national  and 
subnational levels. Most of these are developed within the country for their specific needs. This wide 
variety significantly limits the feasibility of linking them to EWRS.  

“The digitalisation has to happen nationally and regionally to be useful and efficient. 
Integrations to national systems for testing, online questionnaires and personal data needs to 
be put in place, which makes it difficult to standardise at the EU-level.” 

Some of the responses mentioned the following regarding EU-level support on digital CT technologies 
at national level: 

•  A  platform  or  app  to  support  CT  activities  at  national  and  cross-border  level  including  a 
common database for storage of airline passenger data would be a useful support. In addition, 
it will be important that EWRS operators in charge of cross-border CT data exchange can have 
authorisation to access this database for CT purposes. 

•  Some countries suggested that it might be beneficial to have a common tool for CT to be used 
at  national  level  in  EU/EEA  countries,  such  as  Go.Data,  for  outbreak  management  and 

54 

 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

infectious disease  surveillance.  This could facilitate exchange of CT data between countries 
while applying data protection. 

•  Evaluation frameworks are needed to demonstrate the added value of CT during peak times, 
especially  when  public  health  systems  are  overwhelmed.  One  country  mentioned  that  the 
added value of evaluation frameworks is that it can sustain practices both at local and national 
level.  

•  Setting up a legal framework for digitalisation. 
•  Political  awareness  that  lobby  and  advocacy  is  necessary  for  CT  software  and  platforms  at 

national level. 

•  Funding  of  system  integration,  a  standard  setting  for  CT  tools,  and  a  standardised  and 

adaptative CT tool. 

EU-level 
The survey and interview data indicate that the majority of the respondent countries expressed the 
need for EU alignment and guidance on standardised policy, guidelines, and systems for cross-border 
CT  (n=15).  There  was  a  clear  need  for  standards  and  guidance  on  what  countries  should  do  for 
pandemic CT preparedness: when to continue/discontinue CT, how to define cases and contacts, what 
data should be shared, and how to handle pandemics in a more holistic way. This will speed up future 
responses to cross-border threats and will improve practicality, and systems. “Coordination on when 
to continue/discontinue cross-border CT during outbreaks” was listed among the top 3 areas the EU 
could  provide  the  most  support  for  cross-border  CT  during  the  second  webinar  (52%  of  the 
participants).   

“Protocols could be shared at EU-level, and even better, at the international level with WHO. 
But for instance, each module dedicated to one disease, we should have make sure that ECDC 
is on board with the protocol guiding, what should be the contact tracing; incubation period 
and all those different recommendations, so that every member state can have the same, 
almost the same strategy and contact tracing... also (during COVID-19) there were different 
views from different countries of about when to do contact tracing, when to stop and so 
receive requests for information or information and some countries would use it, some would 
not. So, when it's harmonised, I think we're also using less time.” 

The overall findings indicate that a balance needs to be sought between EU-level coordination and 
national autonomy. Despite acknowledging the need for standardisation and guidance regarding cross-
border CT, some countries emphasised their wish to maintain their autonomy with regards to when to 
start and stop conducting cross-border CT, according to their national needs and priorities. According 
to some countries, the aim of the EU should focus on standardising CT data exchange. Nevertheless, 
countries also indicated that in order to manage their day-to-day operations, they saw a great value in 
having an overview of all countries’ statuses on whether they are following up on the incoming CT 
data.  

One solution recommended at the second webinar was that EU-level coordination could come 
into place when the countries ask the EC for this role during outbreaks. Another suggested solution 
was  the  development  of  an  algorithm  for  countries  to  determine  when  cross-border  CT  should  be 
conducted according to their geographical situation (e.g., islands may need to be stricter with incoming 
travellers), or on the epidemiological situation or vaccination coverage. Such a risk-based approach 
tailored to countries’ needs could be more useful instead of activating/deactivating cross-border CT in 
a uniform way across EU. 

Some of the responses mentioned the following considering EU standards and guidance:  

• 

“Guidance  on  a  platform  that  could  integrate  general  and  disease  specific  assistance’.  For 
example: ‘rules to apply on collective transportation (especially the number of seats to look for 

55 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

next to an index case, and also the impact of mask wearing on CT, the impact of the distribution 
of meals on board)”. 

•  Digitisation  of  tools  for  airline  passenger  data  so  that  digital  resources  are  immediately 

• 

available and to be able to scale up when necessary.  
Improving surveillance and monitoring of infectious diseases to enable better evidence-based 
policy making. 

•  Training on new features of EWRS. 
•  Guidance  on  standardised  policy-making:  transparent  risk  assessment  and  contact  tracing 

decision making with regard to subsidiarity and proportionality. 

The majority of the respondents also expressed the need of having opportunities to exchange best 
practices with other countries (n=8). In this way, national capacities can be further enriched by the 
knowledge and expertise gained from other countries. “Exchange of best practices between countries” 
was also listed among main areas the EU could provide the most support for cross-border CT during 
the second webinar (43% of the participants). 

As reflected in sections 4.7 and 5.1, one of the areas of need for EU-level support is research 
on the effectiveness of performing cross-border CT, both for potential transmission at departure or 
destination  countries,  and  potential  transmission  during 
international  travel  with  collective 
transportation means (in particular by planes). During the second webinar, “Evidence of effectiveness 
in conducting cross-border CT” was listed among the top 3 areas where the EU could provide the most 
support for cross-border CT (61% of participants). Such research can demonstrate when cross-border 
CT is beneficial to curb transmissions in a timely way.  

Other areas where  the  EU could  provide  support for cross-border CT  according to  countries are  as 
follows: 
• 

Implications of the new Regulation (EU) 2022/2371 for cross-border CT (listed among top 3 
areas the EU could provide the most support for cross-border CT during the second webinar 
(48% of the participants)).  
Improve timeliness of action by countries on sent/received data, communicated via a common 
file accessed by all EU/EEA countries. 

• 

•  Define quality standards and monitor effectiveness. 

5.3.2 EU support needs in relation to improve contact tracing software and platforms for 
cross-border CT performance  

According to some countries, the aim of the EU should be to standardise and facilitate information 
exchange  across  countries,  as  was  the  aim  with  the  introduction  of  dPLFs  and  the  current 
developments of EWRS on new features (see section 5.1.1). Further opinions were shared on having a 
coordinated platform where other data, e.g., vaccination status or former test results, could be shared.  
With regard to countries’ suggestions for features of EWRS, the importance of direct access of 

regional public health authorities to EWRS and the linkage of local data sources was indicated.  

5.3.3 Policy that can facilitate and/or hinder the integration of data resources for CT 

In terms of policies that can facilitate or hinder integration of data resources for CT, some countries 
responded  that  they  did  not  have  any  specific  policy  that  may  influence  the  integration  of  data 
resources for CT in their country. However, the majority of the respondent countries shared factors, 
as described below.   

Two countries indicated experiencing challenges with regard to legislation for the integration 
of  data  resources  for  CT,  in  particular  in  relation  to  GDPR  and  its  interpretation.  Also,  the 

56 

 
 
 
 
  
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

understanding of the effect of its implementation were vague across MS according to one country and 
therefore, a discussion on the implementation of this legislation could be useful.  

“One of the main hindrances in the beginning was the reluctance of relevant actors in handing 
over data, due their strict interpretation of the GDPR and fear of processing data unlawfully by 
transferring data to the Chief Epidemiologists Office.” 

Some of the responses noted the following suggestions on how to deal with challenges in relation to 
legislation: 

•  Allow  easier  use  of  pseudonymised  health  (and  other  non-commercial)  data  and  facilitate 

exchanges between countries.  

•  Provide  potential  incentives  to  all  (health)  partners  to  share  data  with  public  health 

authorities.  

•  Developing future data privacy frameworks for crisis periods. 
•  Establish an emergency preparedness register at national level, which allows different actors 
in the country to access CT data from selected tools that could be linked to other data sources 
(in a time-limited way).  

Another challenge mentioned by countries regarding the integration of CT data resources is the way 
the  current  national  digital  infrastructure  is  organised.  As  a  result,  it  is  not  always  possible  to  link 
(sub)national  CT  platforms  to  each  other  (either  among  regions  or  with  laboratory  platforms,  for 
example) and to share information between these platforms. This lowers the efficiency of CT practices. 
In addition, the responsibility for the implementation of CT lies at the regional level, but because the 
way  in  which  CT  is  performed  is  legally  determined  at  the  national  level,  this  makes  it  difficult  for 
countries to take joint decisions.  

“Regions are independently responsible for CT and can therefore decide what system/tools they 
need and want to use. This means that it is difficult to reach consensus to use and develop one CT 
system. Not all regions see the need or want to spend the resources needed to develop and 
integrate new systems.” 

57 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

6. Conclusions and Recommendations 

This section presents the conclusions of the study in the form of short answers to the key questions 
posed  in the  introduction section.  These  answers  provide  a  summary of  the  analysis  regarding the 
feasibility  of  integration  of  national  digital  technologies  into  the  EWRS  selective  exchange 
functionality. They also provide information regarding countries’ views toward and needs regarding 
the use of digital CT technology for other ID scenarios, such as respiratory diseases, Mpox and other 
STIs. Collectively, these answers provide guidance on how to use digital technologies for enhancing 
cross-border CT in support of health emergency response. 

6.1 What are the main challenges and facilitators for carrying out cross-border CT in 
EU/EEA countries?   

6.1.1 Overview of challenges and facilitators from the perspective of organisation of CT 
and related digital technology 

Countries reported large variations in the number and types of digital CT technology they had used 
during the pandemic. Just over half reported one main CT case management system to register cases 
and their contacts, several reported using different case management systems in different regions and 
two did not report having any digital case management system. Data were usually transmitted from 
regional PHAs to the national public health institute or agency conducting cross-border CT by secure 
email or telephone. 

Due to the enormous COVID-19 case numbers, countries were faced with many challenges that 
required them to adapt and apply strategies rapidly. Table 12 summarises these challenges that were 
encountered at the national level as well as some of the strategies implemented.  

Table 12. Challenges and strategies reported at the national level during the COVID-19 pandemic 
Challenges 
•  Recruiting and retaining sufficient human 

Strategies/Solutions 
• 

resources  

• 

•  Collaboration issues with the general public, 
due to pandemic fatigue, privacy concerns 
and digital illiteracy 
Insufficient digital technology, including case 
management systems being too slow to 
handle the volume of CT data, and difficulties 
with linking databases containing lab and 
vaccination data to cases registered in case 
management systems 

•  Obtaining relevant data for CT was time-

consuming and difficult 

•  Different regions within countries had their 
own policies, CT processes and digital 
technology  

•  Needing to constantly adjust CT processes, 
guidelines and digital technology to the 
evolving pandemic 

Large numbers were recruited and trained to 
the CT workforce from various medical and 
non-medical fields, using various strategies 
such as flexible working hours to retain them 
•  CT policies shifted toward focusing more on 

high-risk cases and their contacts 

•  More flexibility was enabled for citizens by 

shifting more to self-service 

•  Existing digital systems were adjusted and 
upgraded; new systems were developed to 
accommodate the rising numbers, and to 
facilitate data sharing between databases 
containing relevant CT data 

•  Organisations were established to implement 

common strategies or national guidelines to 
be used across the country 
In  terms  of  legislation,  the  overwhelming 
majority  of  the  countries  introduced  new 
law(s)  to  manage  the  scale  of  CT  that  was 
required  during  the  pandemic,  most  of  them 
used  sunset  clauses 
legislative  acts, 
meaning that many are now no longer in place 

for 

• 

58 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

At  the  cross-border  level,  countries  were  also  faced  with  challenges.  These  included  an  additional 
workload, a large part of which was manual; missing information, errors and delays with the CT data 
received  from  other  countries,  as  well  as  from  airlines;  and  different  country  guidelines  on  cross-
border CT, with regard to defining relevant CT concepts, as well as when to continue/discontinue with 
data sharing. Doubts were expressed by several countries as to the added value of cross-border CT 
after the first stages of the pandemic. Tools such as the EWRS, the EUdPLF and national dPLFs were 
generally  appreciated  when  it  came  to  facilitating  cross-border  CT.  However, when  countries  were 
overwhelmed with cases at the national level, cross-border CT was generally deprioritised. Despite the 
general recognition of the value of the EWRS and the EUdPLF, over half of the countries also reported 
using secure email for cross-border CT amongst EU/EEA countries.  

6.1.2 Overview, challenges and facilitators from the perspective of legislation and ethics 

Several countries reported having to update public health and data protection laws, which led to the 
adoption of new laws. Some of the new laws remain in force while others included a sunset clause 
which means that many were in effect only temporarily and are now no longer in effect. In general, 
the laws were adopted to allow the introduction of dPLFs, supporting epidemiological surveillance, as 
well as CT data collection and sharing, clarifying responsibilities, enabling the use of digital CT tools, 
and justifying the restriction of fundamental rights. 

At  EU-level,  Regulation  (EU)  2022/2371  (which  repealed  and  replaced  Decision  No 
1082/2013/EU) provides for a single lawful basis for sharing CT data across borders within the EU/EEA. 
When  sharing  outside  the  EU/EEA  a  more  complex  picture  emerges,  with  many  national  laws 
implementing IHR 2005; however, as this does not indicate a single lawful basis for sharing CT data, it 
may act as barrier due to the legal complexity involved. 

The GDPR provided countries with a common data protection framework for CT, both within 
and outside the EU/EEA, which the countries were generally using appropriately. Overall, countries 
used the same legal bases provided for in Article 6 and 9 for cross-border CT with EU/EEA countries. 
For CT  data going to third countries, most countries relied on Article 49(1)(d) as a tool for transfer 
outside the EU/EEA. This indicates that GDPR was robust despite the wide margin of manoeuvrability 
available to countries, facilitating the free movement of data and legal interoperability.  

Overall, data protection problems relating to cross-border CT seemed to be specific to COVID-
19,  in  particular  its  sudden  onset  and  high  volume  of  data;  as  well  as  the  new  technologies, 
interoperability and data linkage challenges it posed. The study indicated that in the immediate face 
of  the  pandemic,  there  was  a  lack  guidance  from  both  national  data  protection  authorities  and 
European Data Protection Board (EDPB) on the applicability of GDPR to CT, which resulted in an initial 
hesitance to share data. Many countries also required new laws/regulations/guidance to facilitate the 
use of new technologies for CT data sharing, such as new specific laws to accommodate use of dPLF. 
Furthermore, while the study identified several variations in the way in which countries applied the 
principles of GDPR, EWRS was identified as a facilitator to GDPR compliant and compatible data sharing 
for CT.  

From an ethical perspective, a barrier to sharing CT data arises in situations where CT could 
pose a risk to individual fundamental rights and freedoms. This may occur where punitive or criminal 
sanctions for non-adherence to quarantine laws or sexual orientation exist. This can occur both within 
and outside EU/EEA countries. For STIs and diseases transmitted through close contact, such as Mpox, 
several countries prefer the application of a balancing test on a case-by-case basis with an anonymous 
direct contact with the affected person. This highlights the importance of scope at individual MS level 
to make an assessment on whether to share CT data or not in these types of circumstances. Differences 
in national professional codes of practice and ethics may also act as a barrier to cross-border CT data 
sharing. Although most of the countries reported that these codes were adequate during COVID-19, 
the answers of those who applied amendments indicate that facilitating access to and sharing as well 

59 

 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

as  processing  of  sensitive  personal  data  is  a  key  not  just  for  medical  professionals  but  for  non-
healthcare professionals, such as those working in hospitality industry, or border crossings staff. For 
example,  in  some  countries,  staff  working  in  restaurants,  bars  and  other  venues  were  entitled  to 
process  health  information  such  as  the  certificate  of  COVID-19  vaccine,  negative  tests  or  previous 
infection as it was a requirement to enter specific public places. In another country, border-crossing 
staff arranged accommodation for COVID-19 infected foreigners.  

6.2 What (national and subnational) digital tools could be integrated into EWRS, and 
how  could  they  be  integrated  to  allow  a  more  efficient  and  effective  CT  across 
borders? 

EWRS selective exchange module was regarded among major facilitators of cross-border CT as a safe, 
efficient and useful platform. However, during peak times of COVID-19, using selective exchange for 
CT resulted in a labour-intensive and time-consuming process. In terms of development of EWRS to 
allow  more  efficient  and  effective  cross-border  CT,  two  options  are  considered  in  the  current 
regulatory background: adoption of new features and integration of national digital technologies into 
EWRS.  

6.2.1 Regulatory background 

Regulation (EU) 2022/2371 permits the continuous development of EWRS to allow for the use of new 
technologies  such as new digital mobile  apps, artificial intelligence models, or other automated CT 
technologies.  The  ECDC,  in  close  cooperation  with  MS,  will  facilitate  interoperability  with  national 
systems for the purposes of EWRS. 

The understanding of the effects of the  implementation of the Regulation was quite  vague 
across MS and many were unaware of the Regulation or its specifics. Countries hoped the Regulation 
may  change  or  aid  them  in  conducting  cross-border  CT  and  that  it  would  incentivise  or  improve 
digitalisation of CT,  either by new technologies or developments  to or integration of existing ones. 
Some  countries  found  it  hard  to  envision  new  technologies  being  established  as  a  result  of  the 
Regulation yet maintained, that they would consider implementation of a new technology if it were 
deemed useful. 

Countries  indicated  that  a  discussion  on  the  implementation  of  this  legislation  within  MS 

amongst MS could be useful. 

6.2.2 Adoption of new features on EWRS selective exchange  

As laid out briefly in Chapter 2, after the adoption of the new Regulation in November 2022, the EC 
proposed three developments EWRS for structured cross-border CT.  

(1)  Definition of the minimum data required for CT as part of EWRS contact tracing  

Adoption of minimum data requirement was mostly positively perceived by the countries. There was 
a  clear  need  for  EU  alignment  on  definition  of  minimum  required  data  for  CT.  This  could  improve 
quality of data exchange via EWRS in terms of completeness, accuracy, and timeliness, while improving 
efficiency and reducing strain on human resources.  

However, this adoption of minimum data required should not be too restrictive as for some 
infectious diseases, CT can be conducted with only limited information. When not all required data is 
available, some cases might be left behind.  

(2)  Structured cross-border CT data as part of EWRS selective exchange 

Adoption  of  structured  cross-border  CT  as  part  of  EWRS  was  mostly  positively  perceived  by  the 
countries as there was a clear need for it to prevent overload of EWRS by enhancing the information 

60 

 
 
 
 
 
 
 
 
 
  
 
  
Feasibility study on digital technology for cross-border contact tracing 

sharing and streamline data formatting, leading to improved efficiency. Such a platform would also 
meet the wish of countries to have a platform only used for cross-border CT, where selective exchange 
carried out for purposes other than CT (e.g., MEDEVAC) is separated.  
When implementing the above mentioned two additional features, the platform should be applicable 
to a varied range of diseases and not be very restrictive, as different (emerging) diseases have different 
characteristics and data needs.  

(3)  Inclusion of data from dPLFs as part of EWRS selective exchange  

Adoption of methods for the inclusion of data from dPLFs as part of EWRS selective exchange received 
positive comments in a quarter of the responses from the survey and the interviews. This relatively 
low rate was possibly related to the fact that all countries use EWRS, but only a number of them used 
EUdPLF and national dPLFs during COVID-19, to a varying degree. According to the responses, inclusion 
of dPLF data as part of EWRS selective exchange could lead to better coordination of sharing data and 
increase usability. This would be further enhanced if all countries use dPLFs during outbreaks that pose 
a serious cross-border health threat in Europe and the dPLFs are completely integrated.  

6.2.3 Possible integration of different national and subnational digital CT technologies into 
EWRS selective exchange functionality 

Assessment of feasibility 
Integration or linkage of national and subnational digital CT technologies into EWRS has a big potential 
to improve efficiency and effectiveness of cross-border CT. Nevertheless, there are several challenges 
ahead. To assess the feasibility of this integration, our findings are presented based on three of the 
four levels of the EU eHealth interoperability framework(33), namely the legal, organisational (including 
policy), and technical interoperability. The semantic aspect of interoperability is not covered in this 
study as it is already being covered under the EWRS selective exchange module, including definition of 
minimum data requirements.  

(1)  Legal interoperability 

The GDPR provides a common legal basis for data protection in the EU. Our finding shows a fair level 
of unity between countries in relation to application of GDPR for CT. For instance, all eight countries 
that shared which articles they rely on pointed to Article 6(1)(e), which allows for processing of data 
necessary for the performance of a task in the public interest or in the exercise of official authority in 
conjunction  with  Article  9(2)(i)  which  is  the  public  health  basis  for  processing.  Although  additional 
combinations of using Articles 6 and 9 have also been reported, GDPR is robust despite the wide margin 
of  manoeuvrability  available  to  countries.  This  helps  to  facilitate  the  free  movement  of  data  and 
interoperability among EU/EEA countries. However, in addition to the question of lawful basis, GDPR 
has further requirements, for instance in terms of compliance with principles, such as data sharing 
agreements or data protection impact assessment, where there is a wider variance in practice among 
the countries. Accordingly, some level of practical interoperability of legal and regulatory aspects of 
data sharing remains to be addressed. Furthermore, the legal interoperability between the governance 
frameworks  of  EWRS  and  national  CT  tools  is  also  needed.  These  needs  could  be  well  addressed 
through guidance from national data protection agencies and the EDPB.  

(2) Organisational and policy interoperability  

Regular CT is organised at a subnational (local or regional) level in most of the countries included in 
the study. With the exception of smaller countries, subnational authorities are often in charge of how 
they organise  and conduct CT and what  digital technologies they use for it, although guidance  and 
policy often come from national authorities. In most countries, a national EWRS operator in charge of 
cross-border CT does not seem to have direct access to the CT data and therefore they exchange CT 
data with subnational levels (or authorities who carry out CT) such as via secured email, online forms, 

61 

 
 
 
  
 
 
  
 
Feasibility study on digital technology for cross-border contact tracing 

or encrypted servers, which are outside the outbreak response and management systems. Therefore, 
integration of CT technologies  used at subnational level into EWRS would require involvement and 
commitment  of  subnational  authorities  in  several  countries.  This  indicates  low  organisational 
feasibility due to mainly decentralised organisation of CT in most countries. In smaller countries and a 
few countries where CT (technology) is relatively centralised or  in the process of being centralised, 
integration of national systems directly with national authorities can be discussed.  

(3) Technical interoperability  

There is a very large variety of digital outbreak management systems used at national and subnational 
level, most of which are developed within the country for their specific needs. Internationally known 
platforms such as WHO’s Go.Data and SORMAS were only briefly used by some countries or regions in 
the beginning of COVID-19 but often discontinued and replaced by CT systems developed according to 
the (sub)national needs. Having a very large variety of national and subnational outbreak management 
systems used for CT in EU/EEA countries and limited integration of systems within several countries 
significantly limits the feasibility of linking them to EWRS.  

Future approach to integration of (sub)national digital technologies into EWRS selective exchange 
functionality 
Although  the  number  of  countries  with  centralized  outbreak  management  and  case  management 
systems are low and these mostly constitute smaller countries, there are a number of countries who 
are exploring or preparing to develop national digital systems that integrate subnational ones. Based 
on these developments and formation of post-COVID CT systems in the level of countries, as well as 
future technological developments which may facilitate integration of a large variety of different digital 
technologies, it might be possible to revisit the feasibility of integration of national digital technologies 
into EWRS selective exchange functionality in the future.  

For  the  time  being,  an  option  would  be  to  provide  access  to  subnational  actors  for  those 
countries who wish to have this. This can help to improve timeliness and efficiency of cross-border CT, 
in particular for larger countries with a highly decentralised organisation as cross-border CT requires 
flow  of  data  between  several  actors  nationally  and  across  borders  in  these  cases.  Development  of 
EWRS  selective  exchange  in  this  direction  would  enable  sharing  of  cross-border  CT  data  between 
subnational and national actors of different countries and improve coordination across EU-national-
subnational levels. 

6.3. How do countries envision the future of international travel-related CT? 

6.3.1 What are their experiences and views toward using EU dPLFs or national dPLFs 
integrated with ePLF? 

When direct access to passenger data was not an option, using dPLFs (in particular EUdPLF) during 
large outbreaks such as pandemics was often regarded as the next best solution. In addition to the 
four  countries  who  used  EUdPLF  during  COVID-19,  several  countries  were  preparing  to  join  to  the 
EUdPLF,  and  others  indicated  they  would  consider  doing  so  if  legal  barriers  were  removed.  Legal 
challenges specific to EUdPLF highlighted were those related to data storage concerns, as well as need 
for further considerations to amend national laws.  Most  countries considered the national dPLF or 
EUdPLF to increase efficiency and improve data security, accessibility, and quality, but some countries 
expressed concern about this. Moreover, collecting data individually from passengers could be prone 
to  errors  and  burdensome  for  passengers  to  be  done  on  a  routine  basis,  and  required  passenger 
compliance and their access to digital tools. Some countries also questioned the evidence of the value, 
effectiveness and efficiency, as well as the proportionality of use of dPLFs. 

62 

 
 
 
  
  
  
  
 
  
Feasibility study on digital technology for cross-border contact tracing 

Legal aspects of PLFs 
Most  of  the  countries  that  used  dPLFs  have  adopted  new  laws  allowing  the  introduction  of  PLFs, 
mostly subject to sunset clauses and are now no longer in place, meaning that new legislative acts 
would be required for the re-introduction of dPLFs, while others relied on existing legislation. Several 
countries that operated dPLFs carried out data protection measures to ensure compliance with the 
GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, 
storage limitation, security and accountability. A few carried out a DPIA, while others were compliant 
with GDPR though other measures. 

Many respondents pointed out that the collection of travel related data raises challenges to 
find  the  right  balance  between  individual  rights  and  public  interest,  as  well  as  puts  administrative 
burden both on the citizens and on the national authorities. Accordingly, the decision to use dPLFs and 
under what circumstances is an important national competence. 

6.3.2 What are the experiences and views towards using passenger data from airlines? 

Although this was not covered among the initial study questions, the interviews, surveys and webinars 
indicated that obtaining passenger data from airlines was a usual practice among EU/EEA countries 
during  the  COVID-19  pandemic.  Therefore,  this  question  was  added  in  this  conclusion  section  to 
summarise the findings.  

All but one country reported that during the COVID-19 pandemic, passenger data was obtained 
from airlines for CT purposes (based on their national (public health) laws or legislation adopted as 
response to COVID-19). However, these data often came with delays or was sometimes incomplete or 
incorrect. Several countries mentioned that in an ideal situation, passenger data from airlines would 
be directly accessible. Currently, European legislation requires data provided by passengers during the 
process of booking and checking in for a flight to be communicated by the airlines to law enforcement 
and immigration authorities only for security purposes, which does not include public health reasons.  
The survey showed that at present countries relied on national legislation to access airline passenger 
data for CT purposes. 

By comparing airline data sharing practices with usage of dPLFs, we can conclude that those 
countries who did not introduce dPLFs seemed to have relied on data from airlines as their main source 
of passenger data, whereas the others made use of both data sources. In some cases, data from airlines 
helped to complement incomplete dPLFs. 

Legal and practical aspects of obtaining passenger data from airlines  
As  noted  above,  the  GDPR  legal  basis  for  the  re-use  of  passenger  data  requires  such  re-use  to  be 
provided for in national rules, such as in national public health laws, including implementation of IHRs 
(2005). Most countries reported having adopted such rules, with many having sunset clauses which 
mean that they are now no longer in force. On a practical basis, most of the countries replying to the 
survey reported that they obtained passenger data from airlines through the organisation in charge of 
sharing  cross-border  CT  data  through  EWRS,  while  others  through  other  public  administration 
channels. Most countries explained receiving passenger data from airline companies as per request. 
No country reported routinely receiving passenger lists, though there is one country who is working 
towards on an automated system. Data sharing was a mandatory obligation for the airline companies 
in most jurisdictions, whereas only one country specified that they didn’t impose obligation and rely 
on voluntary collaboration.  

6.3.3 What are their views towards linking these tools (EUdPLF and ePLF) with the EWRS? 

The answer to this question is covered as part of “6.2.3 Possible integration of national and subnational 
digital CT technologies into EWRS”. 

63 

 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

6.4 What are countries’ future plans regarding use of different digital  technologies 
for CT and their utilisation for other communicable disease scenarios?  

Countries’ current strategies and future plans regarding the use of digital technologies for CT has been 
posed within various questions in the survey as well as the interviews. As presented in section 4.6.2, 
nine countries indicated having no plans to move to another type of software or platform for CT, eight 
indicated to consider a switch and three indicated they had plans to switch. Some countries indicated 
plans  to  make  national  systems  available  to  integrate  data  from  subnational  systems  or  other  CT 
relevant medical data, such as lab results or vaccination status. Seven countries reported their plans 
to develop generic systems to accommodate CT for multiple ID, as their systems had been too specific 
to COVID-19. However, further details or concrete information were limited in surveys and interviews 
that  were  mainly  held  in  January-February,  possibly  due  to  the  fact  that  the  plans  were  not  yet 
concretized enough to be shared with the EC. 

Further information was sought for countries’ future plans during the second webinar held on 
the  21  April  2023,  based  on  two  groups  of  infectious  disease  scenarios.  These  scenarios  were 
developed based on the data provided by countries regarding diseases where CT is carried out within 
the country and across borders: 1) ID with respiratory transmission, such as Tuberculosis, Measles and 
Meningococcal Meningitis, and 2) STIs and ID that are transmitted through close contact and shared 
environment, such as Mpox.  

The discussions revealed that there are currently no new plans for cross-border digital tools 
for other ID diseases; the EWRS works well enough for them. They would also need to reactivate their 
current national CT digital systems. For diseases such as tuberculosis or meningitis, cross-border CT 
was often not carried out anyway. Making use of proximity-based apps was also not something that 
countries could foresee during other outbreaks of respiratory diseases in the future, due to constraints 
related to legislation, acceptability issues among the general public, and unclarities about the efficacy 
of such apps. Nevertheless, there are plans to digitalise outbreak investigation on contacts and the 
systems  for  the  managements  of  contact  persons,  which  relates  to  the  question  answered  under 
section 6.2.3. 

As  for  Mpox  and  other  STIs,  countries  mentioned  that  cross-border  CT  was  generally  not 
carried out, mainly due to the sensitive nature of these diseases, fears regarding data protection and 
the risk of discrimination for individuals in some countries. CT for STIs is generally handled by STI clinics, 
rather  than  public  health  services,  and  the  need  for  CT  is  decided  on  a  case-by-case  basis,  in 
collaboration with the patient. If the names of contacts are known, either the PHP or patient can notify 
them, or they make use of anonymised notification systems. The use of digital technology at the EU 
level for STIs and diseases transmitted through close contact does not appear to be a prominent option 
at the moment and in the near future. 

6.5 In what areas would EU-level support be valuable to enhance cross-border CT in 
relation to digital technologies? 

EU-level support would be valuable to enhance cross-border CT in a number of areas. 

6.5.1 Potential EU-level action for cross-border CT with particular focus on digital tools 

Developing frameworks and examining the evidence for effectiveness of performing cross-border 
CT: EU-level support is needed to demonstrate the effectiveness of performing cross-border CT, both 
to reduce transmission at the country of origin or destination, and during journey with a collective 
transportation  means.  To  demonstrate  when  cross-border  CT  is  most  effective,  efficient,  and 
proportionate,  an  appropriate  evaluative  framework  should  consider  different  factors  such  as 
transmission  levels  (sporadic  cases,  clusters  of  cases,  and  community  transmission),  burden  on 
passengers and proportionate limitation on individuals’ rights, and competing national priorities when 

64 

 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

the  case  numbers  are  too high.  Such  evidence  can  provide  a  basis for  countries  for  their  decisions 
regarding use of digital tools for cross-border CT, such as dPLFs and EWRS.   

Guidance on when to activate/deactivate cross-border CT in EU/EEA countries: There is a need for 
standardisation  and  guidance  on  when  to  start  and  stop  cross-border  CT.  Nevertheless,  a  balance 
needs to be sought between EU-level coordination and national autonomy when it comes to when to 
activate/deactivate  cross-border  CT.  The  geographic,  economic,  and  social  contexts  of  EU/EEA 
countries  vary  greatly.  Moreover,  during  an  outbreak,  differences  on  epidemiological  status  and 
vaccination  levels  would  also  influence  any  decisions  made.  Therefore,  rather  than  recommending 
starting  or  stopping  cross-border  CT  altogether  in  the  Union,  guidance  can  be  developed  (e.g.,  an 
algorithm or another form) to determine when countries should conduct cross-border CT, with a risk-
based approach tailored to the context and needs of the countries. 

Guidance on standards for (sub)national CT technologies:  As several countries are moving forward 
with developing national or subnational systems for CT for future outbreaks, it would be beneficial to 
including  system  requirements  as  well  as  all  aspects  of 
develop  guidance  on  standards, 
interoperability. Of note, with the planned funding under EU4HEALTH, Member States will be able to 
apply for grants to strengthen their national systems. 

6.5.2 Potential developments for EWRS 

Facilitating making country-specific and up-to-date CT-relevant measures and policies available: To 
decide whether to send outgoing cross-border CT requests to other countries during outbreaks or have 
insight on the incoming requests received, countries wish to be able to see the latest status of CT in 
each country, including whether they act upon incoming CT requests, case and contact definitions, CT 
guidelines,  measures  applied,  and others.  Making  such  information  available  in  common  platforms 
such as the EWRS, while allowing countries to dynamically update them would be appreciated during 
outbreaks. This would support the alignment between countries in cross-border CT (while at the same 
time  retaining  country  autonomy)  on  which  countries  to  send  outgoing  CT  requests  to  during 
outbreaks, the  type  of  data  to  share,  when  to  send this  data,  and  in  the  definitions  of  CT-relevant 
concepts, such as ‘close contacts’. 

Providing subnational actors’ access to EWRS: As stated earlier, providing access to subnational actors 
for  those  countries  who  wish  to  have  can  improve  timeliness  and  efficiency  of  cross-border  CT 
especially  for  large  countries  with  decentralised  organisation.  Development  of  EWRS  selective 
exchange  in  this  direction  would  enable  sharing  of  cross-border  CT  data  between  subnational  and 
national actors of different countries. 

6.5.3 Other potential areas of need 

On legal and ethical aspects in relation to digital technologies 
Support in the implementation of Regulation (EU) 2022/2371 in the context of digital technologies: 
Many countries recognise the importance of the new Regulation in supporting the operations of EWRS, 
in particular the integration of digital technologies. A lack of understanding about how the Regulation 
can assist in this regard could be supported with EU engagement and discussion with MS.  

Guidance  on  how  to  apply  GDPR  to  digital  technology  used  for  national  and  cross-border  CT: 
Countries indicated that there was a lack of guidance on the application of GDPR to cross-border CT 
activities, particularly in the initial throes of COVID-19. Guidance from both national authorities and 
the European Data Protection Board (EDPB) in the context of digital technology is recommended. 

65 

 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Development  of  codes  of  practice:  Specific  CT  codes  of  practice  for  ethical  CT  when  using  digital 
technology  along  with  codes  to  protect  the  privacy  and  fundamental  rights  of  citizens  can  be 
developed. 

Creation of standardised data-sharing templates: Although the GDPR provides the legal basis for CT 
data sharing, the format for doing this is defined at national and local level. To facilitate easier cross-
border CT data sharing, the creation of standardised data sharing templates with the involvement and 
agreement of the EDPB could help to build acceptance of CT data sharing as a GDPR compliant form of 
data processing amongst all players.  

On collaboration across EU/EEA countries 
Exchanging good practices on national and cross-border CT: EU/EEA countries wish to exchange good 
practices on various aspects of national and cross-border CT, including, among others, organisation of 
CT with subnational actors, standards of digital CT technologies, collaboration with airlines, and ethical 
principles in CT for STIs and diseases transmitted through close contact. 

On collaboration beyond EU/EEA countries  
GDPR  compliant  platforms  for  sharing  data  outside  EU/EEA:  Within  the  EU/EEA,  the  EWRS  was 
recognised as a secure, GDPR compliant, and efficient platform for sharing CT data within the EU/EEA. 
Countries  shared  their  wish  to  have  a  similar  centralised  platform  to  exchange  CT  data  with  non-
EU/EEA countries to improve security and efficiency of international CT. 

66 

 
 
 
 
 
 
References 

1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 

9. 

10. 

11. 

12. 

13. 

14. 

15. 

16. 

17. 

18. 

from: 

2022. 

Available 

[updated 

Health  Organization. 

World Health Organization (WHO): Contact tracing in the context of COVID-19. 2021 [Available 
from: https://www.who.int/publications/i/item/contact-tracing-in-the-context-of-covid-19. 
Reichmuth ML, Hodcroft  EB, Riou J, Neher RA, Hens N, Althaus CL. Impact of cross-border-
associated cases on the SARS-CoV-2 epidemic in Switzerland during summer 2020 and 2021. 
Epidemics. 2022;41:100654. 
Markus I, Steffen G, Lachmann R, Marquis A, Schneider T, Tomczyk S, et al. COVID-19: cross-
border contact tracing in Germany, February to April 2020. Euro Surveill. 2021;26(10). 
Zhu  Z,  Weber  E,  Strohsal  T,  Serhan  D.  Sustainable  border  control  policy  in  the  COVID-19 
pandemic: A math modeling study. Travel Med Infect Dis. 2021;41:102044. 
Considerations  for  sharing  information  for  international  contact  tracing  in  the  context  of 
COVID-19. 2021. 
Ruebush E, Fraser MR, Poulin A, Allen M, Lane JT, Blumenstock JS. COVID-19 Case Investigation 
and Contact Tracing: Early Lessons Learned and Future Opportunities. J Public Health Manag 
Pract. 2021;27 Suppl 1, COVID-19 and Public Health: Looking Back, Moving Forward:S87-s97. 
Chowdhury  MJM,  Ferdous  MS,  Biswas  K,  Chowdhury  N,  Muthukkumarasamy  V.  COVID-19 
Contact Tracing: Challenges and Future Directions. IEEE Access. 2020;8:225703-29. 
World 
Go.Data 
https://www.who.int/tools/godata. 
DHIS2.  COVID-19  surveillance,  response  &  vaccine  delivery  toolkit  2020  [Available  from: 
https://dhis2.org/covid-19/. 
SORMAS. The real-time software for outbreak and epidemic surveillance 2022 [Available from: 
https://sormas.org/. 
Helms YB, Stein ML, Hamdiui N, van der Meer A, Baron R, Eilers R, et al. Dutch public health 
professionals'  perspectives  and  needs  regarding  citizen  involvement  in  COVID-19  contact 
tracing through digital support tools: an exploratory qualitative study. BMC Health Serv Res. 
2022;22(1):1378. 
Shahroz M, Ahmad F, Younis MS, Ahmad N, Kamel Boulos MN, Vinuesa R, et al. COVID-19 digital 
contact tracing applications and techniques: A review post initial deployments. Transportation 
Engineering. 2021;5(100072):100072. 
Example 
passenger 
http://www.healthygateways.eu/Portals/0/plcdocs/WHO_PLC.pdf?ver=2020-04-10-170602-
890. 
Tools facilitating travel within the EU during the COVID-19 pandemic - Relevant initiatives with 
impact ranging from success to limited use, (2023). 
European 
https://www.euplf.eu/web/index-2.html. 
The European parliament and the council of the European Union. REGULATION (EU) 2022/2371 
OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 november 2022 on serious cross-
border  threats  to  health  and  repealing  decision  no  1082/2013/EU.  2022    [Available  from: 
https://eur-lex.europa.eu/legal-content/EN/LSU/?uri=CELEX:32021R0821. 
The European parliament and the council of the European Union. DECISION no 1082/2013/EU 
OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 22 october 2013 on serious cross-
border threats to health and repealing decision no 2119/98/EC (text with EEA relevance) 2013 
https://eur-lex.europa.eu/legal-
[Available 
content/EN/TXT/PDF/?uri=CELEX:32013D1082. 
The  European  parliament  and  the  council  of  the  European  Union.  Commission 
Recommendation (EU) 2017/1140 of 23 June 2017 on personal data that may be exchanged 
through the Early Warning and Response System (EWRS) established pursuant to Decision No 
1082/2013/EU  of  the  European  Parliament  and  of  the  Council  for  the  purposes  of  the 
coordination of contact tracing measures in relation to serious cross-border threats to health 

passenger 

[Available 

[Available 

locator 

locator 

(dPLF) 

digital 

from: 

from: 

from: 

form 

form 

of 

a 

 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

(notified  under  document  C(2017)  4197)  (Text  with  EEA  relevance.  )  2017  [Available  from: 
https://eur-lex.europa.eu/eli/reco/2017/1140/oj. 

19.  World Health Organization. International Health Regulations (2005) third edition.  [Available 

20. 

21. 

22. 

23. 

24. 

25. 

in 

EU 

no. 

the 

Data 

2021 

from: 

from: 

19/2023 

[Available 

Comission. 

from: https://www.who.int/publications-detail-redirect/9789241580496. 
protection 
European 
https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_en. 
cep-Centrum für Europäische Politik. EU regulation, serious cross-border threats to health, cep 
https://www.cep.eu/en/eu-
[Available 
PolicyBrief 
topics/details/cep/serious-cross-border-threats-to-health-ceppolicybrief-com2020-727.html. 
Jespers  V  CJ,  De  laet  CD,  et  al.  International  comparison  of  COVID-19  testing  and  contact 
tracing strategies. 2020. 
European  Observatory  on  Health  Systems  and  Policies.  COVID-19  health  system  response 
monitor 
from: 
https://eurohealthobservatory.who.int/monitors/hsrm/hsrm-
countries/hsrm/denmark/preventing-transmission/monitoring-and-surveillance/. 
European  Observatory  on  Health  S,  Policies.  Effective  contact  tracing  and  the  role  of  apps: 
lessons from Europe. Eurohealth. 2020;26(2):40-4. 
Valencia C, Jaramillo-Gutierrez G, Rearte A, Rosin P, Gassino F, Morreale SE, et al. Adoption of 
digital  tools  in  the  context  of  the  COVID-19  pandemic  in  the  Region  of  the  Americas  -  the 
Go.Data experience. The Lancet Regional Health - Americas. 2022;16:100377. 

[Available 

(HSRM) 

27. 

29. 

28. 

26.  Montanari  Vergallo  G,  Zaami  S,  Marinelli  E.  The  COVID-19  pandemic  and  contact  tracing 
technologies,  between upholding the  right  to health and personal data protection. Eur Rev 
Med Pharmacol Sci. 2021;25(5):2449-56. 
Hatamian M, Wairimu S, Momen N, Fritsch L. A privacy and security analysis of early-deployed 
COVID-19 contact tracing Android apps. Empir Softw Eng. 2021;26(3):36. 
Pagliari C. The ethics and value of contact tracing apps: International insights and implications 
for Scotland's COVID-19 response. J Glob Health. 2020;10(2):020103. 
The European parliament and the council of the European Union. Regulation (EU) 2016/679 of 
the  European  Parliament  and  of  the  Council  of  27  April  2016  on  the  protection  of  natural 
persons with regard to the processing of personal data and on the free movement of such data, 
and  repealing  Directive  95/46/EC  (General  Data  Protection  Regulation)  [Available  from: 
https://eur-lex.europa.eu/eli/reg/2016/679/oj. 
European Data Protection Board. Guidelines 04/2020 on the use of location data and contact 
from: 
in  the  context  of  the  COVID-19  outbreak  2020 
tracing 
https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_20200420_contact_tr
acing_covid_with_annex_en.pdf. 
Court of Justice of the European Union. Judgment of the Court in Case C-817/19 2022 [updated 
from:  https://curia.europa.eu/jcms/upload/docs/application/pdf/2022-
2022.  Available 
06/cp220105en.pdf. 
DIRECTIVE (EU) 2016/681 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 
2016  on  the  use  of  passenger  name  record  (PNR)  data  for  the  prevention,  detection, 
investigation and prosecution of terrorist offences and serious crime, (2016). 
European  Commission  Directorate-General 
Interoperability Framework : overall executive summary: Publications Office; 2013. 

Information.  eHealth  European 

[Available 

for  the 

tools 

32. 

33. 

30. 

31. 

68 

 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Appendix A: 
border contact tracing 

 Proposed  developments  for  structured  cross-

Information notes as of February 2023 

Proposed developments for structured cross-border contact tracing: 
After the adoption of the new Regulation in November 2022, the EC proposes to review the variables 
that can be exchanged for cross-border contact tracing, replacing the Commission Recommendation 
2017/1140.  

EWRS new architecture will support that the selective exchange for contact tracing will become an 
independent module, which will provide the ability to separate data access to specific users. 
The  contact  tracing officers  will  be  nominated  by the  Member  States  Authorities,  thus  limiting  the 
exposure of the sensitive data.   

A dedicated user for “Contact Tracing” can utilise Selective Exchange function to send contacts or to 
receive  information  by/from  other  countries.  EWRS  user  will  receive  this  list  attached  to  a  secure 
Selective  Exchange  message,  which  imports  the  contacts  in  the  database,  having  first  checked  for 
possible duplicates. The system will raise a flag in such case. For the Contact Tracing selective exchange 
messages, the system will allow sharing with multiple recipient countries and limits actual access only 
to those involved.  The Contact Tracing functionality will consist of the Selective Exchange messaging 
mechanism,  the  automated  import  functionality  and  three  supporting  tables.  These  tables  are 
“Received”, “Sent” and “Archived” list of contacts. “Received and “Sent tables are completed by an 
“Actions” mechanism for bulk and individual management of contacts. The actions supported will be 
Update Contact Status and Comment, Add and Remove recipient and Update Contact Comment. The 
designated Contact Tracing user may add manually a contact and also edit the contacts.  

At an individual’s contact page, the user can see the history of the contact status. EWRS automatically 
deletes the contact tracing personal information after a specific retention period, or when the contact 
reaches a specific status (e.g., archived). The remaining non sensitive contact information is moved 
into a separate list for statistical purposes. Furthermore, the dedicated user for contact tracing can 
visualise,  comment,  and  change  the  statuses  of  the  received  contacts,  thus  allowing  for  optimised 
contact management and administration activities accomplishment, the variables that will be collected 
are listed in the Appendix.  

Current state of the EWRS selective exchange functionality for contact tracing: 
EWRS  guarantee  protection  of  personal  data.  A  security  posture  strengthened  through  relevant 
procedures and redefined periodically through security audits and data protection assessment. At the 
time of writing, CT messages can be exchanged as described above (the complete functionality is in 
User Acceptance Testing/UAT phase, ready to be launched for UAT testing from the Member States). 
In addition, the EWRS managers are considering the integration of EU PLF exchange platform (ePLF) to 
EWRS selective  exchange. The  ePLF  platform can  support the exchange of traveller contact  tracing 
data,  collected  by  the  National  passenger  locator  forms  (NPLF),  including  those  countries  that  are 
linked  with the  EU  digital Passenger  Locator  forms EUdPLF.  The  ePLF  integration  into  EWRS  would 
allow that EWRS will receive contacts information from the ePLF system and displays it to the recipient 
country/countries at EWRS selective exchange functionality. 

DG SANTE with support of the ECDC EWRS team has procured a new study (“Assessment of the needs 
to ensure the alignment of Early Warning and Response System with the Regulation on serious cross-

69 

 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

border threats to health”iii) that will lay the ground for further development and the use for fit-for-
purpose emerging technologies. 

Contact Tracing import template fields 
As mentioned earlier, the EWRS will accept an Excel list and automatically place information into the 
database. The figure and table below show the fields that are available for a contact. Note that the 
variables and grouping of fields might change depending on the feedback received from MS after UAT. 

Figure 3. Contact Tracing import file example 

Table 13. Contact Tracing fields  

Contact Details Screen 

Contact Details - Mandatory 

Contact ID  

Source 

Reporting Country 

Reporting Date 

First name 

Last name / Family name 

Current City 

Current Region / County / State 

Current Postal Code 

Telephone number 

Email address 

Agent 

Disease 

Index_Case_ID 

Close contact  

Recipient Country  

Transport Type 

Ship name / Flight number 

Seat/Cabin number contact 

Field Type 

Autogenerated 

Autogenerated 

Autogenerated 

Autogenerated 

Free Text 

Free Text 

Free Text 

Free Text 

alpha numerical 

Numerical  

Free Text  

Dropdown list  

Dropdown list  

alpha numerical 

Dropdown list  

Dropdown list  

Dropdown list  

alpha numerical 

alpha numerical 

iii Assessment of the needs to ensure alignment of the Early Warning and Response System with the Regulation on serious 
cross-border threats to health study, BEACON-000075 contract, under DIGIT/2020/OP/0005 – BEACON Lot 2. 

70 

 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Date of travel 

Origin location 

Destination location 

Last destination  

Nationality 

Date of birth 

Sex 

Document Identifier Type 

Issuing Authority  

Person or document identifier 

Current address 

Additional address 

Country of Residence 

Residential address 

Other means of contact 

Emergency Contact Details 

Accompanying_Person_ID 

Date last exposure  

Successfully informed  

Case pseudo id 

Case date symptom onset 

Time of Departure 

Country of Departure 

Country of Arrival 

Comment 

Persons/Place of Visit 

Visit date 

Visit Addresses 

Visit Telephone 

Date Picker  

Free text  

Free text  

Free text  

Dropdown list  

Date Picker  

Dropdown list  

Dropdown list  

Dropdown list  

alpha numerical 

Free Text 

Free Text 

Dropdown list  

Text 

alpha numerical 

alpha numerical 

Autogenerated 

Date Picker  

Dropdown list  

Numerical 

Date Picker  

Time Picker 

Dropdown list  

Dropdown list  

Free text  

Free text  

Date Picker  

Free text  

Numerical  

Contact details 

Case details 

Travel details 

Visiting details 

71 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Appendix B: 

List of references in legal sections 

Legal references of: 

International Health Regulations 

1. 
2.  Regulation (EU) 2022/2371 on serious cross-border threats to health  
3.  Decision No 1082/2013/EU on serious cross-border threats to health (NO LONGER IN FORCE) 
4.  Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing 

of personal data and on the free movement of such data (GDPR) 

1. International Health Regulations (2005) 

Retrieved from: www.who.int/publications/i/item/9789241580496 

The following article referenced in the report: 

PART V – PUBLIC HEALTH MEASURES  
Chapter I – General provisions  
Article 23 Health measures on arrival and departure  

1. Subject to applicable international agreements and relevant articles of these Regulations, a State 
Party may require for public health purposes, on arrival or departure:  
(a) with regard to travellers:  

(i) information concerning the traveller’s destination so that the traveller may be contacted; 
(ii) information concerning the traveller’s itinerary to ascertain if there was any travel in or 
near  an  affected  area  or  other  possible  contacts  with  infection  or  contamination  prior  to 
arrival, as well as review of the traveller’s health documents if they are required under these 
Regulations; and/or  
(iii) a non-invasive medical examination which is the least intrusive examination that would 
achieve the public health objective;  

(b) inspection of baggage, cargo, containers, conveyances, goods, postal parcels and human remains. 

2. Regulation (EU) 2022/2371 of the European Parliament and of the Council of 
23 November 2022 on serious cross-border threats to health and repealing Decision 
No 1082/2013/EU  

Retrieved from: www.eur-lex.europa.eu/eli/reg/2022/2371/oj 

The following articles are referenced in the report: 

Article 18 
Early Warning and Response System 

1.  The EWRS shall enable the Commission, the ECDC, and the competent authorities responsible 
at national level to be in permanent communication for the purposes of preparedness, early 
warning and response, alert notifications, assessing public health risks and determining the 
measures that may be required to protect public health. 

2.  The management and operational use of the EWRS shall involve the exchange of personal data 
in specific cases where the relevant legal instruments so provide. Such management and use 
shall include: 
(a)  the processing of personal data of authorised users of the system; and 

72 

 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

(b)  the  processing  of  health  data  and  other  personal  data  when  strictly  necessary  for  the 
purpose for which those data were transmitted, through the EWRS selective messaging 
functionality, in accordance with Article 28. 

Taking into account Member States’ opinions, the ECDC shall continuously update the EWRS, 
allowing  for  the  use  of  modern  technologies  such  as  digital  mobile  applications,  artificial 
intelligence models, space-enabled applications, or other technologies for automated contact 
tracing, building upon the contact-tracing technologies developed by the Member States or by 
the Union and used for the purpose of combatting serious cross-border threats to health. The 
ECDC, in close cooperation with Member States, shall facilitate interoperability with national 
systems for the purposes of the EWRS. 
The ECDC shall also provide technical assistance to the competent authorities responsible at 
national level, including training following updates to the EWRS. 

3.  Each  Member  State  shall  designate  the  competent  authority  or  authorities  responsible  at 
national  level  for  notifying  alerts  and  determining  the  measures  required  to  protect  public 
health, for the purposes of early warning and response in accordance with paragraphs 1 and 2 
of this Article, as well as Articles 19 and 20. 

4.  The  Commission  shall,  by  means  of  implementing  acts,  adopt  procedures  concerning  the 
information  exchange  with  other  rapid  alert  systems  at  Union  and  international  levels, 
including exchange of personal data, in order to ensure the proper functioning of the EWRS 
and to avoid the overlapping of activities or conflicting actions with existing structures  and 
mechanisms for preparedness for, monitoring, early warning of and combatting serious cross-
border threats to health, in a coordinated One Health approach. 
Those  implementing  acts  shall  be  adopted  in  accordance  with  the  examination  procedure 
referred to in Article 29(2). 

Article 19 
Alert notification 

1.  National competent authorities or the Commission shall notify an alert in the EWRS, where 

the emergence or development of a serious cross-border threat to health fulfils the following 
criteria: 
(a)  it is unusual or unexpected for the given place and time, it is causing or may cause 

significant morbidity or mortality in humans, it is growing rapidly or may grow rapidly in 
scale, or it is exceeding or may exceed national response capacity; 

(b)  it affects or may affect more than one Member State; and 
(c)  it requires or may require a coordinated response at Union level. 

2.  Where the national competent authorities notify the WHO of events that may constitute 

public health emergencies of international concern, and in the absence of full 
interoperability between the WHO notification system and the EWRS, national competent 
authorities shall simultaneously notify an alert in the EWRS, provided that the threat 
concerned falls within those referred to in Article 2(1) of this Regulation. 

3.  When notifying an alert, the national competent authorities and the Commission shall 
promptly communicate through the EWRS any available relevant information in their 
possession that may be useful for coordinating the response such as: 
(a)  the type and origin of the agent; 
(b)  the date and place of the incident or outbreak; 
(c)  means of transmission or dissemination; 
(d)  toxicological data; 
(e)  detection and confirmation methods; 
(f)  public health risks; 
(g)  public health measures implemented or intended to be taken at national level; 
(h)  measures other than public health measures, including multi-sectoral measures; 

73 

 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

(i)  whether there is an urgent need for or shortage of medical countermeasures; 
(j)  requests and offers for cross-border emergency assistance, such as the medical transfer 
of patients or provision of healthcare staff by one Member State to another, in particular 
in cross-border areas in neighbouring regions; 

(k)  personal data necessary for the purpose of contact tracing in accordance with Article 28; 
(l)  any other information relevant to the serious cross-border threat to health in question. 

4.  The Commission shall make available to the national competent authorities through the 
EWRS any information that may be useful for coordinating the response referred to in 
Article 21, including information relating to serious cross-border threats to health and public 
health measures related to serious cross-border threats to health, already transmitted 
through rapid alert and information systems established under other provisions of Union law 
or the Euratom Treaty. 

5.  Member States shall update the information referred to in paragraph 3 as new data become 

available. 

Article 28 
Protection of personal data concerning the EWRS selective messaging functionality 

1.  The EWRS shall include a selective messaging functionality allowing personal data, including 
contact and health data, to be communicated only to the national competent authorities 
involved in contact-tracing measures and medical evacuation procedures. That selective 
messaging functionality shall be designed and operated so as to ensure safe and lawful 
processing of personal data and to link with contact-tracing systems at Union level. 

2.  Where national competent authorities implementing contact-tracing measures or medical 
evacuation procedures communicate, through the EWRS, personal data necessary for 
contact-tracing purposes pursuant to Article 19(3), they shall use the selective messaging 
functionality referred to in paragraph 1 of this Article and communicate the data only to the 
other Member States involved in the contact-tracing or medical evacuation measures. 

3.  When communicating the data referred to in paragraph 2, the national competent 
authorities shall refer to the alert communicated previously through the EWRS. 

4.  The selective message functionality shall be used solely for the purpose of contact tracing 
and medical evacuation. It shall only allow national competent authorities to receive data 
that were sent to them by other national competent authorities. The ECDC shall only access 
the data required to ensure the proper functioning of the selective message functionality. 
Messages containing personal data shall automatically be erased from the selective message 
functionality 14 days after the date of their posting at the latest. 

5.  Where necessary for the purpose of contact tracing, personal data may also be exchanged 
using contact-tracing technologies. The national competent authorities shall not retain the 
contact data and health data received through the selective message functionality for longer 
than the retention period applicable in the context of their national contact-tracing activities. 
6.  The Commission shall adopt delegated acts in accordance with Article 31 to supplement this 

Regulation by establishing: 
(a)  detailed requirements necessary to ensure that the operation of the EWRS and the 
processing of data complies with Regulation (EU) 2016/679 and Regulation (EU) 
2018/1725, including the respective responsibilities of the national competent 
authorities and of the ECDC; and 

(b)  a list of the categories of personal data that may be exchanged for the purpose of the 

coordination of contact-tracing measures. 

7.  The Commission shall, by means of implementing acts, adopt: 

(a)  procedures for the interlinking of the EWRS with contact-tracing systems at Union and 

international levels; and 

74 

 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

(b)  the modalities for processing contact-tracing technologies and their interoperability, as 
well as the cases where, and the conditions under which, the third countries may be 
granted access to contact-tracing interoperability and the practical arrangements for 
such access, in full compliance with Regulation (EU) 2016/679and the applicable case law 
of the Court of Justice of the European Union. 

Those  implementing  acts  shall  be  adopted  in  accordance  with  the  examination  procedure 
referred to in Article 29(2). 

3. Decision No 1082/2013/EU of the European Parliament and of the Council of 22 October 
2013 on serious cross-border threats to health and repealing Decision No 2119/98/EC (NO 
LONGER IN FORCE) 

Retrieved from: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32013D1082 

The following articles are referenced in the report: 

Article 9 (NO LONGER IN FORCE) 
Alert notification 

1.  National competent authorities or the Commission shall notify an alert in the EWRS where the 
emergence  or  development  of  a  serious  cross-border  threat  to  health  fulfils  the  following 
criteria: 
(a)  it  is  unusual  or  unexpected  for  the  given  place  and  time,  or  it  causes  or  may  cause 
significant morbidity or mortality in humans, or it grows rapidly or may grow rapidly in 
scale, or it exceeds or may exceed national response capacity; and 

(b)  it affects or may affect more than one Member State; and 
(c)  it requires or may require a coordinated response at Union level. 

2.  Where  the  national  competent  authorities  notify  the  WHO  of  events  that  may  constitute 
public health emergencies of international concern in accordance with Article 6 of the IHR, 
they shall at the latest simultaneously notify an alert in the EWRS, provided that the threat 
concerned falls within those referred to in Article 2(1) of this Decision. 

3.  When  notifying  an  alert,  the  national  competent  authorities  and  the  Commission  shall 
promptly  communicate  through  the  EWRS  any  available  relevant  information  in  their 
possession that may be useful for coordinating the response such as: 
(a)  the type and origin of the agent; 
(b)  the date and place of the incident or outbreak; 
(c)  means of transmission or dissemination; 
(d)  toxicological data; 
(e)  detection and confirmation methods; 
(f)  public health risks; 
(g)  public health measures implemented or intended to be taken at national level; 
(h)  measures other than public health measures; 
(i)  personal data necessary for the purpose of contact tracing in accordance with Article 16; 
(j)  any other information relevant to the serious cross-border threat to health in question. 
4.  The Commission shall make available to the national competent authorities through the EWRS 
any information that may be  useful for coordinating the response  referred to in Article 11, 
including  information  related  to  serious  cross-border  threats  to  health  and  public  health 
measures related to serious cross-border threats to health transmitted through rapid alert and 
information systems established under other provisions of Union law or the Euratom Treaty. 

75 

 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Article 16 (NO LONGER IN FORCE) 
Protection of personal data 

1. 

In  the  application  of  this  Decision,  personal  data  shall  be  processed  in  accordance  with 
Directive 95/46/EC and Regulation (EC) No 45/2001. In particular, appropriate technical and 
organisational  measures  shall  be  taken  to  protect  such  personal  data  against  accidental  or 
illegal  destruction,  accidental  loss,  or  unauthorised  access  and  against  any  form  of  illegal 
processing. 

2.  The  EWRS  shall  include  a  selective  messaging  functionality  allowing  personal  data  to  be 
communicated only to national competent authorities involved in contact tracing measures. 
That selective messaging functionality shall be designed and operated so as to ensure safe and 
lawful exchange of personal data. 

3.  Where competent authorities implementing contact tracing measures communicate personal 
data necessary for contact tracing purposes through the EWRS pursuant to Article 9(3), they 
shall use the selective messaging functionality referred to in paragraph 2 of this Article and 
communicate  the  data  only  to  the  other  Member  States  involved  in  the  contact  tracing 
measures. 

4.  When circulating the information referred to in paragraph 3, the competent authorities shall 

refer to the alert communicated previously through the EWRS. 

5.  Messages containing personal data shall automatically be erased from the selective message 

functionality 12 months after the date of their posting. 

6.  Where  a  competent  authority  establishes  that  notification  of  personal  data  made  by  it 
pursuant to Article 9(3) has subsequently proved to be in breach of Directive 95/46/EC because 
that notification was unnecessary for the implementation of the contact tracing measures at 
issue,  it  shall  inform  immediately  the  Member  States  to  which  that  notification  was 
transmitted. 
In relation to their responsibilities to notify and rectify personal data through the EWRS, the 
national competent authorities shall be regarded as controllers within the meaning of point 
(d) of Article 2 of Directive 95/46/EC. 
In relation to its responsibilities concerning storage of personal data, the Commission shall be 
regarded  as  a  controller  within  the  meaning  of  point  (d)  of  Article 2  of  Regulation  (EC)  No 
45/2001. 

8. 

7. 

9.  The Commission shall adopt: 

(a)  guidelines aimed at ensuring that the day-by-day operation of the EWRS complies with 

Directive 95/46/EC and Regulation (EC) No 45/2001; 

(b)  a recommendation providing an indicative list of the personal data that may be exchanged 

for the purpose of the coordination of contact tracing measures. 

4. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 
2016 on the protection of natural persons with regard to the processing of personal data 
and on the free movement of such data, and repealing Directive 95/46/EC (General Data 
Protection Regulation) 

Retrieved from: https://eur-lex.europa.eu/eli/reg/2016/679/oj 

The following articles are referenced in the report: 

Article 5 
Principles relating to processing of personal data 

1.  Personal data shall be: 

76 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

(a)  processed  lawfully,  fairly  and  in  a  transparent  manner  in  relation  to  the  data  subject 

(‘lawfulness, fairness and transparency’); 

(b)  collected  for  specified,  explicit  and  legitimate  purposes  and  not  further  processed  in  a 
manner  that  is  incompatible  with  those  purposes;  further  processing  for  archiving 
purposes  in  the  public  interest,  scientific  or  historical  research  purposes  or  statistical 
purposes shall, in accordance with Article 89(1), not be considered to be incompatible with 
the initial purposes (‘purpose limitation’); 

(c)  adequate, relevant and limited to what is necessary in relation to the purposes for which 

they are processed (‘data minimisation’); 

(d)  accurate and, where necessary, kept up to date; every reasonable step must be taken to 
ensure that personal data that are inaccurate, having regard to the purposes for which 
they are processed, are erased or rectified without delay (‘accuracy’); 

(e)  kept in a form which permits identification of data subjects for no longer than is necessary 
for the purposes for which the personal data are processed; personal data may be stored 
for  longer  periods  insofar  as  the  personal  data  will  be  processed  solely  for  archiving 
purposes  in  the  public  interest,  scientific  or  historical  research  purposes  or  statistical 
purposes in accordance with Article 89(1) subject to implementation of the appropriate 
technical and organisational measures required by this Regulation in order to safeguard 
the rights and freedoms of the data subject (‘storage limitation’); 

(f)  processed in a manner that ensures appropriate security of the personal data, including 
protection  against  unauthorised  or  unlawful  processing  and  against  accidental  loss, 
destruction or damage, using appropriate technical or organisational measures (‘integrity 
and confidentiality’). 

2.  The  controller  shall  be  responsible  for,  and  be  able  to  demonstrate  compliance  with, 

paragraph 1 (‘accountability’). 

Article 6 
Lawfulness of processing 

1.  Processing shall be lawful only if and to the extent that at least one of the following applies: 

(a)  the data subject has given consent to the processing of his or her personal data for one or 

more specific purposes; 

(b)  processing is necessary for the performance of a contract to which the data subject is party 
or in order to take steps at the request of the data subject prior to entering into a contract; 
(c)  processing is necessary for compliance with a legal obligation to which the controller is 

subject; 

(d)  processing  is  necessary  in  order  to  protect  the  vital  interests  of  the  data  subject  or  of 

another natural person; 

(e)  processing is necessary for the performance of a task carried out in the public interest or 

in the exercise of official authority vested in the controller; 

(f)  processing  is  necessary  for  the  purposes  of  the  legitimate  interests  pursued  by  the 
controller or by a third party, except where such interests are overridden by the interests 
or  fundamental  rights  and  freedoms  of  the  data  subject  which  require  protection  of 
personal data, in particular where the data subject is a child. 

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the 
performance of their tasks. 

2.  Member States may maintain or introduce more specific provisions to adapt the application 
of the rules of this Regulation with regard to processing for compliance with points (c) and (e) 
of paragraph 1 by determining more precisely specific requirements for the processing and 
other measures  to  ensure lawful  and  fair  processing including  for other  specific  processing 
situations as provided for in Chapter IX. 

77 

 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

3.  The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down 

by: 
(a)  Union law; or 
(b)  Member State law to which the controller is subject. 
The  purpose  of  the  processing  shall  be  determined  in  that  legal  basis  or,  as  regards  the 
processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a 
task  carried  out  in  the  public  interest  or  in  the  exercise  of  official  authority  vested  in  the 
controller. That legal basis may contain specific provisions to adapt the application of rules of 
this Regulation, inter alia: the general conditions governing the lawfulness of processing by the 
controller; the types of data which are subject to the processing; the data subjects concerned; 
the entities to, and the purposes for which, the personal data may be disclosed; the purpose 
limitation; storage periods; and processing operations and processing procedures, including 
measures  to  ensure  lawful  and  fair  processing  such  as  those  for  other  specific  processing 
situations as provided  for in Chapter IX. The  Union or the Member State  law shall meet an 
objective of public interest and be proportionate to the legitimate aim pursued. 

4.  Where the processing for a purpose other than that for which the personal data have been 
collected is not based on the data subject's consent or on a Union or Member State law which 
constitutes a necessary and proportionate measure in a democratic society to safeguard the 
objectives  referred  to  in  Article  23(1),  the  controller  shall,  in  order  to  ascertain  whether 
processing for another purpose is compatible with the purpose for which the personal data 
are initially collected, take into account, inter alia: 
(a)  any link between the purposes for which the personal data have been collected and the 

purposes of the intended further processing; 

(b)  the context in which the personal data have been collected, in particular regarding the 

relationship between data subjects and the controller; 

(c)  the nature of the personal data, in particular whether special categories of personal data 
are  processed,  pursuant  to  Article  9,  or  whether  personal  data  related  to  criminal 
convictions and offences are processed, pursuant to Article 10; 

(d)  the possible consequences of the intended further processing for data subjects; 
(e)  the  existence  of  appropriate  safeguards,  which  may 

include  encryption  or 

pseudonymisation. 

Article 9 
Processing of special categories of personal data 

1.  Processing  of  personal  data  revealing  racial  or  ethnic  origin,  political  opinions,  religious  or 
philosophical  beliefs,  or  trade  union  membership,  and  the  processing  of  genetic  data, 
biometric data for the purpose of uniquely identifying a natural person, data concerning health 
or data concerning a natural person's sex life or sexual orientation shall be prohibited. 

2.  Paragraph 1 shall not apply if one of the following applies: 

(a)  the data subject has given explicit consent to the processing of those personal data for one 
or more specified purposes, except where Union or Member State law provide that the 
prohibition referred to in paragraph 1 may not be lifted by the data subject; 

(b)  processing  is  necessary  for  the  purposes  of  carrying  out  the  obligations  and  exercising 
specific rights of the controller or of the data subject in the field of employment and social 
security and social protection law in so far as it is authorised by Union or Member State 
law or a collective  agreement pursuant  to Member State  law providing for appropriate 
safeguards for the fundamental rights and the interests of the data subject; 

(c)  processing  is  necessary  to  protect  the  vital  interests  of  the  data  subject  or  of  another 
natural person where the data subject is physically or legally incapable of giving consent; 
(d)  processing  is  carried  out  in  the  course  of  its  legitimate  activities  with  appropriate 
safeguards by a foundation, association or any other not-for-profit body with a political, 

78 

 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

philosophical, religious or trade union aim and on condition that the processing relates 
solely to the members or to former members of the body or to persons who have regular 
contact with it in connection with its purposes and that the personal data are not disclosed 
outside that body without the consent of the data subjects; 

(e)  processing relates to personal data which are manifestly made public by the data subject; 
(f)  processing  is  necessary  for  the  establishment,  exercise  or  defence  of  legal  claims  or 

whenever courts are acting in their judicial capacity; 

(g)  processing is necessary for reasons of substantial public interest, on the basis of Union or 
Member State law which shall be proportionate to the aim pursued, respect the essence 
of the right to data protection and provide for suitable and specific measures to safeguard 
the fundamental rights and the interests of the data subject; 

(h)  processing is necessary for the purposes of preventive or occupational medicine, for the 
assessment of the working capacity of the employee, medical diagnosis, the provision of 
health or social care or treatment or the management of health or social care systems and 
services on the basis of Union or Member State law or pursuant to contract with a health 
professional and subject to the conditions and safeguards referred to in paragraph 3; 
(i)  processing is necessary for reasons of public interest in the area of public health, such as 
protecting  against  serious  cross-border  threats  to  health  or  ensuring  high  standards  of 
quality and safety of health care and of medicinal products or medical devices, on the basis 
of  Union  or  Member State  law  which  provides  for  suitable  and  specific  measures  to 
safeguard the rights and freedoms of the data subject, in particular professional secrecy; 
(j)  processing is necessary for archiving purposes in the public interest, scientific or historical 
research purposes or statistical purposes in accordance with Article 89(1) based on Union 
or Member State law which shall be proportionate to the aim pursued, respect the essence 
of the right to data protection and provide for suitable and specific measures to safeguard 
the fundamental rights and the interests of the data subject. 

3.  Personal data  referred to in paragraph 1 may be  processed for the  purposes  referred to in 
point (h) of paragraph 2 when those  data are  processed by or under the  responsibility of a 
professional subject to the obligation of professional secrecy under Union or Member State 
law or rules established by national competent bodies or by another person also subject to an 
obligation  of  secrecy  under  Union  or  Member State  law  or  rules  established  by  national 
competent bodies. 

4.  Member  States  may  maintain  or  introduce  further  conditions,  including  limitations,  with 

regard to the processing of genetic data, biometric data or data concerning health. 

Article 46 
Transfers subject to appropriate safeguards 

1. 

In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer 
personal  data  to  a  third  country  or  an  international  organisation  only  if  the  controller  or 
processor  has  provided  appropriate  safeguards,  and  on  condition  that  enforceable  data 
subject rights and effective legal remedies for data subjects are available. 

2.  The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring 

any specific authorisation from a supervisory authority, by: 
(a)  a legally binding and enforceable instrument between public authorities or bodies; 
(b)  binding corporate rules in accordance with Article 47; 
(c)  standard  data  protection  clauses  adopted  by  the  Commission  in  accordance  with  the 

examination procedure referred to in Article 93(2); 

(d)  standard data protection clauses adopted by a supervisory authority and approved by the 

Commission pursuant to the examination procedure referred to in Article 93(2); 

79 

 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

(e)  an approved code of conduct pursuant to Article 40 together with binding and enforceable 
commitments of the controller or processor in the third country to apply the appropriate 
safeguards, including as regards data subjects' rights; or 

(f)  an  approved  certification  mechanism  pursuant  to  Article 42  together  with  binding  and 
enforceable commitments of the controller or processor in the third country to apply the 
appropriate safeguards, including as regards data subjects' rights. 

3.  Subject  to  the  authorisation  from  the  competent  supervisory  authority,  the  appropriate 

safeguards referred to in paragraph 1 may also be provided for, in particular, by: 
(a)  contractual clauses between the controller or processor and the controller, processor or 
the recipient of the personal data in the third country or international organisation; or 
(b)  provisions to be inserted into administrative arrangements between public authorities or 

bodies which include enforceable and effective data subject rights. 

4.  The supervisory authority shall apply the consistency mechanism referred to in Article 63 in 

the cases referred to in paragraph 3 of this Article. 

5.  Authorisations  by  a  Member  State  or  supervisory  authority  on  the  basis  of  Article 26(2)  of 
Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by 
that supervisory authority. Decisions adopted by the Commission on the basis of Article 26(4) 
of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, 
by a Commission Decision adopted in accordance with paragraph 2 of this Article. 

Article 49 
Derogations for specific situations 

1. 

In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards 
pursuant  to  Article 46,  including  binding  corporate  rules,  a  transfer  or  a  set of  transfers  of 
personal data to a third country or an international organisation shall take place only on one 
of the following conditions: 
(a)  the  data  subject  has  explicitly  consented  to  the  proposed  transfer,  after  having  been 
informed of the possible risks of such transfers for the data subject due to the absence of 
an adequacy decision and appropriate safeguards; 

(b)  the transfer is necessary for the performance of a contract between the data subject and 
the  controller  or  the  implementation  of  pre-contractual  measures  taken  at  the  data 
subject's request; 

(c)  the transfer is necessary for the conclusion or performance of a contract concluded in the 
interest of the data subject between the controller and another natural or legal person; 

(d)  the transfer is necessary for important reasons of public interest; 
(e)  the transfer is necessary for the establishment, exercise or defence of legal claims; 
(f)  the transfer is necessary in order to protect the vital interests of the data subject or of 
other persons, where the data subject is physically or legally incapable of giving consent; 
(g)  the  transfer  is made  from a  register  which  according  to  Union  or  Member  State  law  is 
intended to provide information to the public and which is open to consultation either by 
the public in general or by any person who can demonstrate a legitimate interest, but only 
to the extent that the conditions laid down by Union or Member State law for consultation 
are fulfilled in the particular case. 

Where a transfer could not be based on a provision in Article 45 or 46, including the provisions 
on binding corporate rules, and none of the derogations for a specific situation referred to in 
the  first  subparagraph  of  this  paragraph  is  applicable,  a  transfer  to  a  third  country  or  an 
international organisation may take place only if the transfer is not repetitive, concerns only a 
limited  number  of  data  subjects,  is  necessary  for  the  purposes  of  compelling  legitimate 
interests pursued by the controller which  are not overridden by the interests or rights  and 
freedoms  of  the  data  subject,  and  the  controller  has  assessed  all  the  circumstances 
surrounding  the  data  transfer  and  has  on  the  basis  of  that  assessment  provided  suitable 

80 

 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

safeguards  with  regard  to  the  protection  of  personal  data.  The  controller  shall  inform  the 
supervisory  authority  of  the  transfer.  The  controller  shall,  in  addition  to  providing  the 
information referred to in Articles 13 and 14, inform the data subject of the transfer and on 
the compelling legitimate interests pursued. 

2.  A transfer pursuant to point (g) of the first subparagraph of paragraph 1 shall not involve the 
entirety of the personal data or entire categories of the personal data contained in the register. 
Where the register is intended for consultation by persons having a legitimate interest, the 
transfer shall be made only at the request of those persons or if they are to be the recipients. 
3.  Points (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph 
thereof shall not apply to activities carried out by public authorities in the exercise of their 
public powers. 

5. 

4.  The public interest referred to in point (d) of the first subparagraph of paragraph 1 shall be 
recognised in Union law or in the law of the Member State to which the controller is subject. 
In  the  absence  of  an  adequacy  decision,  Union  or  Member  State  law  may,  for  important 
reasons of public interest, expressly set limits to the transfer of specific categories of personal 
data  to  a  third  country  or  an  international  organisation.  Member  States  shall  notify  such 
provisions to the Commission. 

6.  The controller or processor shall document the assessment as well as the suitable safeguards 
referred to in the second subparagraph of paragraph 1 of this Article in the records referred 
to in Article 30. 

81 

 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Appendix C: 

Summary  of  the 
methods 

literature  review  study 

The  review  was  guided  by  the  methodology  of  a  (systematic)  scoping  review,  which  included:  (1) 
identifying  the  scope  and  approach,  (2)  searching  for  relevant  literature  (scientific  and  grey),  (3) 
selecting literature, (4) analysis of the literature, and (5) synthesis of the report. 

1. 

Identifying the scope and approach 

The  scope  and  approach  were  identified  in  the  inception  phase  of  the  study.  The  approach  and 
resulting inclusion criteria and methods for the review were pre-specified in a protocol. During the 
study  more  insights  were  gained  on  the  topic  and  minor  deviations  have  been  made  to  the  initial 
protocol to meet the study objectives in a better way. These are stated in the methods section below 
with the justifications. 

2.  Searching for relevant literature 

We searched for literature that focused on digital CT tools and applications as well as national and 
cross-border  CT  practices  (for  both  COVID-19  and  Mpox),  and  actors  involved  in  the  execution  of 
national  and  cross-border  CT  of  MS.  The  literature  search  was  divided  into  a  scientific  and  grey 
literature search.  

Scientific literature search 
Scientific  studies  were  identified  by  computerised  searches  of  Embase  and  PubMed.  The  search 
strategies were developed by an experienced information scientist with input from members of the 
project team. Four separate search strategies were set up: 

i. 
ii. 
iii. 
iv. 

Digital CT (COVID-19) 
Cross-border CT (COVID -19) 
Legal aspects of CT (COVID-19) 
CT for Mpox 

On  top  of  the  search  strategies,  the  Eurosurveillance  journal  was  specifically  searched  during  the 
course of the study to identify and include additional relevant articles. 

Grey literature search 
We identified reports/other documentation applying the following strategy: 

1.  A web-based search in specific databases: 

•  World Health Organization (WHO) IRIS Library 
•  Publications Office of the European Union 

2.  A search to build upon prior work and knowledge of others: 

•  Publications provided by the EC 
•  Documents on other, previous relevant EC-projects 
•  Publications provided by the expert taskforces of RIVM on CT and international travel, who 
keep track of relevant documents shared by authorities such as the WHO and ECDC  

In  addition,  the  COVID-19  Health  System  Response  Monitor  (HSRM)  platform  of  the  European 
Observatory on Health Systems and Policies was used to extract data on MS CT practices and how they 
increased surge capacity in human resources for CT. 

3.  Selecting literature 

The scientific literature was first assessed and thereafter the grey literature. The literature identified 
(n=3148) through the various search strategies  were imported into Endnote bibliographic software 

82 

 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

(v.20.3) and duplicates were removed. After assessment, a process for inclusion/selection of relevant 
articles was performed, including a scientific literature and a grey literature assessment. In total, we 
included 120 publications for the general search, and 52 for the legal analysis (ten publications had 
overlap). Four publications identified through Eurosurveillance were additionally included. 

Regarding  “contact  tracing”,  we  included  literature  related  to  identifying,  notifying,  and 
monitoring of index cases and their contacts by PHAs or organisations responsible for the execution of 
CT. It includes the exchange of information between, (1) citizens and PHAs, (2) PHA and other PHAs in 
the same country, and (3) EU-NFPs and non-EU-NFPs, i.e., cross-border CT. 

Regarding “digital tools and applications for CT”, we included literature related to tools and 
applications used by citizens to support PHAs by collecting, storing, or sharing information that PHAs 
use for CT as well as receive information from PHAs; and tools and applications used by PHAs to in 
their outbreak investigation and response. We specifically excluded warning and proximity apps.  

4.  Analysis of literature  

Three  frameworks  were  used  as  a  base  and  structure  for  coding  and  reporting  the  data  from  the 
literature: one on digital tools and applications, one on how national CT relates to cross-border CT, and 
one on legal aspects.  

Key predefined variables related to the objective of the review structured our data extraction 
phase and were put into MAXQDA as a start of the coding system. Based on these key codes, selective 
reading  was  performed  to  identify  and  code  the  literature  documents.  We  applied  a  deductive 
approach, with inductive elements. This allowed us to structure the most important elements of the 
studies, but also to create new concepts and variables that may arise from the literature but were not 
yet  included  in  the  frameworks.  The  data  synthesis  techniques  were  structured  based  on  the 
framework and emerging concepts that arose from the literature.  

5.  Synthesis of the report 

The  synthesis  was  initially  built  on  the  MAXQDA  codes,  but  later  continued  with  various  cross-
tabulations  of  data  and  hand  searching  for  specific  topics  within  the  included  set  of  publications. 
Additional relevant literature was used as and when necessary to provide background or insights to 
the topics discussed.  

83 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Appendix D:   Survey 

Questionnaire 

Contact tracing digital tools and applications used at national and EU level and integration within 
EWRS, selective exchange module – November 2022 

Dear colleagues, 

You are kindly invited to participate in this survey for representatives of EU Member States and EEA countries, 
conducted by the EUHealthSupport Consortium, on behalf of the European Commission’s Directorate-General 
for Health and Food Safety (DG SANTE).  

The aim of this survey is to collect information on  national and cross-border Contact Tracing (CT) practices, 
experiences, digitalisation, and legal frameworks. The results of this survey will be used to assess the feasibility 
of a linkage between the CT applications data (national CT applications, digital Passenger Locator Form, exchange 
platform (ePLF and EUdPLF) with the Early Warning and Response System (EWRS). 

This survey is part of a larger feasibility study on CT tools and applications used at national and EU level and their 
integration within EWRS. The study focusses on lessons learnt from the COVID-19 pandemic in relation to CT and 
strengthening of cross-border CT practices at national, EU and international level. 

The survey collects information on national and cross-border CT practicesiv with the main focus on cross-border 
exchange. It is divided into three sections: 

• 
• 
• 

Part 1 : CT operations, practices, and management 
Part 2 : legal perspective in CT 
Part 3 : policy and CT 

The questions in the survey will focus on cross-border CTv within EU and EEA countriesvi. A few questions will 
cover how CT is conducted at international level with other countries, i.e. non-EU/EEA countries. 

To  provide  a  full  response  to  the  questions  below,  we  kindly  ask  you  to  consult  other  departments  and/or 
authorities involved in national and/or cross-border CT practices, if needed.  

We  kindly  ask  you  to  provide  a  consolidated  response  by  23  December  2022  at  the 
contact@euhealthsupport.eu with sante-consult-b2@ec.europa.eu in carbon copy.  

latest  to 

iv Contact tracing is the process of identifying, assessing, and managing people who have been exposed to an infectious disease 
to  prevent  onward  transmission.  It  has  been  an  important  public  health  strategy  with  the  aim  of  breaking  the  chain  of 
transmission during the COVID-19 pandemic. 

v Cross-border CT is CT that takes place between two or more countries. It involves carrying out CT for incoming requests on 
contacts or index cases identified in another country, who are sent to you for CT in your country and sending outgoing requests 
to other countries on contacts or index cases identified in your country, who are staying (contacts) or have been infectious 
(index) in another country. 

vi  EU  countries:  Austria,  Belgium,  Bulgaria,  Croatia,  Cyprus,  Czech  Republic,  Denmark,  Estonia,  Finland,  France,  Germany, 
Greece,  Hungary,  Ireland,  Italy,  Latvia,  Lithuania,  Luxembourg,  Malta,  Netherlands,  Poland,  Portugal,  Romania,  Slovakia, 
Slovenia, Spain, Sweden.   

EEA countries: Iceland, Liechtenstein, Norway 

84 

 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Your answers will be invaluable in creating an understanding of how MS have conducted and are conducting CT 
and what is necessary to enhance cross-border CT exchange for COVID-19 and other infectious diseases, as part 
of preparedness and response at national and EU level.  

Regarding the respondents for this survey, it may vary per section who could be the most suitable person to 
respond to the survey per section or question. Possible respondents could be: 

• 
• 
• 

Part 1: professionals involved in CT operations, practices and management) 
Part 2: professionals involved in legal and policy related topics) 
Part 3: senior level policy-makers or public health managers who plan public health measures.  

If you have any questions about the survey or the study, please contact contact@euhealthsupport.eu. 

We would like to thank you in advance for your contribution. 

Background information  
1.  Which country are you representing? 

2.  What is your current role in the organisation? 

Part 1: Contact tracing practices and digital tools  

Section 1: Organisation and execution of CT in your country for COVID-19 

In the first section we focus on how contact tracing (CT) has been organised and executed in your country for 
COVID-19 response. For all questions below, if there have been major changes throughout the pandemic, then 
we kindly ask if you could indicate the major changes in measures, processes and infrastructures, especially 
towards the peak of the pandemic, to indicate the current situation and to describe the lessons learned for 
potential future pandemics. 

3.  a.  Please  fill  in  the  actors  (organisations,  institutes,  units,  or  professionals)  who  have  the  main 

responsibilities for CT activities, as listed below, during the COVID-19 outbreak at three levels:  

• 

Cross-border level: actors who are working on different aspects of cross-border CTiv in your country. 

•  National level: actors who function at a national level, such as the Ministry of Health, the national public 

health institute, national agencies, and others. 

• 

Sub-national level: actors who have authority or a function in a certain jurisdiction of the country, such 
as a region, city, or catchment area. Examples include regional health authorities, regional institutes of 
public health, local public health units, hospitals, general practitioners, and others.   

Please provide names and abbreviations of actors in the original language, and in English, if possible. You may 
also list  full names and abbreviations and then complete the remainder of the table with abbreviations. If 
there are no actors/ organisations or activities at a given level, you can write N/A. 

85 

 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Cross-border level 

National level 

Sub-national level  

Other 

Decides CT policies 
and guidelines 

Organises and 
conducts/ executes 
CT 

Collects data for 
case management 
and surveillance 

Functions as the 
data controllervii 

Decides which CT 
software and 
platforms (digital 
tools and 
applications) are 
usedviii 

Conducts other 
relevant tasks, 
please specify: 

b. Please fill in the table below for specific cross-border CT activities, including any major changes towards the 
peak of the pandemic and in the current situation. 

Note that incoming requests include contacts or index cases identified in another country, who are sent to you for 
CT in your country. Outgoing requests include contacts or index cases identified in your country, who are staying 
(contacts) or have been infectious (index) in another country.  

Cross-border specific 
CTv activities 

Actors / organisations (please provide the full names and abbreviations in 
the original language and in English, if possible) 

N/A 

National Focal Point 
(NFP) who sends and 
receives CT requests 
and data to and from 
other countries 
through EWRS 

vii Data Controller within the meaning of Article 4 of GDPR refers to the natural or legal person, public authority, 
agency or other body which, alone or jointly with others, determines the purposes and means of the processing of 
personal data. E.g. which agency, authority of body decides “why” and “how” CT data is processed. 

viii Digital CT tools refer to tools and applications that have been used during the COVID-19 pandemic and are 
directly  linked  to  the  CT  process  conducted  by  public  health  authorities  or  organisations  responsible  for  the 
execution of CT. 

86 

 
 
 
 
  
 
  
  
  
 
 
 
 
  
 
  
  
  
 
 
 
 
  
 
  
  
 
 
 
 
 
 
 
  
 
Feasibility study on digital technology for cross-border contact tracing 

Cross-border specific 
CTv activities 

Actors / organisations (please provide the full names and abbreviations in 
the original language and in English, if possible) 

N/A 

Incoming CT: Actors 
who receive CT 
requests and data 
from the NFP and 
carry out CT  

Outgoing CT: Actors 
who send CT requests 
and data to the NFP to 
be shared with other 
countries 

4.  What strategies have been used to upscale CT during COVID-19 peak times, or to increase efficiency? For 
example, using methods to increase human resources. (volunteers, medical students, etc.), and/or adjust 
the execution of CT, based on pandemic pressure). 

5.  a. Please describe the three main challenges you have experienced during CT for COVID-19 in the box below: 

1. 

2. 

3. 

b. Please describe any solutions you implemented to meet these challenges in the box below: 

6.  Have the CT practices in the context of COVID-19 been monitored and evaluated? If yes,  please describe 
what were the main outcomes (how, what, where). If there are existing reports (published or unpublished), 
materials or websites that provide more information on the monitoring and evaluation of CT practices, then 
please share the link or send them via e-mail as attachment. 

☐ Yes 
☐ No (please go to the next section) 

7.  What were the main lessons learned in relation to cross border CT from COVID-19? Please provide answers 

in the box below:  

a. During peak time: 

b. For the future: 

87 

 
 
 
 
  
  
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Section 2:  Contact tracing software and platforms (Digital CT tools) 

We  would  like  to  obtain  further  insight  into  the software  and  platforms  (Digital  CT  tools)  used  for  CT  during 
COVID-19 outbreak. These refer to outbreak investigation tools (e.g., Go.Data and SORMAS) and other digital 
tools that are directly linked to the CT process conducted by public health authorities or organisations that were 
assigned to carry out CT (e.g. excel), as described in the box below.   

Software and platforms for CT (digital CT tools): Public health agencies (PHA) use different types of software 
or platforms/systems to support the digitalisation and streamlining of case investigation and CT. Such tools 
also include Excel or others. PHA or other organisations use these systems as both databases and to aid work 
processes  by  employing  standardised  workflows  (e.g.  transferring  cases  to  other  jurisdictions,  managing 
attempts to reach contacts, guiding staff through interviews, etc.) and gathering information to support the 
core tasks of CT (e.g. identities of potential contacts, details of disease progression, requests for additional 
resources,  etc.).  These  systems  may  have  been  developed  to  streamline  the  labour-intensive  process  of 
conventional  public  health  CT,  a  necessity  given  the  exceptional  volume  of  cases  during  the  COVID-19 
pandemic.  

8.  What software and platforms have been used in your country during the COVID-19 outbreak to conduct CT 
and/or  share  CT  data?  Please  specify  them  below,  with  the  name  of  the  tools  and  the  actors  who  use 
that/those tool(s). If available, you can provide a link to the website, report or documentation that provide 
background information on the digital tool(s). 

Name and 
type of 
digital 
platform 
and/or tool 
(Add links to 
tool, reports, 
etc)  

Example: … 

Actors who use it 

Brief explanation on the platform/ 
tool and why it was chosen 

CT system 
used for 
(sub)national 
CT  

CT system 
used to 
provide data 
for cross 
border CT 

Example: Public 
Health Authority 
(PHA) at local level 

Example: System used for the 
collection and storage of CT 
information.  

☐ Yes 

☐ No 

☐ Yes 

☐ No 

It was already in place before the 
pandemic 

☐ Other:… 

☐ Other:… 

☐ Yes 

☐ No 

☐ Yes 

☐ No 

☐ Other:… 

☐ Other:… 

☐ Yes 

☐ No 

☐ Yes 

☐ No 

☐ Other:… 

☐ Other:… 

☐ Yes 

☐ No 

☐ Yes 

☐ No 

☐ Other:… 

☐ Other:… 

9.  a. Does your country have any plans to move to another type of software and platform for CT? 

88 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

☐  Yes  
☐  Not yet, but considering to switch to another type in the future 
☐  No 
☐  Don’t know 
☐  Not applicable 

    b. If yes or considering/exploring, please elaborate in the box below:  

Which alternative are you preparing / considering? 

What are the reasons for (possibly) switching to this other system?  

10.  Can  you  describe  in  the  box  below  how  CT data  is  shared  between  actors  within  your  country?  In  your 
answer, if available, you can present a graphic or a (flow) chart showing how CT data flows from the actor 
that collected it towards other actors, eventually reaching the organisation in charge of sharing cross-border 
CT data through EWRS. 

For example: In the Netherlands, contact tracers collect information from citizens mainly through phone calls. 
The CT information is stored in the so-called HPZone system of the PHA at the local level. There are 25 PHA at 
local level and they all use the HPZone system to collect CT information. These systems of the PHA are not 
connected to each other, nor does the organisation in charge of sharing cross-border CT data through EWRS, 
i.e. RIVM, have access to it. Therefore, they communicate through phone/secured mail when necessary.   

11.  In some countries, the organisation(s) in charge of sharing cross-border CT data through EWRS  may not 

have access to regular CT data, but only have access to data for cross-border CT.  

a. 

If this is the case in your country, what specific systems are in place for (sub)national actors such as 
local  PHA,  to  share  data  with  the  EWRS  user  in  charge  of  sharing  cross-border  CT  data  for 
international travel? 

☐  E-mail (secured); please specify between which actors: …. 
☐  Online form; please specify between which actors: …. 
☐  Not applicable 
☐  Do not know 
☐  Other, please specify which system and between which actors 

b.  Are there specific conditions that need to be met for the use of such systems? 

89 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

c.  What are the national regulations that allow the sharing of this data, including application of GDPR 

for the exchange of personal data, and others? 

12.  What were the main practical challenges you have experienced in relation to (digital) CT for COVID-19 within 
your country? And what were the main drivers or facilitators of using digital tools for CT for COVID-19 within 
your country? 

a. Practical challenges: 

b. Main drivers or facilitators: 

Section 3: Specific questions on cross-border CT for COVID-19   

In the questions below, we want to obtain a better understanding specifically of the cross-border CT carried out 
within EU/EEA countries during the COVID-19 outbreak, as well as with countries outside the EU/EEA. 

13.  What were the main practical challenges you have experienced in relation to cross-border (digital) CT for 
COVID-19 with other countries? And what were the main drivers or facilitators of using digital tools for CT 
for COVID-19 with other countries? 

a. Practical challenges: 

b. Main drivers or facilitators: 

14.  What software or platform(s) has your country used through their national focal points (NFPs) to enable 
cross-border data-exchange of CT data for COVID-19 with EU/EEA countriesvi? Multiple options are possible. 

☐  E-mail (secured) 
☐  Excel 
☐  Early Warning and Response System (EWRS) 
☐  Event Information Site (EIS) 
☐  Digital Passenger Locator Form (EUdPLF) 
☐  Exchange platform (ePLF)  
☐  No software or platform(s)  
☐  Other, please specify 

15.  What software or platform(s) has your country used through their national focal points (NFPs) to enable 
cross-border data-exchange of CT data for COVID-19 with countries that are not EU/EEA members? Multiple 
options are possible. 

☐  E-mail (secured) 

90 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

☐  Excel 
☐  Early Warning and Response System (EWRS) (if yes, please specific which countries: …. ) 
☐  Event Information Site (EIS) 
☐  Digital Passenger Locator Form (EUdPLF) 
☐  Exchange platform (ePLF)  
☐  No software or platform(s)  
☐  Other, please specify 

16.  What were the challenges of using the above-mentioned system(s) (if applicable)?  

17.  Please provide the (maximum) top 3 benefits and drawbacks in using existing EU digital tools (EUdpLF and 

ePLF) to support CT of other communicable diseases?  

Possible 
benefits 

Possible 
drawbacks  

1. 

2. 

3. 

1. 

2. 

3. 

N/A 

☐ 

N/A 

☐ 

18.  To which non-EU/EEA countries does your country send the most requests/data for outgoing cross-border 
CT? And from which non-EU/EEA countries does your country receive the most requests/data for incoming 
cross-border CT? Please provide the top 3 in both columns below. 

Top 3 non-EU/EEA countries to which you send most 
requests/data 

Top 3 non-EU/EEA countries from which you 
receive most requests/data 

1. 

2. 

3. 

1. 

2. 

3. 

19.  To what extent did you share the CT information regarding COVID-19 with other EU/EEA countries for index 
cases or contacts identified in your country, who were infectious (index case) or who were staying (contacts) 
or were in another country (outgoing CT)?  

Index cases 

Contacts 

91 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

All/ almost all 

Most 

Approximately half 

Some 

Very few  

None of the contacts or index cases identified 

N/A 

☐ 

☐ 

☐ 

☐ 

☐ 

☐ 

☐ 

☐ 

☐ 

☐ 

☐ 

☐ 

☐ 

☐ 

20.  a.What  factor(s)  related  to  your  own  country  (other  than  the  policy  on  carrying  out  CT  for  international 
travel)  influence(s)  whether  outgoing  CT  requests  are  made  and  CT  information  is  shared  with  another 
country? Multiple responses are possible  

☐ Outbreak/cluster size 
☐ Epidemiological assessment, based on________________(please complete) 
☐ Availability of trained human resources 
☐ Workload 
☐ Concerns over the CT policy of the other country  
☐ Whether the CT data is sufficient 
☐ Whether CT is still needed (after a delay) 
☐ Other, please specify:  

b. What factor(s) related to the other country to which you send the request influence(s) whether outgoing 
CT requests are made and CT information is shared with another country? Multiple responses are possible. 

☐ EU/EEA versus non-EU/EEA country (outgoing requests to EU/EEA countries being   
    prioritised)  
☐ Privacy approach and regulations of the country the request will be sent to 
☐ Whether the CT information shared will be followed up by that country 
☐ Responsiveness of the other country 
☐ Other, please specify:  

21.  To what  extent  did your country conduct CT after receiving incoming requests regarding COVID-19 from 
another EU/EEA country on contacts or index cases who were staying or had been infectious in your country? 

☐ All / almost all of the CT requests received 
☐ Most of the CT requests received 
☐ Approximately half of the CT requests received 
☐ Some of the CT requests received 
☐ Very few of the CT requests received 
☐ None of the CT requests received 
☐ Other, please specify: 

92 

 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

22.  a. What factor(s) related to your own country (other than the policy on carrying out CT for  international 
travel) influence(s) whether incoming CT requests are processed for CT in your country? Multiple responses 
are possible. 

☐ Outbreak/cluster size 
☐ Epidemiological assessment, based on____________________________________ 
☐ Availability of (trained) workforce  
☐ Workload  
☐ Other, please specify:  

b. What factors related to the other country which sends you the request influence(s) whether incoming CT 
requests are processed for CT in your country? Multiple responses are possible. 

☐ Whether the CT data is sufficient 
☐ Whether CT is still needed (after a delay) 
☐ EU/EEA versus non-EU/EEA country (incoming requests from EU/EEA countries 
     being prioritised)  
☐ Working relationships with that country  
☐ Other, please specify:  

Section 4: CT practices in relation to other infectious disease outbreaks 

In the questions below we would like to obtain a better understanding of CT practices in relation to other 
infectious disease outbreaks. If not relevant, please indicate this with ‘N/A’. Please skip those questions and go 
to the next question. 

23.  Please  provide  a  list  of  the  top  five  infectious  diseases,  other  than  COVID-19,  for  which  CT  has  been 
conducted  in  your  country  during  the  last  five  years.  Note.  This  can  refer  to  infectious  diseases  such  as: 
airborne, vector borne, sexually transmissible diseases or any other infectious diseases transmitted to and/or 
between humans. 

Top five infectious diseases during the last five years (other than COVID-19) 
1.  

2.  

3.  

4.  

5.  

24.  Do any of the five infectious diseases you have listed above prompt cross-border CT? If yes, which ones? 

93 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

25.  In the previous sections we have asked in-depth questions to understand how CT systems operated during 
COVID-19. We would like to know whether and how operation of CT systems differ for other outbreaks, in 
particular for Mpox. 

a. Is there a difference between  CT systems for the Mpox outbreak or for other diseases that prompt 
cross-border CT, compared to CT systems for COVID-19 in your country?  

☐ No difference for CT systems in the case of Mpox or other outbreaks compared to COVID-19 
☐ CT systems do differ in the case of Mpox or other outbreaks compared to COVID-19 (please describe 

the main differences below) 

☐ Not applicable  
☐ Do not know  
☐ Other, please specify:  

b. If there are differences, could you describe how national and cross-border CT systems differ for the 
Mpox  outbreak  or  for  other  diseases  that  prompt  cross-border  CT,  compared  to  COVID-19  in  your 
country?  

The main differences for 
Monkeypox compared to COVID-19 

The main differences for 
other diseases compared to 
COVID-19  

National CT systems 

Cross-border CT systems 

26.  Are CT software and platforms (digital CT tools) developed for COVID-19 potentially helpful for CT of other 

infectious diseases? 

☐  Yes, namely (please below describe in what way and provide examples/references of these tools): 
☐ No  
☐ N/A 

Part 2: Legal Analysis 

Section 1: Questions relating to International Health Regulations (IHR) – International Law  

The aim of this section is to collect information on the legal frameworks that support CT. While there is some 
repetition of questions under each of the sections, please note the answers may differ. For example, there may 
be a different lawful basis for data sharing at national level, within the EU and outside the EU and the governing 
law may dictate the answer. If the answer is in fact the same, then it is possible to refer to a previous answer. 

In  the  questions  below  we  want  to  obtain  a  better  understanding  of  the  national  legal  and  policy  context  in 
relation to the application of the IHR and International law. Specifically: 

27.  What public health laws/regulations/policies does your country have in place to implement and underpin CT 

obligations under the IHR 2005? Please outline in the box below and add the link. 

94 

 
 
 
 
 
 
 
 
  
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

28.  General Data Protection Regulation 2016 (GDPR) 

a.  What  is  your  country’s  basis  for  processing  under  Articles  6ix  &  9x  of  GDPR,  when  cross-border  sharing 

personal data in compliance with IHR obligations?  

b.  When  performing  international  cross-border  sharing  of  personal  data,  how  are  the  GDPR  principles  of 
lawfulness,  fairness,  transparency,  purpose  limitation,  data  minimisation,  accuracy,  storage  limitation, 
security & accountability complied with? e.g. are controller agreements, data sharing agreements in place?   

c. 

In the absence of an adequacy decision, which Article 46 GDPR safeguards are in place enabling cross-
border sharing e.g. standard contractual clausesxi. Please specify. 

29.  Could a decision not to share contact tracing data be taken? Such a decision might be made where an ethical 
or fundamental rights concern arises, such as punitive or criminal sanctions for non-adherence to quarantine 
laws or sexual orientation. 

☐ Yes  
☐ No (please go to the next question) 

If yes, please elaborate more in the box below: 

30.  a. Are there any data protection based legal barriers to cross-border data sharing under IHR for CT purposes.  

 ☐ Yes  
 ☐ No (please go to the next question) 

b. If yes, please elaborate more in the box below the following:  

a. What are the legal barriers: 

b. Are there plans to resolve them and what are these plans: 

Section 2: Questions related to Decision 1082 /2013/EU  

We also want to obtain a better understanding of the national legal and policy context in relation to Decision No 
1082/2013/EU of the European Parliament and of the Council of 22 October 2013 on serious cross-border threats 
to health and repealing Decision No 2119/98/EC Text with EEA relevance.  

ix Art 6 GDPR - Lawfulness of processing, https://gdpr-info.eu/art-6-gdpr/ 
x Article 9 GDPR - Processing of special categories of personal data (Processing of personal data revealing racial or ethnic origin, 
political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric 
data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex 
life or sexual orientation shall be prohibited). 
xi  Art. 46 GDPR – Transfers subject to appropriate safeguards - General Data Protection Regulation (GDPR) (gdpr-info.eu) 

95 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
   
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Note - If the answers to question 32 are the same as for question 29 above, then it is possible to refer to that 
answer.  

31.  General Data Protection Regulation 2016 (GDPR) 

a.  What  is  your  country’s  basis  for  processing  under  Articles  6  &  9  of  GDPR,  when  cross-border  sharing 

personal data using EWRS, in compliance with Decision 1082 obligations? 

b. How are the GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, 
accuracy, storage limitation, security & accountability complied with in a cross-border context within the 
EU/EEA? e.g. are controller agreements, data sharing agreements or a data protection impact assessment 
(DPIA) in place. 

32.  Are there any data protection based legal barriers to EU/EEA cross-border data sharing for CT purposes?   

☐Yes  
☐No (please go to the next question) 

If yes, please elaborate more in the box below the following: 

a. What are the legal barriers: 

b. Are there plans to resolve them and what are these plans: 

33.  a. For CT purpose, does the organisation(s) in charge of sharing cross-border CT data through EWRS receive 

passenger data from airline companies? 

☐Yes  
☐No (please go to the next question) 

If yes, please elaborate more in the box below : 

b. What is the legal basis for receiving personal data from the airline companies, in line with GDPR and other 
requirements?  

Section 3: Questions relating to COVID-19  

In the questions below we are looking for additional information relating to CT for COVID-19. If the answer is 
the same as per the  questions above, then you can refer to those answers 

34.  a.  Were  legal  frameworks  sufficiently  robust  to  manage  the  scale  of  CT  required  during  the  COVID-19 

pandemic:  

☐ Yes  
☐ No   

96 

 
 
 
 
 
 
 
 
 
 
  
   
 
 
  
  
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

a.  Please elaborate in the box below. If yes, what potential reasons were there? If no, what improvements 
were  or  are  still  needed  to  support  international,  EU  &  national  level  CT  based  on  the  COVID-19 
emergency? 

b.  Was it necessary to introduce new law(s)? 

☐ Yes 
☐ No (please go to the next question) 

If yes, please describe in the box below: 

c. 

Is this law still in place or was it time limited? 

☐ Yes, this law is still in place. 
☐ No, it was time limited for a period from ______to ______  

If no, please specify if the time  period has been extended from a previous limited period 

Please elaborate on above answer in the box below: 

d.  Did  the  COVID  19  pandemic  raise  any  particular  data  protection  challenges?  If  yes,  how  were  these 

overcome? 

☐ Yes (please describe in box below)  
☐ No (please go to the next question) 

If yes, please describe in the box below: 

e.  Does your country have a legal framework for declaring a public health emergency? 

☐ Yes  
☐ No (please go to the next question) 

If yes, please describe in the box below: 

35.  a. Has legislation that was put in place during COVID-19 been helpful for CT of other infectious diseases? 

☐ Yes, namely (describe briefly in what ways): [insert text box] 
☐ No  
☐ N/A 

97 

 
 
 
 
 
 
 
 
 
 
 
 
  
  
  
 
 
 
 
 
 
  
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

36.  Were  any  amendments  made  to  national  professional  codes  of  practice  and  ethics  to  allow  sharing  of 

medical information  during COVID-19? 
  ☐Yes 
  ☐No  

If yes, please describe in the box below: 

Section 4: Legal questions relating to passenger locator forms (PLFs)  

In the questions below we are looking for additional information on legal issues relating to the use of digital PLFs. 
If the answer is the same as per the questions above, then you can refer to those answers. 

37.  Was a new national level law or regulation needed to allow for the introduction of the national digital PLF?  

☐ Yes  
☐ No  

If yes, please elaborate, and add the link, in the box below: 

a. If yes, is it still in place or will new legislation be required, if digital PLFs become necessary again?  

☐Yes, it is still in place 
☐ No, it is not in place and new legislation will be required 
☐ Other, _________________________ 

Please elaborate in the box below: 

38.  In the context of digital PLF’s, have measures such as DPIA or other data protection measures been used to 
ensure compliance with the GDPR principles of lawfulness, fairness, transparency, purpose limitation, data 
minimisation, accuracy, storage limitation, security & accountability?  

Part 3: Policy  

The aim of this section is to collect information from policy-makers in relation to CT. The topics covered in this 
section are: CT software and platforms (digital CT tools)xii, finance and resources, national level governance of 
cross-border CT and policy frameworks that support CT. 

xii To support the digitalisation and streamlining of case investigation and CT, public health agencies (PHA) use different types 
of  software  platforms/systems.  PHA  or  other  organisations  use  these  systems  as  both  database  and  job  aid,  employing 
standardised  workflows  (e.g.  transferring  cases  to  other  jurisdictions,  managing  attempts  to  reach  contacts,  guiding  staff 
through interviews, etc.) and gathering information to support the core tasks of CT (e.g. identities of potential contacts, details 
of disease progression, requests for additional resources, etc.). These systems have been developed to streamline the labour-
intensive process of conventional public health CT, a necessity given the exceptional volume of cases during the COVID-19 
pandemic. 

98 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Section 1: Contact tracing software and platforms (Digital CT tools) 

39.  Is there any policy (in addition to legal measures as described above) that can facilitate and/or hinder the 

integration of data resourcesxiii for CT in your country? Please elaborate in the box below: 

40.  In  what  way  can  the  EU  support  the  improvement  of  cross-border  contact  tracing  performance  of 

communicable diseases at national level by using contact tracing software and platforms?  

Please elaborate in the box below: 

Section 2: Finance and resources of CT 

41.  Financial and human resources may play an important role within CT decision making. In this context, we 

would like to ask: 

a.  How are the funds organised for CT practices in your country? Please elaborate in the table below 

per different levels, type of funds and proportion of total cost. 

Type of funds  

National level 

Subnational level 

Proportion (%) of 
total funds  

Human resources 

Funds for 
communication 

Funds for equipment, 
digital platforms or IT 
tools 

Funds for testing 

Other types of funds 

b.  How will current CT practices and funding be sustained, if at all after the pandemic COVID-19 (e.g. 

during peace time)? Please elaborate in the box below: 

c.  Has securing funding/financing been a constraining factor to expand CT activities and/or capacity?  

☐ Yes 
☐ No 

xiii In this survey, integration of data resources refers to the merging/combining of different datasets from different sources for 
the purpose of CT. 

99 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

If yes, please elaborate how in the box below: 

d.  Has securing funding/financing been a constraining factor for development or deployment of digital 

tools?  

☐ Yes 
☐ No 

If yes, please elaborate how in the box below: 

42.  Have  you  experienced  staff  shortages  on  CT  during  peak  or  other  times  of  an  outbreak?  If  yes,  please 
elaborate on how you coped with this? These could also be lessons learned from the COVID-19 pandemic. 

☐  Yes 
☐  No 

If yes, please elaborate how this was dealt with in the box below: 

Section 4: National level governance of cross-border CT  

43.  What strategies and alternative methods are you considering in terms of regular CT for infectious diseases 
in the future, and in order to manage CT during high-demand periods in general? These could also be lessons 
learned from the COVID-19 pandemic. 

44.  What strategies and alternative methods are you considering in relation to digital systems for regular CT for 
infectious diseases in the future, in order to manage CT during high-demand periods? These could also be 
lessons learned from the COVID-19 pandemic. 

45.  What  are  your  perspectives  on  adoption  of  structured  cross-border  CT  data  as  part  of  EWRS  selective 

exchange? 

46.  What are your perspectives on the adoption of the definition of the minimum data required for CT as part 

of EWRS selective exchange? 

100 

 
 
 
 
 
 
 
  
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

47.  What are your perspectives on the adoption of the inclusion of data from dPLFs as part of EWRS selective 

exchange? 

48.  What are your perspectives on additional features that EWRS could have in the future? 

49.  What opportunities do you see for enhanced integration of cross-border CT to improve notificationto EWRS? 

50.  What type of support do you need from the EU in relation to digitalisation of national and cross border CT 
practices  in  your  country  (e.g.  training,  recommendations  on  standards,  monitoring  and  evaluation 
frameworks, opportunities to exchange best practices and/or any other)?  

Please elaborate in the box below: 

Contact information  

Please kindly indicate if you grant  permission for your  name and contact details fto be used for contact purposes 
for this survey. Your data will be deleted within one month after completion of the study. 

 ☐ Yes 
 ☐ No 

If you have given permission, then please enter a name and e-mail address in case it is needed to follow up on 
the survey:  

Note. The name and contact details requested are for the sole purpose of contacting the person, if necessary, 
about the survey. In the reports of the study, respondents will remain anonymous, though the results may be 
linked to the countries represented. Your data will be deleted within one month of completion of the study. 

Name: 
E-mail: 

Thank you for your cooperation. 

101 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Appendix E: Summary of the interview study methods 

1.  Research questions and objectives 

The research question(s) were as follows:  

1.  What  are  the  factors  influencing  EU/EEA  countries  current  and  future  plans  for 

international travel related CT?  

2.  What  are  the  opportunities  for  EU-level  support  in  order  to  improve  EU/EEA 
coordination of international travel related CT in preparedness for future pandemics? 

The following sub questions have been developed to explore countries: 

1.  What are countries’ experiences and current developments for CT (during and since 
COVID-19) with a focus on CT systems, digital tools, governance and legislation? 
2.  What are countries’ future directions for CT with a focus on CT systems, digital tools, 

governance and legislation? 

3.  What  are  countries’  perspectives  on  their  needs  in  order  to  improve  international 

travel related CT within the EU? 

These questions feed into the objective of this research, of which was to investigate EU/EEA 
countries international travel related CT experiences and future plans with consideration for 
both  national  and  international  CT  related  systems, practices,  digital  tools,  governance  and 
legislation. 

2.  Country selection for interviews 

Semi-structured interviews were conducted with a total of 11 countries (9 EU/EEA countries 
and  2  non-EU/EEA  countries).  The  final  list  of  EU  countries  selected  for  interviews were  as 
follows:  Austria,  Finland,  France,  Germany,  Latvia,  Malta,  Spain,  Czech  Republic  and  The 
Netherlands. The non-EU countries selected were: United Kingdom and Switzerland.  

3. 

Interview content  
1. 

International  travel  related  CT  in  the  country,  with a  focus on  digital  tools,  governance 
aspects and legislation 

2.  CT systems in the country, with a focus on software’s and platforms that provide data to 

cross-border CT  

3.  Perspectives on EU-level support needed for the above two themes 

The interview guide was constructed to include the following sections:  

1.  Countries COVID-19 CT experiences and applicability to other diseases 
2.  Countries current plans and developments since COVID-19 
3.  Legal aspects  
4.  Perspectives on countries needs 
5.  EUdPLF/dPLF use  

4.  Conducting interviews 

Contact  persons  of  countries  were  informed  that  participants  with  knowledge  on  the 
following  areas  would  be  best  suited  to  this  interview:  1)  CT  system  in  the  country,  in 
particular cross-border CT (or international travel related CT), 2) legal frameworks for CT, 
3) use of digital platforms for CT  and data protection. Interviews  were  not  limited to a 
specific number of participants and therefore in order to cover the range of knowledge 
required to cover all topics some countries nominated multiple participants to adequately 
represent their country. Overall, the number of participants per interview ranged from 1-
5. 

102 

 
 
 
 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Before  the  interview,  participants  were  provided  with  an  informed  consent 
document describing the handling of their data. Interviews were conducted via Microsoft 
Teams and lasted for one hour. Interviews were recorded using Microsoft Teams.  

After the interview, a short summary of the key components was produced and 
sent to the participants for their review (i.e., member check). Participants were asked to 
ensure  that  this  summary  of  the  interview  was  accurate  and  to  provide  any  additional 
missing information where necessary. In some instances, whereby a legal professional was 
not  present  during  the  interview,  legal sections  of  the  interview  guide  were  forwarded 
again to participants with a request for them to forward this to a relevant colleague or 
contact  with  legal  expertise;  relevant  participants  were  asked  if  this  would  be  feasible 
during the interview. 

5. 

Interview analyses 
Interviews recordings were transcribed by an outsourced organisation. Transcripts were 
pseudonymised by referring to participants as ‘speaker 1,2, etc.’ within the  transcribed 
interviews  instead  of  using  names.  Analysis  of  transcripts  was  done  using  open  coding 
followed by thematic analysis using MAXQDA (v.22.0.0). After open coding, codes were 
analysed and grouped into categories. Categories were then analysed for overlaps etc. and 
merged where possible to create key themes and subthemes. 

103 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Appendix F: 

Topics discussed during webinars 1 and 2 

Table 14. Topics discussed during webinars 1 and 2 

Webinar-1 (Monday 6th March, 2023: 11-13.00 hrs CET) 
o 

Introduction to the Regulation on serious cross-border threats to health by 
DG SANTE 

Webinar-2 (Friday 21 April 2023, 14.00-16.00 hrs CET) 
o 

Legal arrangements, including their impact and improvements required to allow 
effective cross-border contact tracing. Main questions addressed:  

o  Presentation on the study by EUHealthSupport 
o  Cross-border contact tracing – Barriers, facilitators, and possibilities 
o 

Feasibility of integration of national CT systems into EWRS to allow more 
efficient CT across borders. Main questions addressed: 

•  What are the potential benefits of integration of national digital 
tools / databases / case management systems into EWRS? (Word 
cloud) 

•  Do you envisage Regulation (EU) 2022/2371 supporting EWRS 

operations and integration of national digital CT tools & applications as 
well as dPLF, ePLF and while at the same time ensuring compliance 
with GDPR at national and EU-level?  

•  How can Regulation (EU) 2022/2371 be utilised in your country to 

support EWRS development for cross-border CT independent of 
national law and policy? 

•  What do you view as the main barriers for the integration of 

o  EU-level support in relation to, among others, guidance, good practices, and 

national digital tools / databases / case management systems into 
EWRS? (e.g., related to CT systems, organisations, digital tools, 
legislation/governance or other topics) (Word cloud) 
o  EU digital Passenger Locator Forms and the future of international related 

standardisation. Main questions addressed:  

•  How can the EU provide digital technological support 
➢  At the national and subnational level?  
➢  At the cross-border level? 

travel CT in Europe. Main question addressed: 

•  Besides digital technological assistance, in what other areas could the 

•  What do you view as the main benefits of EU digital Passenger 

EU provide support for cross-border CT? 

Locator Forms? (Word cloud) 

•  During outbreaks on when to continue/discontinue cross-border CT: 
What are your opinions regarding the balance between coordination 
and autonomy on this topic? 

o  Contact tracing for infectious diseases (ID) other than COVID-19. Main 

(sub)questions addressed: 

•  What factors do you consider when deciding which diseases to do 

regular CT for in your country? 

•  What factors do you consider when deciding which diseases to do 

cross-border CT for? 

•  What are countries’ plans to use digital technology for ID with 

respiratory transmission? 

➢ 

In particular for digital CT support tools between citizens and 
PHA & citizen-to-citizen tools? 

 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Webinar-1 (Monday 6th March, 2023: 11-13.00 hrs CET) 

Webinar-2 (Friday 21 April 2023, 14.00-16.00 hrs CET) 

•  Any preparations for CT for particular future scenarios, e.g., avian 

influenza? 

•  What considerations and plans do countries have for cross-border CT 

for ID with respiratory transmission? 

➢ 

In particular during a journey by collective transportation 
means 

•  Do you have any experience with digital partner notification tools for 

STIs or Mpox in your country?  

Do you have any plans or developments regarding digital 
partner notification tools for STIs or similar diseases? 

o  Why do some countries choose not to carry out cross-border CT for these 

diseases? 

o  What are your considerations for the future of cross-border CT for STIs and 

similar diseases? 

o  Other constraints for cross-border CT per infectious disease type? 

105 

 
 
 
 
 
Appendix G: 

Summary tables on  challenges of  digital CT  within  the  country and digital cross-
border CT, and main lessons learned regarding cross-border CT for COVID-19 

Table 15. Challenges experienced during the pandemic and solutions implemented. Data source: survey responses. 

Challenges 
1.Recruiting and retaining sufficient human resources 
•  Most countries mentioned a lack of human resources for CT as a main challenge.  
•  There were not only difficulties with recruitment, but also with retention, as CT staff 

were generally only temporary. 

2.Difficulties in collaborating with the general population 
•  Countries mentioned issues with people not wanting to report their contacts, or 

pass on personal contact details. 

•  Along with a general pandemic fatigue, countries mentioned cases and their 
contacts were sometimes frustrated about having to isolate or quarantine. 

Solutions 

• As mentioned in the strategies used during peak periods, human resources were 

increased by hiring and training people from various medical and non-medical fields. 
• One country stated that people were offered flexible working hours and relatively high 
salaries. Qualification requirements were also reduced in this country and training was 
based on detailed SOPs (standard operating procedures). A separate CT unit on the 
federal level was created to assist during peak times. 

• One country reported several approaches meet challenges in human resources incl. 
redeploying staff, having operational hours across all 7 days of the week, continually 
updating SOPs, enhancing efficiency, reducing burnout, supporting the 
health/wellbeing of staff (including providing isolation facilities for them). Retention 
during periods of lower activity was managed by providing a work schedule requiring a 
similar skill set. 

• One country reported setting up a constitution of a Health care workers crisis 

workforce (by law). 

• One country reported that the Commissioner for personal data protection (GDPR) 
gave them clearance to use the data provided for public health protection actions 
(such as isolation of cases and their contacts). 

• One country reported that quarantine frustrations in general stopped when 

•  One country mentioned having lawsuits from people who felt wronged at being 

quarantine was no longer required. 

obligated to quarantine. 

• One country carried out extra evaluations to ensure the contacts they identified were 

•  One country mentioned an issue with introducing IT solutions was a lack of 

really at risk, thereby limiting the number of contacts.  

information technology literacy, for example in older people. 

• One country mentioned they communicated with the public, when pandemic fatigue 

was leading to people not wanting to quarantine. 

• One country communicated with the public when there were great fears about COVID-

19. 

• One country reported conducting activities to raise awareness for the importance of 

CT. 

3.Obtaining relevant data for CT was time consuming and difficult 

 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Challenges 
•  Countries reported the CT process itself to be time consuming and difficult at times 
•  Obtaining contact data from large gatherings of people, such as schools, institutions 

and other public venues was difficult. 

Solutions 

• One country reported that organisers of public events were advised, and restaurants 

and cafes were required at times to keep guest lists. 

• One country suggested it would be helpful if labs or test locations collected details to 

•  One country mentioned the timely reception of laboratory results as being a 

be able to contact people. 

challenge. 

•  Several countries mentioned difficulties in cross-border CT, such as missing 

information on passengers and knowing which countries passengers had gone to. 
•  Several countries also mentioned delays in receiving cross-border data led to the 

data not being relevant anymore (as the incubation period had passed). 

• One country reported that a digital process was set up for sending lab results  
• One country concluded that CT cannot be effective, because of transmissions among 

asymptomatic and mild cases.  

4.Different regions within countries have their own policies, CT processes and technology 
•  Many countries mentioned a lack of integration of the various types of digital 

•  One country reported that permanent working groups identified best practices and 

systems. 

implemented common strategies. 

•  Several countries mentioned the lack of a single national platform, which limited 

•  One country reported that linkages were created between digital contact tracing tools 

data sharing and access to CT data. 

•  Data could not be shared easily, for example, between lab systems, appointment 

and testing systems, vaccination systems and CT systems. 

•  One country also mentioned the lack of unique identifiers to be able to link cases. 
•  One country mentioned that it has been a challenge for their 21 regions with 

different ideas and resources, to agree on common guidelines, systems and tools.  
•  One country also mentioned heterogeneity of the response to CT at different levels 

in the country as being a challenge. 

•  The lack of tools and the sharing of data made it difficult to conduct surveillance and 

obtain an overview of cases and CT data. 

5.Lack of digital technology solutions 
•  Many countries mentioned there was a lack of digital technology, especially at the 

start of the pandemic and the challenge of having to adapt the technology to 
changes in the pandemic. 

•  One country, for example, mentioned there being a lot of manual work, and having 

to share data by email or telephone. 

and vaccine registries and other databases to reduce manual data entry. Interoperability 
between tools allowed municipalities to share their data more efficiently. 

•  One country reported the creation of a COVID-ID which was a unique identifier to link 
different digital systems. There was a central CT system, which also integrated data 
collected from self-service tools which could be used by citizens to support CT. 

•  One country reported that national published guidelines were published, and regular 

meetings were held with the contact tracers in the 21 regions throughout the pandemic.  

•  Countries reported the upgrade of existing systems and the development of new digital 

systems.  

•  One country reported that rapid improvements in their systems (e.g., to monitor lab and 

vaccination information, CT of inflight notifications, health care system capacity) 
enabled them to receive information on time.  

•  One country mentioned the lack of interoperable tools for international CT 

•  One country reported that passenger questionnaires were developed; one country 

reported that although their use remained voluntary, several national and regional CT 
management systems were implemented; and FR mentioned the EUdPLF as one 
solution to the lack of interoperability of digital tools. 

•  Two countries also reported that SMS messages were sent instead of calling by 

telephone.  

107 

 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Challenges 

6.Needing to constantly adjust their CT processes and guidelines 
•  Several countries mentioned that continual changes in the pandemic led to them 
having to constantly change and update their CT processes and their guidelines, 
their digital technology and their legislation. 

7.Other challenges 
Other challenges mentioned were the following:  
•  Lack of legislation readiness and GDPR obstacles. 
•  Lack of units dedicated to analysis and research. 
•  Demanding phone calls from patients needing help, due to restrictions and patient 

overload in the general health system. 

Solutions 
•  Several countries mention the development and use of digital contact tracing tools 

(mainly proximity-based apps). 

•  One country mentioned new IT systems to support personnel with less previous 

training. 

•  Several countries mention IT solutions to be used as self-service by citizens to support 

CT. 

•  Organisations were designated to do technical reviews and provide advice and 

recommendations. 

•  One country mentioned a dedicated IT manager who set up a new tool for COVID-19 CT 

and management of cases.  

•  One country reported that the relevant legislation was strengthened. 
•  Besides improvement in the systems necessary for COVID-19 (e.g., Lab and vaccination 

systems), one country reported that surveillance was also improved by work on genomic 
sequencing and wastewater monitoring. 

108 

 
 
 
 
 
 
 
 
 
 
 
Table 16. Challenges of digital CT within the country. Data source: surveys responses. 

Technical 
challenges 

•  At the start of the pandemic, digital tools still needed to be developed and existing 

tools needed to be updated. 

•  A few countries reported using excel sheets in the beginning to keep track of cases 

and their contacts. 

•  One  country  reported  different  regions  using  excel  sheets,  and  there  being  no 

time to discuss the development of a new tool or to implement it. 

• 

•  Digital  tools  needed  to  take  scientific,  medical,  ethical  and  legal  aspects  into 
account. The new and dynamic aspect of the pandemic made it hard to keep up 
technologically  (e.g.,  CY  systems  were  reported  as  slowing  down,  due  to  being 
overloaded with data). 
Specific challenges were reported with regard to uniquely being able to identify 
individuals and handling visitors to the country who were not registered. 
Some  contact  tracing  tools  were  reported  to  contain  too  many  unnecessary 
variables. 
Several countries reported that multiple types of digital CT tools used in different 
regions limited the sharing of and access to CT data.  

• 

• 

•  One country reported it being a challenge to get its different regions to agree to 

• 

using one system. 
Integrating data from different data sources of varying quality and standards was 
difficult. 

•  Digital  tools  had to  be  modified  to  accommodate  huge  case  numbers.  Training 
contact tracers to use these evolving tools was time consuming and slowed down 
the work. 

•  Digital tools had to evolve rapidly to manage large outbreak sizes, while at the 

same time meeting public health requirements.  

•  Despite some digital tools, huge case numbers required large numbers of human 

• 

resources. 
Large case numbers and limited human resources led to limiting the amount of CT 
data  that  could  be  collected  and  to  focusing  on  more  high-risk  cases  and  their 
contacts. 

•  Difficult to access lists of contacts from public venues. 
• 
Citizens often provided missing or incorrect data. 
• 
Identifying  contacts  of  cases  and  obtaining  relevant  telephone  numbers  was 
difficult. 

•  Adherence by the public to provide the contacts that were at risk difficult. 

• 

• 

Some digital tools (such as proximity-based apps) were not adopted or accepted 
widely due to privacy concerns of citizens. 
The Bluetooth signal of proximity-based apps was limited, leading to low use by 
citizens. 
There were a lack of financial resources for digital technology. 

• 
•  One country reported the lack of an initial legal requirement to conduct CT on a 

• 

large scale. 
Some  countries  reported  no  challenges  with  digital  tools  and  one  country 
reported that there was no need for a digital CT system. 

Differing 
subnational 
policies and 
digital tools 
within 
countries 
Limited 
human 
resources 

Challenges 
with obtaining 
CT 
information 
from citizens 
Public distrust 
of 
certain 
tools 

Other 
challenges 

 
 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

Table 17. Challenges of digital cross-border CT with other countries. Data source: survey responses. 

Countries  use 
different tools 
cross-
for 
border CT 

Differing 
country 
policies 
cross-border 
CT 

on 

in 

Delay 
receiving 
cross-border 
CT 
information 
Missing 
incomplete 
data for cross-
border CT 

or 

Additional 
workload 

Digital 
technology 
not in place 

Other 
challenges 

• 

Some  countries  reported  difficulties  and  a  lack  of  interoperability  with  cross-
border  CT  tools,  as  countries  were  using  differing  types  of  tools,  with  varying 
degrees of security. 

•  One country reported using various tools for different countries: a special system 
for    non-EU/EEA  neighbour  country,  secured  email  for  neighbouring  regions  of 
two EU countries, EWRS for exchange with other countries. 

•  One country reported compatibility and privacy to be challenges in cross-border 

• 

• 

CT. 
There  were  differences  between  countries  regarding  when  cross-border  CT 
should  be  discontinued,  leading  to  unnecessary  work  sending  or  receiving 
messages that would not be used for anything. 
There  were also differences between countries regarding  the type of data  that 
was collected and exchanged. 

•  One country reported not knowing what CT information was of priority to other 

countries. 

•  One  country  reported  difficulties  with  issuing  certificates  for  people  who  were 

tested in and should have had certificates from neighbouring countries.  

•  Often when countries were provided with CT information, there was no response 

• 

or a late response. 
There were difficulties in knowing when and where to send information regarding 
infected cases leaving the country. 

•  Many countries expressed delays in receiving CT information, to the point  that 

conducting CT was no longer relevant. 

•  One country reported delays in airline data especially from low-budget airlines. 

•  Many countries reported that much data necessary for conducing cross-border CT 

• 

• 

• 

• 

was incomplete or missing. 
Important details of exposed contacts, such as addresses, and telephone numbers 
were not often provided by authorities in other countries. 
Some reasons were given, such as the person to be contacted had already left the 
place, language barriers and errors in data collection. 
Passengers do not all fill in the seats on the plane in the passenger questionnaire, 
making it difficult to isolate them. 
Travel  companies  did  not  always  provide  the  necessary  contact  details  of 
passengers in relevant flights.  

•  Many countries reported that the high number of COVID-19 cases made it difficult 

to keep up cross-border contact tracing.  

•  Organisations were too overwhelmed at the national level to be able to conduct 

• 

cross-border CT as well. 
The overload of messages at times through the EWRS led to delays in conducting 
CT. 

•  One country reported having to analyse airplane companies’ lists of passengers, 

• 

• 

• 

which was very time consuming.  
Some  countries  reported  there  were  no  digital  solutions  in  place  to  be  able  to 
conduct cross-border CT effectively, especially at the start of the pandemic. 
Some  countries  reported  that  digital  cross-border  contact  tracing  was  not 
applicable to them or not necessary. 
The value of cross-border CT in open travel for an infectious agent such as the 
SARS-CoV-2 is sometimes questioned. 

•  One country reported that a close collaboration with neighbouring EU and non-

EU countries had to be set up initially. 

110 

 
 
 
  
  
  
 
Feasibility study on digital technology for cross-border contact tracing 

Table 18. Main lessons learned regarding regular and cross-border CT for COVID-19. Data source: survey responses. 

(1) The necessary 
CT digital 
technology should 
already be in place 

(2) Review if and 
when cross-border 
CT is effective 

•  Most countries reported the need for IT solutions to be in place for future 

scenarios, to increase the speed and efficiency of cross-border CT. 

•  For some countries this meant having their national CT systems integrated with 
their cross-border CT systems, and for other countries they wanted to be able to 
share national data across regions within their countries.  

•  One country mentioned that faster systems and wider networks are needed for 
cross-border CT and there should be a European/global framework to share 
digitalised passenger data. 

•  One country recommended preparing tools in the future that allow the rapid 

upscale of CT activities. 

•  One country mentioned they established a national unit to contact trace all 

flights and that this had enables standardisation as well as the ability to upscale 
when needed.  

•  Two countries reported a need for cross-border CT to be integrated into the 

systems set up for national CT, as these were separate. One of these countries 
mentioned that cross-border CT had led to a lot of manual work and there was a 
lack of technology in the NFP for them to be able to work efficiently. 

•  One country mentioned that there was little coordination of measures between 
countries, leading to unconstructive work. A coordinated platform for the whole 
of Europe in managing a pandemic (not only CT data, but related data pertaining 
to vaccination status and testing) would facilitate the exchange of data.  
•  One country reported that the EWRS worked well for them, as there was a 

relatively low number of messages that had to be sent. There were doubts about 
the usefulness of passenger lists, this country had websites that published flights 
that were carrying cases. 

•  Two countries reported that EWRS was a good tool to use in the future, one 

country reported that EWRS and secure email worked fine during ‘normal’ times. 

•  One country had not made use of any digital tools, they reported that a CT 

digital tool would be helpful in the future. 

•  Many countries mentioned that cross-border CT may only be effective at certain 
stages during the pandemic, mainly at the beginning when the case numbers are 
still low. Later on in the pandemic, there is not more added value to cross-
border CT. 

•  One country mentioned that high volume cross-border CT hindered other work 

of the NFP. 

•  One country reported that cross-border CT is time-consuming, while its effect on 

mitigating infectious diseases is unclear. 

•  One country concluded that if CT is not possible at the national level, it will also 

not be needed at the international level. 

•  One country mentioned there is little evidence for the effectiveness of cross-

border CT, especially during peak times, and that the threshold for conducting 
cross-border CT in the future will likely be higher. 

•  One country concluded that cross-border CT will not affect the course of the 

pandemic at all during peak times. 

•  Recommendations regarding feasibility and effectiveness of cross-border CT 

need to be revised. 

(3) Ensure there is 
sufficient human 
resource support 

(4) Good CT 
practices are 

•  Many countries mentioned the importance of having sufficient human resources 

in place in the future.  

•  Several countries mentioned the importance of having a trained workforce that 

is readily deployable when the time comes.  

•  Most countries reported the delay in receiving contact tracing whether through 
the EWRS or through passenger lists as being an obstacle to being able to carry 
out CT on time. 

111 

 
 
 
 
 
Feasibility study on digital technology for cross-border contact tracing 

needed to reduce 
delay 

(5) Clear 
agreements are 
needed on what 
cross-border CT 
information is 
needed 

(6) Good 
collaboration with 
cross-border 
countries and 
regions is needed 

(7) Action plans 
and procedures 
should be in place 

•  On passenger data: countries reported issues around passenger data, there were 
delays in obtaining passenger data from airlines. When the contacts were finally 
identified, it was often too late to carry out CT.  

•  One country mentioned that passenger CT is a challenge, as it was not always 
clear whether the transmission occurred during exposure during the journey.  
•  One country suggested that for the future, the collaboration with international 

public health transport (airline companies, trains, buses, etc.) should be 
facilitated.  

•  One country reported that were technical challenges in accommodating 
foreigners without Danish citizen-ID into their technical infrastructure. 

•  One country mentioned that for the future, population needs and new threats 

should be constantly mapped and there should be a greater focus on fragile and 
vulnerable populations. 

•  To increase effectiveness and efficiency of cross-border CT, countries reported 
the importance of clear agreements on what cross-border CT information is 
needed.  

•  One country mentioned that the EWRS would ideally be a platform for use, as 

opposed to solely for sending free texts and excel sheets.  

•  One country stated that a standardised set of data categories for MS, would 

improve the quality of cross-border CT. 

•  One country mentioned that it was unclear what other countries did with the 
information they had sent. Likewise, they did not always do anything with 
information they had received from abroad. 

•  One country stated that they would appreciate an obligation by countries to 

handle CT data in a timely manner. 

•  One country also recommended a harmonised platform in Europe to facilitate 

the exchange of all types of data (e.g., vaccination status, test results, etc.). They 
also recommended implementing common best practices at the regional level. 
•  Several countries underscored the importance of establishing good relationships 

with other regions and countries.  

•  One country set up notification channels with neighbouring EU countries. 

• 

Customs treaty allowed exchange of important CT information pertaining to 
their citizens with a neighbouring non-EU/EEA country. 
In one country, a centre was established in their CT management organisation 
and a MoU (Memorandum of Understanding) was agreed upon with a 
neighbouring country outside of the EU, leading to smooth cross-border CT. 
•  Some countries reported it would be good to invest in health infrastructure, 

such as trained staff and facilities and to have IT solutions in place.  

•  Two countries mentioned the importance of having cross-border action plans 

and procedures in place.  

112 

 
 
 
 
 
 
In person 

GETTING IN TOUCH WITH THE EU 

All over the European Union there are hundreds of Europe Direct information centres. You can find the 
address of the centre nearest you at: https://europa.eu/european-union/contact_en 

On the phone or by email 

Europe Direct is a service that answers your questions about the European Union. You can contact 
this service: 

– by freephone: 00 800 6 7 8 9 10 11 (certain operators may charge for these calls), 

– at the following standard number: +32 22999696, or  

– by email via: https://europa.eu/european-union/contact_en 

FINDING INFORMATION ABOUT THE EU 

Online 

Information about the European Union in all the official languages of the EU is available on the Europa 
website at: https://europa.eu/european-union/index_en 

EU publications 

You can download or order free and priced EU publications from: https://op.europa.eu/en/publications. 
Multiple copies of free publications may be obtained by contacting Europe Direct or your local 
information centre (see https://europa.eu/european-union/contact_en). 

EU law and related documents 

For access to legal information from the EU, including all EU law since 1952 in all the official language 
versions, go to EUR-Lex at: http://eur-lex.europa.eu 

Open data from the EU 

The EU Open Data Portal (http://data.europa.eu/euodp/en) provides access to datasets from the EU. 
Data can be downloaded and reused for free, for both commercial and non-commercial purposes. 

 
 
 
 
ISBN 978-92-95224-58-2