S.L. 465.52 Art. 10Data that shall be processed.  

(1) The following data shall be processed under this order:

(a) in a user terminal:

(i) rotating proximity identifiers;

(ii) approximate timestamps; and

(iii) temporary exposure keys used to generate rotating proximity identifiers; and

(b) where a user voluntarily records an infection under article 7:

(i) the authorisation code verifying the infection;

(ii) the date on which the first symptoms of the COVID-19 virus appeared or in the event of an asymptomatic infection the date of the test;

(iii) the time period in which the data shall be erased;

(iv) the transmission risk level according to the parameters and specifications pursuant to article 9;

(v) the temporary exposure keys of the infected user which were in place during the period which infection of other persons is likely to have occurred; and

(vi) the date of creation of each temporary exposure key; and

(vii) A list of country codes in accordance to the user’s choices; and

(c) where there is contact between user terminals:

(i) the rotating proximity identifiers broadcast from one terminal to another. There is no direct link that identifies the users of the other terminals;

(ii) the proximity between user terminals;

(iii) approximate time window; and

(iv) the estimated duration of proximity.

(d) in the European Federation Gateway Service:

(i) the temporary exposure keys, each key combined with the key date and list of countries of interest including the country of origin, of infected users who have carried out positive infection verification, and which keys were sent by the infected users’ national contact tracing and warning mobile applications and where the date of each key is fourteen (14) days or less than the users’ infectivity date determined by the individual users’ national health authority;

(2) The data mentioned in paragraphs (a), (b) and (c) of sub-article (1) shall be permanently deleted after the lapse of fourteen

(14) days from the date when such data is captured or uploaded, as the case may be, and the data mentioned in paragraph (d) of sub-article (1) shall be permanently deleted after the lapse of seven (7) days from the date when such data is uploaded to the European Federation Gateway Service:

Provided that the data stored on the central server referred to in paragraph (b) and the data stored on the European Federation Gateway Service referred to in paragraph (d) of sub-article

(1) shall be retained for an additional seven (7) days for backup purposes.