Press release

TECNALIA launches COVID-19 contact tracking system that safeguards user privacy

12 May 2020
  • The TECNALIA research and technological development centre, part of The Basque Research and Technology Alliance (BRTA) is currently pioneering a pilot system in Spain, in partnership with Ibermática.
  • Trialling commenced in the TECNALIA environment this week. The results will be made available to the Basque Government Department of Economic Development and Infrastructures for incorporation into PRAP-Euskadi Project for the Reactivation of Business Activity.
  • The system makes intensive use of cryptography and data decentralisation to maintain user privacy, revealing no personal data to central servers.

10 May 2020. According to an article published in Science magazine on 31 March, a combination of automatic and manual contact tracking is currently the most efficient means of helping to stem the spread of coronavirus. Knowing where each new positive has been and with whom they have been in contact gives the authorities key information to break the chain of infection. The challenge faced when using system-based rather than manual tracking is to guarantee data privacy and control, making them suitable for public rollout.

With this in mind, the TECNALIA research and technological development centre, partnering with IT firm Ibermática, is developing an early detection system that maintains user privacy, to help flatten the curve of infection and prevent future outbreaks by means of tracing infected persons and their contacts. Trials using mobile phones are already being carried out in this project, a pioneer in Spain.

“These tools are undeniably more effective than memory or manual processes. We cannot know who we have been sitting next to on public transport, for example, but these apps can. We need to come up with effective automatic tools which also guarantee user privacy and implement them as soon as possible within society” says Oscar Lage, head of Cybersecurity at TECNALIA.

While exposure is currently tracked manually, following WHO procedures, the present situation demands digital systems to help control the spread of the virus. Accordingly, the system being developed by TECNALIA and Ibermática is based on the DP-3T protocol, which allows early detection of exposure and is thus more effective in determining which asymptomatic persons should be tested, at the same time maintaining their privacy by ensuring that data is used only to establish which people have been exposed to COVID-19. In April, tech giants Apple and Google added DP-3T to their smartphone operating systems, helping to expand its use as an exposure detection system incorporating strict privacy criteria.

The DP-3T protocol is a European initiative headed by the Swiss Federal Institute of Technology (ETH). It is currently on the development stage at centres throughout Europe, including TECNALIA, which has started its testing within the centre just this week. The results will be forwarded to the Department of Economic Development and Infrastructures of the Basque Government, to be extended to PRAP-Euskadi companies in a second phase. This will be a major step towards its scalability and generalised use, as support for the testing and tracking activities of the managing authorities.

Cryptography and decentralised data, core elements

This technology makes intensive use of cryptography and data decentralisation to maintain user privacy, revealing no personal information to central servers where it could be used for other purposes. On the contrary, the system proposed by TECNALIA and Ibermática stores and processes all information on users’ own devices; to further ensure user privacy, it also stores no GPS data.

The system uses mobile Bluetooth and new, more comfortable wearable formats, such as bracelets, are also being explored. It will initially run on Android, while an iOS version is also being contemplated. Users just have to ensure that the system is active, and will be able to switch monitoring on and off at will. Those who test positive for COVID-19 can use the app to report their status. Other users of the app to whom they have been in contact will be immediately informed and may then isolate and contact the health authorities for testing. The system also incorporates a verification code, so users cannot report being infected unless they actually are.

TECNALIA is also exploring further features, including one that will allow users to voluntarily share aggregated data from their devices, for analysis by researchers. A further challenge will be to design and implement a protocol that will allow the app to operate across similar platforms, ensuring that user contacts are protected independently of which app they use.

TECNALIA and Ibermática are developing this technology as part of the OptiDiC Diagnosis and Control Optimisation System, a research support initiative under the framework of the Basque Government Department of Economic Development and Infrastructures' COVID-19 emergency measures.


As part of the BRTA (Basque Research and Technology Alliance), TECNALIA is a benchmark Research and Technological Development Centre for Europe, with 1,400 professionals representing 30 different nationalities, focusing on transforming technology into GDP to improve people's quality of life, by creating business opportunities for companies. Its key scopes of action are: Digital Transformation, Advanced Manufacturing, Energy Transition, Sustainable Mobility, Urban Ecosystem and Health.