Covid-19, Contact Tracing and GDPR

Provisions recently issued relating to the Covid-19 pandemic spread emergency showed a considerable impact (also) about personal data processing and, consequently, on the right to their protection. Among the measures adopted (in several countries, including Italy) to cope the pandemic emergency, there are those based on collection and tracking of personal health data in order to control and contain the virus and in particular the so-called "Immuni" app, involving, prima facie, an invasive control in people's lives: hence, once the terms and characteristics of this tracking system have been reconstructed, the need to identify its legal basis in light of the General Data Protection Regulation (GDPR) and, in the event of a positive outcome of this assessment, the guarantees capable to ensure the necessary balance between the protection of public health and the protection of the private sphere from excessive compression or intrusiveness.