Privacy checklist for an app

Before you start

1. You know what you want to use the app for. Write the purpose down in one sentence, for example: “My client keeps track of how he sleeps, so that we can talk about it every week.” After all, you only collect data for a purpose you have clearly decided on beforehand. With that one sentence, you can judge at the other points whether the app asks for more than it needs.

2. You know who makes the app. Look up the name and contact details of the maker, for example in the app store or on the app’s website. If your client has a question or complaint about their own data, it goes to the maker first. If they cannot sort it out together, your client can make a complaint to the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority.

3. You get the app from a reliable store. Install apps from, for example, the Google Play Store or the Apple App Store. Note: the privacy risks of apps apply just as much to apps you pay for, so a price says nothing about how safely an app handles data.

4. There is a privacy statement that you understand. It says which data the app collects, why, and whether the maker shares or sells it. Such a statement must not be too long or complicated. You can often read it before you download the app, and some app stores show a summary. Can you not find the statement, or is it unclear? Then look for another app.

What data the app asks for

5. The app only asks for data it needs. An app for keeping track of your mood, for example, does not need your contacts or your location. If the app asks for them anyway, that is a reason to look further or to choose a different app.

6. The app asks for permission separately for each type of data. Contacts, photos and location, for example, are each a separate type. The app must ask before it takes that data from the phone. In the phone’s settings you can turn that access off again later, even after the app has been installed.

7. Your client does not have to log in with a social media account. Logging in everywhere with the same account is easy, but it sometimes spreads and links data without need. If a separate account is possible, choose that instead.

8. You know whether health data will go into the app. Data about how someone feels mentally counts as health data too. Processing such data is forbidden, unless the law makes an exception for it. That is why stricter rules apply, and why the rest of this list is extra important.

9. The app does not pass data on to advertisers. Some apps track what you do and share that with, for example, advertisers. Check in the privacy statement whether the maker shares or sells data, and with whom. If it only says “with partners”, ask the maker who they are.

Where the data stays

10. You know where the data is stored. Is it only on the phone, or with the maker too? And is that inside or outside the European Economic Area (EEA)? Outside the EEA, the data may fall under other laws.

11. The app protects the data. That is about technology, such as encryption, but also about the arrangements at the maker: who has access to the data? If an app sends data over the internet without encryption, others can intercept it.

12. The app does not keep data longer than needed. The longer data is kept, the bigger the consequences of a data breach can be. Look in the privacy statement for how long the maker keeps data. If it does not say, ask.

13. Your client can stop and have the data deleted. A good app lets you withdraw your consent, delete the app and erase the data it collected. Withdrawing consent must be just as easy as giving it. Can you give consent with one tap, but do you have to phone or send a letter to withdraw it? That is not allowed.

Arrangements in your organisation

14. You know who puts the data into the app. Does your client use the app only for themselves? Or does your organisation put client data into it? In the second case, your organisation decides what the data is used for and how, so your organisation is then responsible and has to arrange more.

15. There is a data processing agreement if one is needed. Does the maker work with client data on behalf of your organisation? Then a data processing agreement is required: a contract about what the maker may do with the data. You can read what should be in it in The AVG (GDPR) in care and support.

16. The data protection officer (in Dutch: functionaris gegevensbescherming, FG) knows about it. The FG gives advice on privacy. Also ask the FG whether a privacy assessment is needed, a data protection impact assessment (DPIA). The rule of thumb is: a DPIA when two or more of nine risk criteria apply. Health data and data about vulnerable people, such as patients, together already make two.

17. You know what to do in case of a data breach. Do you send data to the wrong person? Or do you lose a phone with data that is not encrypted? Those are data breaches, so report it straight away within your organisation. Your organisation must report some data breaches to the AP within 72 hours, and sometimes also to the people concerned.

Together with your client

18. Your client knows what the app does with the data. Explain it in plain words. Also say what your client needs to be able to do, what it costs, what risks or downsides there are and what the other options are. Care providers and youth care providers are expected to do this too, so that the client can make a good choice.

19. Your client chooses freely. Your client must be able to say no without any disadvantage. Pay attention to the relationship between you, because patients, for example, cannot always freely say yes or no. So say clearly that the support will simply continue if your client does not want the app, and that you will then look for something else.

20. If you work with children, you take extra care. If consent is the basis, a child under 16 cannot validly give it themselves: a parent or carer does that. A child aged 12 or over may, however, withdraw that consent themselves. The app also may not use children’s data for advertising aimed at them, and the explanation of the app must suit their age, in simple language.

Points to watch

• Do not use the app yet if you cannot tick a point. First sort it out with your FG, or choose a different tool. This list is not legal advice.
• Do not ask for consent just to be on the safe side. The law often already sets out which data a care professional may record, and extra consent makes things needlessly complicated. Your FG knows what applies in your situation.
• Also look at what happens around the app. A safe app does little good if a report about it then ends up in an ordinary email or a chatbot. Make agreements about this in your team.
• Check again after a big change. For example when the app gets a new version with new features, or when another party takes over the app. An app may not change the purposes it uses your data for along the way without your consent.

Find out more

• The AVG (GDPR) in care and support: the privacy rules in plain words, and what you do every day to keep data safe.
• Choosing a digital tool for your client: privacy is one of the things you look at.
• Try out the list on an app you already know. For example Moodnu, our app for keeping track of how you feel.