Read the Act!
'Levy [... goes on: "Nothing identifying and no personal data are taken from the device or the user."'
Clearly Levy has either not read, not understood, or refuses to honour the GDPR definition of personal data. Any data at all from which a living person can be identified is personal data under the GDPR.
The irony is that, given the circumstances (epidemic control) the regulation gives him a free hand - he doesn't have to justify the collection of personal data for this purpose.
These constant "assurances" from government about privacy suggest that they know they're on shaky ground. It's worth remembering that the GDPR is human rights law, and that the European Declaration of Human Rights was created to protect the public from governments, not from social media behemoths. Unfortunately, almost from day one, it's failed to do so, because governments can award themselves exceptions to the controls.
Quite apart from which, this looks like just another failed government IT project in the making. It would be great if once in a while a little technical competence and forethought were injected into the picture.
Biting the hand that feeds IT
