Feature: NHS COVID-19 app privacy concerns

Privacy organisations are calling on the government to clarify how NHS COVID-19 app users’ private data will be kept secure.

The app, which advises people to self-isolate if they have been in close contact with a confirmed case, launched today (September 24) and is available to those aged 16 and over in multiple languages.

From today, certain businesses in England are required by law to display NHS Test and Trace QR codes so customers with the NHS COVID-19 app can use them to check-in.

However, a spokesman for privacy organisation Big Brother Watch said the government has so far failed to provide a public Data Protection Impact Assessment (DPIA) or explain how pubs and bars are to legally and securely collect and store the personal details of their customers.

The spokesman said, as a result, it appears likely that customer information may not be handled safely, legally or competently. Ad hoc collection has already come under criticism for being abused for unlawful advertising purposes and even harassing customers.

Silkie Carlo, director of Big Brother Watch said: ‘This law could easily lead to the mass recording of our movements and there is a serious question as to whether this is safe and lawful.

‘The government’s new approach to contact tracing is no longer based on public trust, but on exclusion, criminal sanctions and police enforcement.

‘Many people will be rightly shocked to find they’re refused entry to coffee shops and restaurants unless they use the NHS COVID-19 App or hand over their personal contact details.

‘Businesses won’t be able to comply with this draconian new diktat as well as data protection law and many will be fearing sanctions. This is an excessive law that poses a serious risk to privacy and data rights.’

Privacy organisations the Open Rights Group (ORG) and Big Brother Watch instructed data rights agency AWO to send a legal letter to the health and social care secretary, Matt Hancock, demanding the government provide information on how users’ data will be kept safe and secure.

The letter also asks whether the government has conducted a Data protection impact assessments for the Test and Trace programme as, back in July, the government admitted that the Test and Trace programme has been operating unlawfully from the beginning.

This was due to its failure to produce a legally required data safety assessment, a spokesman for Big Brother Watch said.

Data safety assessments

Jim Killock Executive director of Open Rights Group said: ‘The government’s first duty is to protect its citizens. This government’s reckless behaviour is once again endangering public health.

‘We have long argued that the government’s test and trace programme must be trusted by the public in order to effectively protect us from COVID-19.

‘This government’s failure to conduct the legally required data safety assessment means that no one knows how people’s details will be safely and legally collected, stored and protected by bars, restaurants, and coffee shops.

‘No one knows what will happen if things go wrong and this government doesn’t seem to have thought this through.

‘This government has had six months to fix the test and trace programme and on the eve of the launch of this App one thing is for certain; this government is flying by the seat of its pants.’

A DHSC spokesman said the app has been designed with user privacy in mind, so it tracks the virus, not people, and uses the latest in data security technology to protect privacy.

The system generates a random ID for an individual’s device, which can be exchanged between devices via Bluetooth (not GPS). These unique random IDs regenerate frequently to add an extra layer of security and preserve anonymity.

The spokesman said the app does not hold personal information such as the users’ name, address or date of birth, and requires the first half of their postcode to ensure local outbreaks can be managed. No personal data is shared with the government or the NHS.

The contact tracing element of the app works by using low-energy Bluetooth to log the amount of time people spend near other app users, and the distance between them, so it can alert users if someone they have been close to later tests positive for coronavirus, even if they don’t know each other.

Invisible killer

Health and social care secretary Matt Hancock said: ‘We are at a tipping point in our efforts to control the spread of this virus. With infection rates rising we must use every tool at our disposal to prevent transmission, including the latest technology.

‘We have worked extensively with tech companies, international partners, and privacy and medical experts, and learned from the trials, to develop an app that is secure, simple to use and will help keep our country safe.

‘Today’s launch marks an important step forward in our fight against this invisible killer and I urge everyone who can to download and use the app to protect themselves and their loved ones.’

The NHS Test and Trace team worked with major tech companies, including Google and Apple, following a failed attempt to develop its own software earlier this year.

In a joint statement, Apple and Google said: ‘We built the exposure notifications system to enable public health authorities in their efforts to develop apps to help reduce the spread of the virus while ensuring people can trust in the privacy-preserving design.

‘We are committed to supporting the government’s effort to launch an app based on this technology.’

Dido Harding, executive chair of England’s NHS Test and Trace Programme, said: ‘We want to make it as easy as possible for everyone to engage with England’s NHS Test and Trace service.

‘The NHS COVID-19 app enables the majority of people with a smartphone to find out if they are at risk of having caught the virus and need to self isolate, order a test if they have symptoms, and access the right guidance and advice.

‘The features of this app, including QR code check-in at venues, work alongside our traditional contact tracing service and will help us to reach more people quickly in their communities to prevent further spread of the virus.

‘This is a welcome step in protecting those around us.’

Photo Credit – DHSC