The government’s plan to abandon its own app and integrate into the model designed by Apple and Google for tracking and tracing cases of COVID-19, is a step in the right direction on privacy, However, there is more that can be done to ensure that the track and trace app does not implicate human rights.
Few countries have managed to keep the spread of COVID-19 under control, however, one of the key tools that several countries have used is contact tracing. This has allowed countries to track down exposures after an infected individual is identified. Contact tracing via mobile applications in particular, has been very common. The means of enabling contact tracing via mobile apps have varied across the globe. Legislation was passed in Israel permitting the government to monitor the mobile-phone data of citizens with a suspected infection. Relatively early in the spread of the virus on 20th March, the government of Singapore released an app called TraceTogether using Bluetooth to track when two users have been in close proximity. When a user reports in the app that they have tested positive for COVID-19, the app allows Singapore’s Ministry of Health to determine anyone who has been in their proximity. Following this, a designated contact tracer calls those contacts to notify them and inform them of appropriate follow-up actions.
Singapore’s app was one of the first of its kind and exemplified the privacy concerns that these apps bring. Whilst the privacy of users is kept confidential from one another, it is not protected from government access.
While the app uses Bluetooth as opposed to GPS location tracking, meaning it does not gather more information than necessary to build a database of contacts, it makes no attempt to conceal information from the Singaporean government. When a user is diagnosed with COVID-19 and gives their data over to the Ministry of Health when prompted, the government can retrieve the mobile numbers of all individuals that user has been in contact with. Therefore, neither the diagnosed user, nor the exposed contacts, maintain privacy from the government.
In the UK, we are still in the development phase of our app. The NHS’s innovation arm, NHSX, has been developing its own app in collaboration with Oxford University researchers to track the spread of the virus. The project encountered several technical issues last month as it was revealed
that the app was only logging one in 25 contacts between people when it was used on iPhones.
Following these technical issues, the government has now opted for the model developed by Apple and Google, storing data on people’s phones, rather than on a centralised database. Other countries that have taken this approach include Austria, Germany, Ireland, and Switzerland. The way that these apps will work is in the following 4 stage process:
The main difference with what NHSX was developing and the above, new process, is that data from the contact-tracing app remains in each user’s phone. The government had hoped that in their app they would be able use this data for research, however, Apple and Google's model prohibits this from taking place.
In the past month the UK’s app has been pushed far down the agenda of the Government’s actions on the virus. Lord Bethell, the Parliamentary Under-Secretary of State for Innovation, who is responsible for the NHSX app, stated on 17th June that the app would not be ready until winter and
is not currently a priority.
While protecting human life and public health is a paramount concern, it is the duty of the Labour party to be mindful that, as Human Rights Watch has stated, “the long history of emergency measures, such as surveillance measures put in place to counter terrorism, shows that they often
go too far, fail to have their desired effect, and, once approved, often outlast their justification.”
LCHR recommendations
- The UK’s application must store data on the phones of users, not on a centralised database.
- The government should ensure that the 8 conditions for digital surveillance outlined by over 100 civil society groups at the start of April are adhered to.
- That as currently planned, the app does not track GPS signals.