EU warns no compromise on privacy as NHS clashes with tech firms on contact tracing

Less than two days after Apple and Google announced a partnership to accelerate contact-tracing technology to control the spread of the Covid-19 coronavirus, and in a huge boost to their efforts, the Silicon Valley giants have fallen foul of regulations form the UK’s National Health Service (NHS) and the European Union.

In joining in the fight against coronavirus, the two firms announced on 14 April that their software developers would contribute by crafting technical tools to help governments and health agencies reduce the spread of the virus, with user privacy and security central to the design.

The combined Apple and Google solution includes application programming interfaces (APIs) and operating system-level technology to assist in enabling contact tracing.

Given the urgent need for a solution, the companies plan to implement this solution in two steps while maintaining strong protections around user privacy.

First, in May, both companies will release APIs that enable interoperability between Android and iOS devices using apps from public health authorities. These official apps will be available for users to download via their respective app stores.

Second, in the coming months, Apple and Google will work to enable a broader Bluetooth-based contact-tracing platform by building this functionality into the underlying platforms. The two companies noted that this is a more robust solution than an API and would allow more individuals to participate, if they choose to opt in, as well as enable interaction with a broader ecosystem of apps and government health authorities.

Given the nature of the project and of the information that the mobile devices would be carrying, Apple and Google emphasised that privacy, transparency and consent were of utmost importance in their efforts, and that they looked forward to building this functionality in consultation with interested stakeholders.

However, the key interested stakeholders in both the UK and EU have raised red flags to the joint project.

In the UK, and as reported by The Guardian, the NHS has voiced concerns that the Apple/Google solution would go against its own plans for contact tracing, namely that by only informing an individual of being in contact with an infected person, and not informing a central registry, it would not be possible for the health authority to gain a clear picture of the spread of Covid-19 throughout the UK.

The UK government has already contacted the nation’s telcos about the possibility of using location data for this end. The Apple/Google API would strictly limit the information that public health authorities can gather and would not let the public health authority ask a phone to gather a list of every other phone it has been in contact with.

Privacy issues also reared their head in the EU where, as part of a common coordinated approach to support the gradual lifting of confinement measures, Member States, supported by the European Commission (EC), announced the development of a toolbox for the use of mobile applications for contact tracing and warning in response to the coronavirus pandemic.

The EC added that since the outbreak of the coronavirus pandemic, it had been assessing the effectiveness, security, privacy, and data protection aspects of digital solutions to address the crisis.

It stated that contact tracing apps, if well-coordinated and fully compliant with EU rules, can play a key role in all phases of crisis management, especially when time will be ripe to gradually lift social-distancing measures.

Yet it stressed that such solutions needed to be fully compliant with the EU data protection and privacy rules, following consultation with the European Data Protection Board, and should be implemented in close coordination with, and approved by, public health authorities.

In launching the toolbox, and in a clear message to the technology firms, the European Commissioner for Internal Market, Thierry Breton, stressed that strong privacy safeguards were a prerequisite for the uptake of the apps and their usefulness.

“Contact-tracing apps to limit the spread of coronavirus can be useful, especially as part of Member States’ exit strategies. While we should be innovative and make the best use of technology in fighting the pandemic, we will not compromise on our values and privacy requirements,” he said.