Privacy campaigners call for radical changes to contact-tracing app

Campaigners from across a diverse range of civil society groups have called on the government to put in place privacy protections for its NHSX Covid-19 contact-tracing app – so it can gain the trust of marginalised groups, ethnic minorities and immigrants – or scrap the project and start over.

Foxglove, the Joint Council for the Welfare of Immigrants (JCWI), Liberty, Medact, the Open Rights Group and Privacy International have all co-signed a letter calling on the government to either switch from the currently planned centralised data processing model (where the data is sent to NHS servers for processing) to a decentralised one (where the processing is done on user devices) or introduce more robust legal and technical safeguards in the existing model.

“The NHSX app won’t work unless people trust it. Marginalised groups and individuals need to be persuaded they can trust the app, but the government has done nothing to gain their confidence. The result is that the app will be less useful in reducing infection than it could be,” said the Open Rights Group’s executive director, Jim Killock.

The government has so far refused to countenance introducing legislation to guarantee data protection – rejecting a proposed bill drawn up by the cross-bench Joint Committee on Human Rights. According to health secretary Matt Hancock, a mix of existing data protection law and trust that his personal assurances about security can be taken seriously are perfectly adequate.

The campaign groups said that as things stand, a range of groups and individuals in precarious situations might be unable or unwilling to risk using the contact-tracing app. Some may simply lack access to mobile technology or, through financial hardship, still be using older devices that cannot support the app; others may be socially excluded or otherwise marginalised; while others, such as recent immigrants into the UK, may be reluctant to interact with government technology given risks around how the data might be used.

Antonella Napolitano from Privacy International said: “Contact tracing can be part of an effective response to Covid-19, but can also give unprecedented capability to the government.

“The hostile environment policies have eroded overall trust between ethnic minorities, migrant communities and the Home Office, and those groups are disproportionately affected because of their existing social, economic and legal contexts.

“We need transparency and guarantees that data shared through the contact-tracing app will not be used for immigration enforcement, in order to make this app trustworthy by these communities,” she said.

Gracie Bradley from Liberty added: “The government has given the most marginalised in our communities repeated reasons not to trust it with their data. It has a record of sharing health, education and police data with immigration enforcement and so an app with such severe privacy issues is particularly worrying.

“For the wider public, perhaps the concerns are less clear because we simply don’t know what is happening to our personal information. This is why we all deserve tech which prioritises privacy.

“This initiative will only work with public trust, and to earn that we need to see firm legal protections guaranteeing our personal information is safe and will only be used for the very specific public health demands of this pandemic,” said Bradley.

The contact-tracing app was supposed to have launched more widely today (1 June), and last week the government rushed the launch of the wider Test and Trace programme without Public Health England (PHE) having completed the required data protection impact assessment (DPIA).

The government was subsequently accused of attempting to distract from prime minister Boris Johnson’s refusal to sack his advisor, Dominic Cummings, for flagrant breaches of the lockdown regulations he helped draw up.

PHE has now been contacted by the Information Commissioner’s Office (ICO) in regard to this, which the ICO confirmed via Twitter.