This post is part of a series on contact tracing apps. You can read our introduction to the series and get links to the other entries here.
As the UK government searches for a way to safely lift COVID-19 restrictions, increasing attention is being paid to a strategy of widespread contact tracing. This approach relies on the use of mobile phone applications by large numbers of the population.
We have blogged previously on how these contact tracing apps are intended to work. If these apps become as ubiquitous as the government’s strategy will require, then their use will create opportunities and pose challenges for businesses of all shapes and size.
The UK’s approach so far
On 12 April 2020, Matthew Hancock, the Minister for Health and Social Care and the politician directly responsible for the NHS, announced that the NHS was developing a mobile app that will allow for contact tracing. The app is being developed by NHSX, a specialist unit responsible for digital transformation in the NHS.
Although the exact functionality of the app has not been announced, it is expected to have a similar level of functionality to apps being developed in other jurisdictions. Matthew Gould, Chief Executive of NHSX, has confirmed that the app will anonymously log how close you are to other people who also have the app. If you become unwell you can choose to allow the app to inform the NHS. This will trigger an anonymous alert to those other app users with whom you came into significant contact over the previous few days, allowing them to self-isolate and inform people they have come into contact with.
Researchers from the Big Data Institute at the University of Oxford have been actively advising NHSX on the functionality of the app. In a report published on 14 April, they assessed the different feature configurations that the app could have and modelled the impact on the spread of COVID-19. They found that, regardless of the exact feature set, use of a contact tracing app substantially reduced new cases, hospitalisations and ICU admissions.
But there were two key constraints for the app to be effective: 80 per cent or more of the UK population who own a smartphone need to download it, and the UK needs to test more than 100,000 people a day. This is because contact tracing relies on large numbers of citizens partaking and certainty that those who show symptoms have COVID-19. The researchers noted that both constraints may be challenging to overcome.
The regulator’s reaction
The UK Information Commissioner, Elizabeth Denham, has been supportive of the development of contact tracing. On 17 April she stated that “data protection laws [should] not get in the way of innovative use of data in a public health emergency – as long as the principles of the law (transparency, fairness and proportionality) are applied. The same approach applies to the use of contact tracing applications.”
The Information Commissioner’s Office has laid out six questions that developers of a contact tracing app should consider:
- Have you demonstrated how privacy is built in to the processor technology?
- Is the planned collection and use of personal data necessary and proportionate?
- What control do users have over their data?
- How much data needs to be gathered and processed centrally?
- When in operation, what are the governance and accountability processes in your organisation for ongoing monitoring and evaluation of data processing – to ensure it remains necessary and effective, and to ensure that the safeguards in place are still suitable?
- What happens when the processing is no longer necessary?
In response to the Information Commissioner’s approach, NHSX has stated that they are prioritising security and privacy in all stages of the app’s design. They are planning to publish their security designs and the source code of the app to demonstrate this. Furthermore, they have confirmed that all data gathered by the app will only be used for NHS care, management, evaluation and research, and that individuals will be able to delete the app and their data at any point.
What comes next and how businesses can prepare
NHSX is planning to release the app in the next few weeks. Until then, businesses will need to consider the possible ways these apps could impact their operations. We explore this in more detail in upcoming posts.
Other posts in this series:
- Round 1: What’s happening?
- Round 2: Legal considerations for companies that want to use contact tracing
- Round 3: Are companies required to use contact tracing?
