NHSX must be ‘upfront’ about contact-tracing app, privacy group says

NHSX needs to be “upfront” about their plans for a coronavirus contact-tracing app and how it will be used, privacy group medConfidential has said.

Sam Smith, coordinator at the group, told Digital Health News that NHSX would not “get away without people noticing” if they altered the intended purpose of the app after it’s released.

“To gain public acceptance, the app will have to be completely upfront with patients and users about what it won’t do, and then stick to it,” he said.

It comes after The Guardian reported on a draft government memo suggesting ministers could be given the power to request the “de-anonymisation” of data put into the NHS coronavirus contact-tracing app. The report also suggested the app could make use of existing functions on people’s phones, like Google Maps, to trace them.

The app, developed by NHSX, is set to be trialled in the North of England. It would allow people to input their own symptoms, alerting anyone they have come into contact with that they may have been exposed to the virus. NHSX has not provided further detail on the pilot.

Health Secretary Matt Hancock said in the April 12 coronavirus press briefing that the app would enable people to anonymously share their data, but according to The Guardian a government document labelled “draft – not yet approved” suggests the NHS has considered identifying users.

The March memo detailed how the app could work using Bluetooth to trace people’s movements and alert them if they may have come into contact with someone reporting symptoms.

However, the memo also suggested that “more controversially” the app could use device IDs to “to enable de-anonymisation if ministers judge that to be proportionate at some stage”, the Guardian reported.

It did not detail under what circumstances such a move would be deemed appropriate.

NHSX denied plans to de-anonymise data put into the app.

“There have never been plans to make use of existing apps and other functions already installed on peoples phones such as Google Maps and neither have there been plans to look to use the device ID of users in any app based solutions,” they said.

Smith added: “The app will do whatever NHSX wants it to do and right now that is contact tracing, however when there was a question of ‘Well what else will the app do?’ the answer was ‘We are not planning to do anything’.

“Which is entirely true, they’re not saying they’re currently planning to do anything like immunity certificates from the app. That doesn’t mean they can’t, it just means they have no current plan.

“Our position on contact tracing is there’s a good way to do it and there’s a stupid way to do it. We would prefer them to do it the good way but if they’re going to do it the stupid way we will say very loudly ‘it’s stupid’.”

Pointing towards Apple and Google’s new partnership to develop contact-tracing technology, firstly releasing APIs to enable interoperability on iOS and Android, Smith said it goes some way to resolving what would be a bad approach for the NHS to take.

“The older NHSX approach depends upon an app which you would have to keep on screen at all times that you wanted the app to work – you couldn’t do anything else with your phone; battery issues entirely aside, staring permanently at a list of possible exposures is not an approach that will reduce anxiety on the morning commute,” he said.

“The new Google and Apple API solves all those issues, so users would setup the app once, and forget about it until they either show symptoms or get a notification that they should consider taking a specific action.”

Digital Health News understands the NHS app is using Bluetooth technology to trace people reporting symptoms, but is awaiting official confirmation.

The use of Bluetooth is a far less controversial route to take when developing an app as the technology is a standard feature that runs on a smartphone, already taking snippets of information from nearby phones throughout the day.

Apple and Google are also set to create a Bluetooth-based contact tracing platform, built into their underlying platforms.

Questions remain over the effectiveness of contact tracing apps, however. A team at Oxford University, who are advising NHSX on the app, have suggested current contact tracing technology is too slow to keep up with the virus.

Instead, they recommended a mobile application that forms part of an integrated coronavirus control strategy that identifies infected people and their recent person-to-person contacts using digital technology.

But Ross Anderson, a professor at Cambridge University, has suggested the use of such apps could be unreliable as they require large numbers of the population to use them and to input their symptoms correctly.

“Anyone who’s worked on abuse will instantly realise that a voluntary app operated by anonymous actors is wide open to trolling,” he wrote.

Digital Health News has asked NHSX for more information on how the app will work and when they expect a pilot to be rolled-out across the country.