NHSX sets up ethics advisory board to oversee contact-tracing app

NHSX has established an ethics advisory board to oversee the development of it’s Covid-19 contact-tracing app.

In a blog post its chief executive, Matthew Gould, said the organisation had “prioritised security and privacy in all stages of the app’s development” from initial design to user testing.

The advisory panel will be led by Professor Sir Jonathan Montgomery, of University College London. Montgomery was previously head of the Nuffield Council on bioethics.

“We are also taking technical assurance very seriously, with an independent assurance board ensuring that the app we deliver will be stable, resilient, secure, performance, highly usable and above all effective in the fight against Covid-19. The assurance board includes experts in mobile apps, data governance and clinical safety,” Gould wrote.

The app uses Bluetooth technology to alert users if they have come into contact with someone experiencing coronavirus symptoms. Once a user inputs their symptoms the app it automatically logs the distance between their phone and other phones nearby and provides advice accordingly.

It is being piloted in the North of England and is expected to be launched “in the coming weeks”.

Gould also commits to being “totally open and transparent” about how the app will be used.

“As part of our commitment to transparency, we will be publishing the key security and privacy designs alongside the source code so privacy experts can ‘look under the bonnet’ and help us ensure the security is absolutely world class.”

“If we make any changes to how the app works over time, we will explain in plain English why those changes were made and what they mean for you. Your privacy is crucial to the NHS, and so while these are unusual times, we are acutely aware of our obligations to you,” he added.

Phil Booth, coordinator at privacy group medConfidential, which has previously called on NHSX to be upfront about how the app will be used, said: “It’s time for them [NHSX] to stop talking and blogging about being transparent, and actually be transparent. Where are the DPIAs, the other Impact Assessments, the Data Sharing Agreements, the contracts? We were promised they would be published over a month ago, and still nothing.

“The lack of transparency is beyond an embarrassment. The real danger is that this undermines trust – for if they can’t show that they are and have been competent, honest and reliable throughout, then NHSX just failed the three pillars of trustworthiness. Not good for an experimental app that demands 60% of the population risk their lives to it.”

It comes as the privacy and security of contact-tracing apps has been called into question by a number of experts.

An open letter signed by hundreds of academics from 26 countries warned contact-tracing apps could “catastrophically hamper trust” if they become a tool for large-scale data collection.

They urged governments and developers to evaluate the potential risks of developing the technology before releasing an app to market.

The independent Ada Lovelace Institute published a rapid review of evidence for contact-tracing apps and found similar concerns surround privacy, concluding there was an “absence of evidence” for deploying the technology.