Impact of NHS contact-tracing app should be monitored

Jonathan Kirsop and Mario Subramaniam of Pinsent Masons said the recent launch of the NHS Covid-19 app was a welcome development in the government's strategy to curb the spread of Covid-19 at a time when the country appears on the cusp of a 'second wave' of the virus. However, they said the success of the app will likely depend in large part to citizens' trust in the technology and how their data is used. They also said that thought must be given to any unintended consequences of relying on technology which not everyone in society may be able to access or have the skills to use.

The NHS Covid-19 app was released on 24 September for use in England and Wales following trials of the technology on the Isle of Wight and in the London Borough of Newham, as well as with NHS volunteer responders. The release follows on from the earlier launch of similar apps by the Northern Ireland Executive and Scottish government.

Contact-tracing has been used by the medical profession to monitor and control the spread of diseases for many years. Technology has developed over the years to assist the process, but the principle has remained the same; the approach involves identifying persons who have come into contact with an infected person and who may be at risk of contacting the disease and/or transmitting the disease. These contacts are then directed to take the necessary steps and precautions to avoid infecting others.

Contact-tracing apps work by using a person's mobile device as a means for measuring if the user has come into contact with the user of another mobile device who has contracted the disease

Contact-tracing apps developed across the world have used technologies such as GPS or Bluetooth to achieve this aim. The apps adopt one of two core models – a 'centralised' model, or a 'decentralised' model. The NHS Covid-19 app is based on a decentralised model, which involves data being held on the user's phone rather than on a central server and whereby any data collected will be erased with the deletion of the app.

The NHS Covid-19 app is available to anyone over the age of 16 who lives in England and Wales and has six central features which, among other things, allow users to: find out if they have been near other app users who have tested positive for Covid-19; ascertain the level of risk of Covid-19 in their postcode area, and gain notification if they have visited venues where they may be a risk of Covid-19; access information about common symptoms and testing and allows users to order a Covid-19 if required; and access advice in the event they test positive and have to self-isolate.

The app relies on users providing the first part of their postcodes to identify their place of residence. It also records details of the user's phone as well as details of any devices which the phone has interacted with through the use of Bluetooth technology. The app produces daily randomly generated "codes" which are assigned to the user's device and where an individual user has tested positive for COVID-19, the government will ask for that users' permission to share these codes with other users, who will then be notified if they have been in close contact with the user.

Data protection law expert Jonathan Kirsop of Pinsent Masons said: "Initially the government appeared to favour a centralised model for data storage for the app, but it was eventually persuaded to change to a decentralised model after privacy concerns were raised about the state holding such a potentially large volume of personal data about its citizens. However, for the app to serve its purpose, it is critical that people have sufficient trust in how their data is handled to voluntarily provide the information necessary to inform an effective track and trace system. The statement issued by the Information Commissioner's Office (ICO), that the app is 'supported by the necessary consideration of people’s data protection rights', should offer some assurance in this regard."

Digital health expert Mario Subramaniam, also of Pinsent Masons, said the government should also keep under review how it ensures the widest possible access to the app.

"Trust in the use of data and compliance with data protection law are just two of the hurdles for the app to overcome," he said. "This phase in the immediate aftermath of launch is critical for ensuring individuals download the app and are responsive to notifications and act responsibly. There are ethical questions too, about whether the app marginalises some people in society, such as the elderly or those with particular health or learning difficulties, who may not have access to mobile devices and who would therefore be reliant on other parts of the track and trace system the government is operating working effectively to stay safe from the virus."

Subramaniam said the continued monitoring of the implementation of the app is vital and that the government may be able to learn lessons from how other countries addressed challenges that they encountered in the aftermath of releasing contract-tracing apps of their own.

Additional reporting by Katie Lo and Stephanie Lees of Pinsent Masons.