To ask Her Majesty’s Government what action they are taking to (1) protect the privacy of users, and (2) provide oversight, of the National Health Service’s COVID-19 contact-tracing application and, in particular, whether the application will meet Apple’s privacy standard for Bluetooth.
The Question was considered in a Virtual Proceeding via video call.
My Lords, we have put privacy at the heart of the app and the way it works. It is designed so that you do not have to give up your personal details to use it. We have worked in partnership with both the National Cyber Security Centre and the Information Commissioner’s Office throughout. We continue to hold discussions with Apple and Google. The app uses only software development tools and mechanisms that are supported by Apple and Google.
To be effective, achieve widespread adoption and ensure our safety, the new app needs to gain public trust. So, why have the Government developed a go-it-alone, centralised app which is not optimally privacy-preserving, not interoperable with the apps of other countries—not even Scotland, it seems —not fully compatible with the Apple and Google Bluetooth protocol, and has no mandatory oversight, time limit on its use or public data impact assessment?
My Lords, it is not a go-it-alone app; others are following our lead on this. It is interoperable, and we are working with other countries to make sure it is. Testing with the public has turned out to be extremely positive and we look forward to publishing the audit shortly.
My Lords, the importance of track, trace and isolate is beyond doubt, but what assurances can the Minister give to your Lordships’ House that this data, as part of data-sharing with the NHS, will be anonymised and protected to prevent information being used by others?
My Lords, the anonymised data-sharing is protected by the security protocols that have been agreed as part of the app’s governance. That governance is overseen by the ethics board, chaired by Professor Sir Jonathan Montgomery from University College London, who previously headed the Nuffield Council on Bioethics.
My Lords, can the Minister tell the House what lessons Her Majesty’s Government have learned from South Korea and Taiwan, for example, which have been far more successful than the UK in testing, tracking and tracing, and hence reducing death rates? South Korea, with a population of 52 million, has had 252 deaths and Taiwan, with a population of 24 million, has had six deaths. Can the Minister explain to the House why the UK’s record looks comparatively so poor?
My Lords, I am in touch with both the South Korean and Taiwanese Governments, and we are greatly inspired by the throughly professional way in which they have gone about epidemic management. I commend both those countries and their efforts. However, the epidemic arrived in Britain in an incredibly fulsome way. The Chief Medical Officer has been very clear that if that had happened in either of those countries, their responses would have been similar to that of Britain. I defend the Government’s response to the epidemic.
My Lords, one of the core principles of data protection is to gather the minimum amount of data. I understand that one reason given by the NCSC for asking for partial postcodes on registration for the app is to assist with regional healthcare planning and to monitor potential Covid flare-ups. Can the Minister explain why data from Covid tests and NHS 111, for example, would not be sufficient to keep the transmission rate down in a post-lockdown test, track and trace strategy?
My noble friend Lady Blackwood is entirely right. The testing and the surveillance done by testing give us powerful insight into the demographic reach of the virus and information on a very broad basis on the regional reach, but we are looking for a much more granular level of detail from the very powerful, multimillion level of detail that the app can provide. The value of those surveillance details has led us to design the app in the way we have.
Matt Hancock has said that the app is to flag up our proximity to someone else using the app, not to track our movements. So why do the terms and conditions of the app request access to track our precise location based on GPS or network-based systems?
My Lords, the app works by using the Bluetooth tags which are shared once you have declared symptoms or you have had a positive test. It does not rely on GPS tracking. If the terms and conditions are broader, that is because we want to try to provide the most thorough set of conditions that encompass all the data provided by the user’s telephone. However, I can reassure the House that it is Bluetooth tagging that is used by the app and the surveillance system.
My Lords, what work is going on to make sure that the app that NHSX is developing is interoperable with other countries’ apps? Clearly we all want to get back to a situation where people can move freely from one country to another for business or leisure, so interoperation is important. I will be grateful if my noble friend can update us.
My noble friend Lord O’Shaughnessy is entirely right. We all wish to move as quickly as possible back to normal, but I am afraid that travel will be one of the aspects of our former lives that will be slowest to return. That said, we are working extremely hard with other countries to make sure that interoperability can be baked into our arrangements. Of course, the app has not yet been launched and few other countries are ahead of us. We sat with the Irish Government on 24 April in order to work out interoperability protocols since that border is the most important and proximate to us.
The Office for National Statistics tells us that the highest number of deaths is among the poorest communities at 55 in 100,000 versus 25 in 100,000 in other communities, yet they are also the most digitally excluded people. It is tragic that these inequalities mean that the contact-tracing app will not help those who most need it. What is the Government’s plan to address this enormous challenge?