NHS coronavirus tracing app ‘will have unintended consequences’, senior official says

‘We don’t know exactly how it will work’, admits head of NHSX before app is rolled out on Isle of Wight

The new NHS coronavirus app will have “unintended consequences”, according to the head of the unit developing it.

Officials do not know “exactly how it will work”, Matthew Gould, chief executive of NHSX, told a parliamentary committee.

“There will be unintended consequences, there will for sure be some things we have to evolve,” he said.

“We need to level with the public on this, that when we launch it, it won’t be perfect and as our understanding of the virus develops, so will the app.”

The app is being rolled out to residents of the Isle of Wight for a trial, ahead of an expected national release later this month.

Health secretary Matt Hancock told the daily coronavirus briefing at 10 Downing Street on Monday: “Last week we put in place the testing capability on the island, from tonight the contact tracing capability will go live and from tomorrow, NHS staff on the island will be able to download the app.

“From Thursday, each one of the 80,000 households on the island will get a letter from the chief nurse with comprehensive information about the trial. Islanders will then be able to install the app.”

Mr Hancock urged islanders to “embrace this with enthusiasm”, telling them: “By downloading the app you are protecting your own health, you are protecting the health of your loved ones and the health of your community.” But he stressed the trial of the app did not mean the end of social distancing measures on the island.

Privacy campaigners have raised concern over the potential for “mission creep” with the data that will be gathered on people’s movements and contact with others.

The Health Service Journal reported that it has not yet passed tests on cyber security, performance and clinical safety needed to be included in the NHS app library.

But Mr Hancock insisted it had been designed “with privacy and security front of mind”.

“The data is stored on an individual’s phone, not by the NHS, until somebody finds that they’ve got symptoms and then they need a test and they come in to the NHS and the NHS needs to contact those who have been in contact with them,” he said.

“This has the highest level of privacy built in to make sure that we can both reassure people in terms of privacy but also that it will be effective and save lives.”

Testing tsar John Newton told the No 10 briefing that the app itself would contain no personal information, but simply data on where the phone has been and which other phones it has been near to, using anonymised randomly generated numbers.

“It’s a very safe use of data and people should feel very reassured by the precautions that have been taken,” he said.

The NHSX app is part of the government’s wider “test, track and trace” strategy as the UK’s lockdown is relaxed.

It will use Bluetooth technology to monitor when users are in close proximity to other people, and if they develop coronavirus symptoms they can choose to alert those who are at risk.

The data is recorded under an anonymous ID, rather than by the person’s name, and anyone receiving a warning notification will not know how and where they were possibly infected.

Contact tracing has been used extensively in South Korea, Hong Kong and Germany, where outbreaks have been contained more quickly.

The NHSX app has so far been tested in closed conditions at an RAF base, and is being piloted on the Isle of Wight from Tuesday.

The government plans to employ 18,000 contact-tracers by the middle of May, who will be in touch with people who have developed symptoms but do not have the app.

Mr Gould told parliament’s Joint Committee on Human Rights that the app was so far being offered to users as young as 16, but the threshold could change following advice from the Information Commissioner’s Office (ICO) and Children’s Commissioner.

“I’m conscious that smartphone use goes down with the more elderly population,” he added. “This is part of a strategy, so we’re making sure we’re not just relying on the app.”

Asked whether a minimum percentage of the population must use the app to ensure its effectiveness, Mr Gould said the government did not have a target.

He told MPs that similar projects in countries including Australia, Singapore and Norway showed that anything from a fifth upwards would be “good value”.

“Even at that level, the app starts to give us some really important insight into symptoms, how the virus is spreading and how we need to deal with it,” he added.

“If we can get to higher levels of 40, 50 per cent or above, the app can really make a big difference in identifying those people who have been in touch with suspected cases and making sure we can identify and isolate those people faster and more effectively.”

Mr Gould suggested that the app could “materially affect” the government’s decision on how quickly to lift restrictions on movement and association that have been in place since March.

Police have the power to arrest and fine people for violating the current public health regulations, but Mr Gould said data from the app would not be passed to law enforcement and compliance with alerts would be voluntary.

Dr Orla Lynskey, associated professor of law at the London School of Economics, told the committee there were privacy concerns over the gathering of location data.

“Location data is inherently, incredibly sensitive — it says where you were at a certain point in time: were you at the doctor, were you at the counsellor, were you at the sexual health clinic?” she added.

”There is an inherent risk that if you create a system that can be added to incrementally, you could do so in a way that is very privacy invasive.“

Dr Michael Veale, a lecturer in digital regulation at University College London, said there was a potential for “function creep”.

He said that if identifying details were incorporated in future, such as passport details, it could allow “progression to a kind of traffic light system where the idea is someone could be risk-scored on the basis of that activity”.

The experts called for the purpose of the app to be strongly limited and have a “sunset clause” governing when it will no longer be necessary.

Mr Gould did not rule out an expansion to the app’s scope, but said any changes made would be explained to the public.

“We could offer people the choice to offer more detail, but it will be a choice,” he added.

“If you delete the app, all data stored on the phone that hasn’t been voluntarily shared is deleted [but] if shared by choice it can be kept for research.”

Mr Gould said that the app would not ask for people’s names and “does not know who you are”, but requires the first half of postcodes to gather information on potential hotspots and alert local hospitals to surges.

Committee members raised concerns over how the app could operate alongside those used by other countries, including the Republic of Ireland, that use a different type of “decentralised” system.

“We are worried about interoperability but it’s not just us taking this approach,” Mr Gould said.

“If it becomes clear that a different approach is a better one and we need to achieve things more effectively, then we will change.”

NHSX has committed to publishing the app’s code, its privacy assessment and security models.

Elizabeth Denham, the information commissioner, said her officer had been advising developers and would be “doing robust audits” going forward.

“We expect to look at the data protection impact assessment, which is the key document for us to critique,” she added.