UK pushes ahead with contact tracing app; EDPB issues privacy warnings

The UK’s National Health Service has begun testing a mobile application designed to trace the spread of the coronavirus outbreak.

Health Secretary Matt Hancock told the UK Parliament on Wednesday (22 April) that trials had so far been proceeding well, and that that an application would be available within a “matter of weeks.”

Tests for the app are currently taking place at a military base in Yorkshire, England. Later ‘beta trials’ are expected to be conducted in a controlled civic space before the app is rolled out en mass.

The technology will collate information on a centralised database – an issue which has recently brought the UK’s project, led by NHSX – the technology branch of the national health service, into odds with tech giants such as Apple and Google, who are working on their own decentralised approach for storing data.

EU warnings

The UK’s move comes amid warnings by the European Data Protection Board, the organisation which oversees the EU’s data protection authorities, which published new guidelines yesterday about the use of contact tracing software in the fight against the coronavirus.

According to the EDPB, the principle of “data minimisation” outlined in the EU’s general data protection regulation would favour a decentralised model of data storage – even though centralised architectures would also be permissible from a legal standpoint.

Code used in such mobile applications should be checked by experts and made publicly available, the EDPB added in its privacy guidelines for European governments.

“In order to ensure their fairness, accountability and, more broadly, their compliance with the law, algorithms must be auditable and should be regularly reviewed by independent experts,” the EDPB said. “The application’s source code should be made publicly available for the widest possible scrutiny.”

Moreover, the EDPB “strongly recommends” that impact assessments be carried out by national data protection authorities, and the result made available to the public.

Common toolbox

The EDPB’s guidelines for contact tracing tools come a week after the European Commission released their own pointers on how such applications should be used in the context of the coronavirus outbreak.

In the Commission’s common toolbox for mobile applications to combat COVID-19, developers were warned against the processing and storage of location data.

“Location data is not necessary nor recommended for the purpose of contact tracing apps, as their goal is not to follow the movements of individuals or to enforce prescriptions,” said the Commission document, published on Thursday (April 16).

“Collecting an individual’s movements in the context of contact tracing apps would violate the principle of data minimisation and would create major security and privacy issues,” the document noted.

More broadly, EU Commission recommendations for the development of contact tracing applications state that such technologies should be voluntary and must implement privacy-friendly technologies using only anonymised data, ideally based on bluetooth proximity technology.

The apps should also be interoperable, cyber-secure and dismantled as soon as they are no longer needed, the Commission said.

Speaking at a Brussels event on Wednesday evening, the EDPB’s Anna Buchta attempted to shine a line of the organisation’s thinking with regards to the guidelines published on Wednesday.

“I think the preferred EU approach currently is one where technology is only one element of an overall exit strategy,” the official said. “It’s not a standalone single bullet solution.”

“The voluntary approach and individual control is very important, as is transparency and the temporary character of an extraordinary tracing measures…Whatever solutions are considered necessary and proportionate under the current circumstances should not necessarily stay with us after the current crisis is over.”

Speaking to EURACTIV last week, the Commission’s vice-president for digital matters, Margrethe Vestager, sought to calm the general fears over the the privacy of telecommunications data in the ongoing fight against the coronavirus.

“You don’t have to choose between fighting the virus and protecting privacy,” she told EURACTIV in a telephone interview on Friday (17 April).

“You can do something that also makes very good sense with privacy and at the same time, get a digital tool that will be very useful.”

(Edited by Frédéric Simon)

Subscribe to our newsletters