Privacy and data protection must be at heart of tracing app, Amnesty says

Amnesty International UK has urged the Government to address privacy questions around its contact-tracing app before rolling it out nationally.

The app is currently being trialled on the Isle of Wight ahead of a wider UK rollout as part of the Government’s “test, track and trace” strategy to stop the spread of coronavirus.

The human-rights charity has written to Health Secretary Matt Hancock with seven key principles that it says should guide the Government’s decisions before a full rollout.

Concerns have been raised by some over the app – developed by the NHS’ innovation arm NHSX – because it uses a centralised approach to data, meaning information collected is sent to a central server controlled by the NHS for analysis as part of the contact-tracing process.

In contrast, the decentralised model favoured in other countries keeps data on a user’s phone.

NHSX has previously insisted the app anonymises all data and only receives information when a user chooses to share it – for example, to declare they have coronavirus symptoms and to request a test.

It has said the app “has been designed to protect users’ privacy” and that it “does not track location or store any personal information”.

Kate Allen, Amnesty International UK director, said user privacy “must not become another casualty of the crisis”.

“A Government decision-making approach to this app that incorporates key human rights principles can ensure that does not happen,” she said.

“We are certainly not trying to discourage people from using the app, but rather encouraging the UK Government to answer important questions about its approach at this crucial moment.

“Very important concerns around the current choice to adopt a centralised model and issues like accessibility and transparency still remain unanswered.

“As the UK Government prepares to roll the app out across England, it is critical that these are addressed so that people can properly understand what is being proposed and why.”

The charity has highlighted seven key principles which it says the Government should use as part of the app’s ongoing development process.

They include pledging that the app always remains entirely voluntary and restricting all data collection to controlling the spread of Covid-19.

The principles also suggest the apps should not to be used for any other purpose or accessed by any third party, and proof should be published which shows collected data can not be de-anonymised.

Privacy and data protection must be part of the app’s design and it should be subject to independent oversight with automatic deletion of collected data after set time limits, Amnesty says.

Some of Amnesty’s principles have already been met – the source code for the trial version of the app has been published while the Government has an ethics advisory board in place to scrutinise the app’s development and testing.