Covid-19 tracing app will stray from ICO privacy recommendations

The head of the UK Information Commissioner’s Office has backed the use of a centralised database for a covid-19 tracing app – contrary to prior recommendations by her office. 

Elizabeth Denham told a parliamentary committee yesterday that the planned use of a centralised database may be acceptable, despite the ICO having recommended the privacy benefits of decentralised databases. Denham told legislators that it “does not in any way mean that a centralised system can not have the same kind of privacy and security protections”.

The app, which has not been given a precise rollout date, will “anonymise” proximity location data from the mobile phones of consenting users and alert those that come into contact with anyone who has reported showing symptoms of covid-19.

Michael Gould, chief executive of NHSX – a collaboration between the English health service and health ministry that is responsible for developing the app – said during the meeting that balancing a number of concerns and objectives means a centralised system is necessary. 

“If privacy was the only thing we were optimising for here then it may well be that a decentralised approach should be the default choice but actually we’re balancing a number of things here,” Gould said. 

Legislators challenged Gould on the centralised system’s inability to interoperate with the decentralised systems adopted by most other countries. They highlighted interoperability as a particular concern for Northern Ireland and the Republic of Ireland – the latter of which is expected to roll out a decentralised system. 

Denham faced scrutiny from the committee over questions of independence in her role as both advisor and enforcer for the tracing programme. But Denham said that the role of her office is to offer expert advice and does not sign off or approve anything. “If we did that it would put us in a conflict to carry out enforcement measures,” she said. 

“In the design of the app we are a critical friend and can give peer-reviewed technical advice,” Denham said. She added that it is important that there should be an independent oversight body to make sure the app is being deployed  in a way that protects privacy and security. She argued that given the time constraints, setting up a new oversight body would be impractical and that the job remains in the remit of her office.

The committee also raised concerns including the storage and deletion of data after it is collected.

Gould told the committee that it “has put privacy right at the heart of how the app works”. He said data stored on mobile phones is automatically deleted on a 28-day cycle, and if users delete the app. 

But he added that there is no guarantee or legislative guidelines ensuring the data sent to NHSX will be eventually deleted. “It can be retained for research in the public interest or by the NHS for planning and delivering services, obviously in line with the law.”