ICO tells NHS to ‘collect minimum amount of personal data’ as contact-tracing app starts trial
As health service program moves towards nationwide launch, regulator sets out principles that should be followed
Credit: Adobe Stock
The Information Commissioner’s Office has told NHSX to ensure its soon-to-launch coronavirus contact-tracing app gathers as little personal data as is needed for its purposes, and stores information for no longer than is necessary.
The app this week began a testing phase in the Isle of Wight, where health service and local authority staff are now able to download it. From tomorrow, all residents of the island will be able to do so.
Shortly before the pilot began, the ICO issued NHSX with a 10-point guidance document to outlining the principles it believed should “guide the development of your contact-tracing app” and its ongoing approach to the collection and processing of personal data.
The first three points all relate to transparency, with the ICO asking that the app’s developers are completely open about the program’s purpose, design choices, and benefits.
If there is some degree of “tension” regarding the benefits that may be achieved by different parties, NHSX is encouraged to “be clear on how you have managed these in the data-protection context”.
- Coronavirus: can we keep track of our sensitive data?
- NHSX hopes to test contact-tracing app within two weeks
- Will the UK government use phone tracking to fight pandemic?
The ICO added: “Explain if the purpose is only proximity notification or if the purpose is broader, or is likely to expand in accordance with any development roadmap. Explain any additional purposes clearly and make sure you assess the necessity and proportionality of the processing the app undertakes.”
The fourth principle is that the technology should “collect the minimum amount of personal data necessary”, while the seventh stipulates that data should be kept “for the minimum amount of time, and, where appropriate… the user [should have] control over this”.
Developers should start from a position of trying to create an app that could work without gathering or storing any data that could identify individual devices or users, and rely solely on the device’s location data.
“Begin by considering whether you can generate and match identifiers on-device,” the ICO said. “Where this approach is available, feasible, and enables you to achieve your purposes, then you should use it. If you decide to use an alternative approach, you must be able to explain why it is necessary to do so, as well as the steps you will take to ensure you will not introduce unnecessary risks to the user.”
The regulator added: “Store data for the minimum amount of time necessary for your purposes. Explain what that period will be and why. Avoid gathering, augmenting or correlating user data without express permission.”
The fifth and sixth principles are to “protect users” via the use of “pseudonymous identifiers”, and to give them control through over how their data is used, by implementing a “privacy dashboard”.
The eighth point on the ICO’s checklist is to “securely process the data” via the use of cryptography and other security technologies and techniques.
Opt in and opt out
The ninth principle requires that users of the app “can opt in or opt out without any negative consequences”.
“App use – from installation to sharing of information – should be voluntary, with no negative consequences for individuals if they do not take action,” the document said. “Functions should be de-coupled to allow the user to benefit from one function without being compelled to provide data for other functions.”
The final data-protection request is that developers should only strengthen privacy, and not do anything to weaken it.
The ICO said: “Ensure the design of the app does not introduce additional privacy and security risks for the user – for example requiring the phone to be unlocked.”
It added: “The ICO will keep these recommendations under review, taking into account how the Covid-19 pandemic develops and the particular proposals under development to respond to the crisis. The ICO is open to any conversation regarding these recommendations in order to help technical teams build data protection by design and default into their service, because this is the best way to promote trust and confidence in any solution.”
"App use – from installation to sharing of information – should be voluntary, with no negative consequences for individuals if they do not take action"
Once someone has downloaded the app, they are encouraged to report any symptoms of coronavirus they subsequently suffer.
“The app… will [then] detect any other app users that the person has been in significant contact with over the past few days, including unknown contacts such as someone they may have sat next to on public transport,” the government said. “The app will be able to anonymously alert these contacts and provide advice, including how to get a test to confirm whether or not they do have Covid-19. Users will be able order tests through the app shortly.”
Those unable to access the app will be offered means to report symptoms and contacts online or via a telephone interview. This work will be supported by the deployment by Public Health England of 18,000 dedicated staff.
Health and social care secretary Matt Hancock said: “The app will help control the spread of coronavirus by alerting people they may have come into contact with it and recommending appropriate action. This groundbreaking technology, combined with our heroic frontline health and social care staff, and both a nationwide contact tracing testing programme will ensure that we remain in the best position to move toward easing the lockdown.”
The Public Accounts Committee finds a lack of information and collaboration could have seen many ‘slip through the net’
Scottish institutions to work with consenting older citizens to track energy usage
Plans include use of NHS Covid-19 app to display vaccination or test results
Citizens may be financially remunerated for their diet and exercise habits
In order to stay productive despite increased feelings of isolation - and other challenges - Azeus Convene suggest these top 10 tips to help you make the most out of working from home...
Higher Education institutions are some of the most consistently targeted organisations for cyberattacks. CrowdStrike explores the importance of the right cybersecurity measures.
There are many reasons to keep your Oracle workloads running on local servers. But there are even more reasons to move them to the cloud as part of a wider digital transition strategy. Six Degrees...
Engage Process explains how to ensure that process remains at the heart of your management programs - and how to keep undue pressure from those processes