After U-turning on the contact-tracing app, the Government must show its plans protect our rights

When the Government said a contact-tracing app would be key to us getting out of the coronavirus crisis, our chief concern was that it would be centralised – and it looked like it would be.

It has finally reversed this position.

This is a welcome decision that is in the interests of both public health and privacy, but there are still serious concerns that must be addressed.

The app relies on collecting information about who a user has been in close contact with. If the user then tests positive for coronavirus, the app provides data that can be used to “track and trace” potential paths of infection and limit the spread.

If this information had been collected centrally it would have created another massive Government database, gathering our movements and our contacts. This information is not truly anonymous, and combined with other data the Government holds it could identify a huge amount about each of us.

Liberty has said from the start that a decentralised app model is the best practice. Other countries have used this system – data is stored on your phone and is not collected on a Government database.

We briefed Parliament’s Joint Committee on Human Rights and said this model was the only way the app could respect and protect our privacy rights.

Any Government project involving our data must prioritise our right to privacy.

But at the outset of this project the Government appeared to prioritise mass data collection – including collecting data not needed for contact-tracing. This not only threatened our privacy, it would have undermined public confidence, meaning the app was never going to work effectively.

The Government appears to have finally accepted this, thanks in part to the fact that the privacy policies of big tech companies meant its central data-collection model wouldn’t work on many phones.

But a lack of transparency from the start means we’re yet to get the guarantees we need to ensure our rights are protected. There are crucial questions raised by the Government’s track and trace system:

• The Government is working with big tech companies on data-driven projects and algorithmic decision-making, which creates a host of threats to our rights. What’s the role of these companies in the coronavirus response, and what kind of algorithmic decision-making do they want our data for?
• The “manual” track and trace system (in which people report symptoms and contact-tracers follow up with their recent contacts) has been launched and is operating without a mandatory data privacy impact assessment. Is the data collected safe, or is it being shared with these tech companies?
• Will this data be deleted, and will the app be shut down once the pandemic is over?
• What happens if we don’t tell the contact-tracers where we’ve been and who with? Does the Government plan to use powers in the Coronavirus Act to criminalise us?

It should never have been left to the discretion of privately-owned companies to ensure the app was rights-compliant – and yet this is what has happened.

Now, the Government needs to make the case that a contact-tracing app is actually necessary for an effective test and trace system to work at all. Beyond that, we need far more robust guarantees that the app, and any of our data used as part of the coronavirus response, is protected and will be deleted as soon as possible.

The whole system must be legislated for, so that MPs can debate it, and we can ensure it has privacy protections truly built in and guaranteed in law.

A centralised app model is just step one – we need to see a lot more from the Government to ensure track and trace will work without putting our rights at risk.

The track and trace system needs high public trust if it is to help to protect public health. Ensuring the system has human rights protections built-in is key to ensuring this.