The Government’s coronavirus contact tracing app could face a legal challenge if it cannot justify its use of a centralised database, experts have warned.
As part of the tracing and tracking app, users will be able to share data with the NHS in a central system to confirm symptoms and book a Covid-19 test.
But in a published legal opinion from barristers and data rights experts, the lawyers warned that the centralised system would result in “significantly greater interference with users’ privacy and require greater justification” to be considered lawful.
In contrast, a decentralised system, where contact tracing data collected stays on a user’s phone, is considered “likely to be in accordance with the law, proportionate and necessary”, the report said.
The opinion was drafted by Ravi Naik, legal director of data rights agency AWO, Matthew Ryder QC and Edward Craven of Matrix Chambers, and Gayatri Sarathy of Blackstone Chambers.
Mr Ryder told BBC Radio 4’s Today programme that the Government is yet to “present the evidence or the material it would need to justify the course it is taking”.
He warned that if the Government ignores the advice of the Information Commissioner’s Office – which has previously also suggested that a decentralised approach would best protect user privacy – and others, it is “almost inevitable” that there will be legal implications, including the possibility of a legal challenge.
Speaking on BBC Breakfast in response to similar privacy concerns raised by Amnesty International UK that a centralised model is “opening the door to pervasive state surveillance and privacy infringement”, Health Secretary Matt Hancock said that is “completely wrong”.
“Firstly because the data is stored on your phone until you need to get in contact with the NHS in order to get a test, and secondly because the purposes of this are purely and simply to control the spread of the virus, which is really important,” he said.
“Thirdly, because we’ve all had to give up significant infringements on our liberty, for instance with the social distancing measures and the lockdown, and we want to release those, and this approach will help us to release them … I can reassure you that it’s completely untrue.”
A trial of the app on the Isle of Wight begins this week.
The contact tracing app is part of the Government’s wider “test, track and trace” strategy for controlling the spread of the disease while easing social distancing rules.
Both the legal opinion and Amnesty International UK have argued that the Government needs to justify why – unlike some other European countries – Britain is establishing a central database to store information.
NHS chiefs have said a centralised model via the NHS is important because it can speed up the process of the health service tracking and tracing the spread of the virus, which can help in slowing its transmission.
Dr Ian Levy, technical director at the National Cyber Security Centre (NCSC), which advised on the development of the app, said in both contact tracing models information is held privately on a user’s phone.
He said that while, in a decentralised model, health authorities learn little about who is ill, using the NHS as a central data point means the health service can learn more about the virus and how to stop it.
“Importantly, the public health authority has anonymous data to help it understand how the disease appears to be spreading, and has the anonymous contact graphs to carry out some analysis,” he said in a blog post on the app’s security.
“So the health authority could discover that a particular anonymous person seems to infect people really well.
“While the system wouldn’t know who they are, encounters with them could be scored as more risky, and adjust the risk of someone being infected by a particular encounter appropriately.
“The NHS app uses this centralised model, but also protects your security and privacy strongly.”
NHSX, the health service’s digital innovation arm and developer of the app, have also insisted it is still in testing and development and will evolve over time.