To ask Her Majesty’s Government what steps they are taking to address privacy concerns about (1) the use of the NHS Covid-19 contact tracing application, and (2) the introduction of immunity certificates.
The Question was considered in a Virtual Proceeding via video call.
My Lords, we have put privacy at the heart of the app and how it works so that you do not need to give your personal details to use it. We have worked in partnership throughout with the National Cyber Security Centre and the Information Commissioner’s Office. The science around immunity is currently uncertain and there are a number of issues that we need to address to understand potential certification.
I thank the Minister for his response but that is certainly not the information that I am getting from other places. A Dr de Montjoye from Imperial College’s department of computing has written a paper in which he says that, if the Government are to use this app properly, it is very important that they are transparent about it. Can the Minister commit the Government to transparency about whichever app they use?
Professor de Montjoye is entirely right that transparency is key. That is why we have published the open source code for our app, as well as a PPIA privacy notice, and blogs setting out the approach that we are taking. We will continue to go about our business in a transparent way.
My Lords, the Minister has reminded the House that tens of thousands of people on the Isle of Wight have downloaded and used the app. People of the island often feel—with, I regret, some justification—that they are considered last if at all. Now, despite the questions about privacy, effectiveness and rollout, they have been the first to step up and make a significant contribution to the nation’s common good. Will he undertake to look at how their service might be recognised?
My Lords, where the Isle of Wight leads, the country follows. We are enormously grateful to islanders for taking this pilot on board with energy and enthusiasm. I would like to consider ways of recognising that. One important lesson that we have learned from the island project is that the human touch of contact tracing is incredibly important and we will be implementing that at later stages.
My Lords, I declare my interest as chairman of the Information Assurance Advisory Council. In normal times, the cybersecurity advice that we would all give would be to keep the Bluetooth on our mobile telephones switched off unless and until we need it in a private setting. But these are not normal times. What advice would my noble friend the Minister give to help us protect ourselves while using this app?
My Lords, the Bluetooth used by the app is the latent Bluetooth, which does not need to be turned on and off. Our advice is for everyone to ensure that they keep their Bluetooth on. In fact, we will be issuing specific advice to doctors and other health workers who spend a lot of time in each other’s company, to ensure that the app does not create erroneous data.
Does the Minister agree that immunity or health certificates have the potential to be socially divisive and foster prejudice if they were valued by employers? Why else would you want them? They would also implicitly endorse the Government’s original, much vilified, herd immunity policy. They are a terrible idea and the Government would be wise not to go down this road.
My Lords, I completely hear the noble Earl’s reservations about certification. Our plans are in development. We are fully aware of the concerns that he has expressed about their potentially divisive nature, but the public deserve to know whether they have had the disease. We have to use whatever technology we can to help shake off the economic and social effects of this virus. Therefore, we retain an open mind on the use of certification.
Does the Minister accept that the proposed tracking app we are discussing will effectively exclude those who do not have a smartphone or the experience, knowledge or capability to operate apps or Bluetooth? That will disproportionately exclude the elderly, the poor and the disadvantaged—exactly the groups most at risk from Covid-19. What plans do the Government have to include this group in any future tracking and testing regime?
My Lords, the testing and tracing regime depends on three legs: access to tests; updated methods of the classic contact tracing run by individuals, using phones and the internet; and lastly, importantly but not exclusively, the NHS app. We are very much focused on ensuring that the vulnerable, the elderly and the digitally poor are in no way excluded, which is why we have put the human element at the centre of our plans.
Will the Minister give a cast-iron guarantee that, as the app evolves, it will not use location tracking or seek personal identification information as a condition of use?
My Lords, we have no current plans for using geolocation information. However, we have an open mind on options for users being able to share data of several different kinds, and we are open to the idea of consumers making those choices.
I want to ask the Minister about the immunity certificates. At the moment, as I understand it, medical science does not tell you whether you are immune. It can tell you whether you have had it, but surely we do not yet know whether Covid mutates. So how can you issue an immunity certificate, and, importantly, how can you make sure that it is not forged?
My noble friend is entirely right. The science on immunity is confounding and we do not fully understand it, although we are investing a huge amount of time, money and effort into understanding it better. We believe that there may be an opportunity to understand immunity better, and that will inform and make safe people’s commitment to going back to work. No decisions have been made yet, though, and we have in our minds all the reservations that my noble friend described.
Given what we know about the NHS app, I have to say that my greater concern would be about the data held by Amazon or Google, rather than by the NHS. Does the Minister accept that the countries implementing track and trace, particularly those in the EU, are all countries that have an ongoing system, decades-old, of using ID cards? Would the Government consider the fact that trust in government in those countries, even privacy-obsessed Germany, is higher due to the state having held data, not centrally but in some form, through an ID card system? Maybe they should look at that.
My Lords, ID cards do not form part of the British tradition. We work on a system of consent and we have a very high level of trust in the Government. The app is particularly well suited to a country that has a universal NHS system, and that is one reason why we have designed it in the way that we have.
Can the Minister confirm that the national rollout of the NHSX app has now been delayed until June? Does he share my concern that a government spokesperson has said that it is possible for the test and track system to work without an app, and for the lockdown to be relaxed further without a system operating at all? This is deeply worrying, given that the Government have admitted that they should never have stopped track and trace in the early stages of the pandemic and now appear to be reneging on a commitment to make it a priority.
My Lords, it is entirely right that test and trace does not need a digital app to be effective. I reassure the House that prevalence levels are reducing across the country, as is the infection rate. It is only because prevalence and infection are reducing to manageable levels that we can even consider reducing the lockdown and maintaining pressure on infection through test and trace. The app brings many benefits of being able to automate millions of transactions a day, but it is not intrinsically necessary, and we believe that it would benefit from being introduced later, rather than earlier, than human-based tracing mechanisms.
My Lords, what discussions has my noble friend’s department had with other Governments around the world, and what lessons can be drawn from their experience of such apps?
My Lords, we are in discussions with many other Governments—those in the east, which have a tradition of these apps, and fellow travellers like ourselves. It is a highly technical and difficult area; Britain is leading the way in many ways and we have learned an enormous amount. I have personally spoken to the Taiwanese Government, who have taught me an enormous amount, and those conversations continue regularly.
My Lords, the time allowed for this Question has elapsed. It is worth noting that, in the whole Proceeding, we excluded only two possible questioners, so apologies to them. I thank your Lordships. That concludes the Virtual Proceedings on Oral Questions. Virtual Proceedings will resume at 3.30 pm for a Private Notice Question on post-Brexit customs arrangements in Northern Ireland.
Virtual Proceeding suspended.