Skip to main content

Contact Tracing: Personal Privacy

Volume 803: debated on Thursday 11 June 2020


Asked by

To ask Her Majesty’s Government what steps they are taking to protect personal privacy in the trial on the Isle of Wight of the NHSX COVID-19 contact tracing application.

My Lords, we have prioritised privacy and security in all stages of the app’s development, working in partnership with experts across government and industry, including the Information Commissioner’s Office and the National Cyber Security Centre. Demonstrating our commitment to transparency, we have published a data protection impact assessment and a privacy notice.

My Lords, there have been numerous failings over the Isle of Wight contact tracing app meeting its promised deadlines, alongside other serious errors in the Government’s track and trace system. Also, the NHS failed to carry out its legal data protection obligations prior to the launch and entered into data-sharing relationships on unnecessarily favourable terms to large companies. Will the Government now give full disclosure on every aspect of how their track and trace currently works, and commit to fully disclose details of any changes to that scheme, including the app, before they are rolled out?

My Lords, we have agreed up front to an enormous amount of transparency. We have open source for the code, we have published the data protection impact assessment and the privacy notice, we have committed to publish the privacy and security models, and we have published numerous blogs setting out the approach we are taking. The approach towards the app completely embraces transparency and we will continue down that path.

My Lords, in addition to the questions laid before the House by the noble Lord, Lord Hain, can the Minister address the fact that the Covid-19 impact on minority communities has seen pertinent questions about structural discrimination, and inequality is now rightly acknowledged? Does he accept that the deep-seated misgivings about privacy and protection of personal data management within many communities is real? How will the Government work with community leaders, including women’s and faith organisations, to create confidence in the NHSX contact tracing system in areas such as Tower Hamlets, Newham, Hackney and Brent, which have a disproportionate number of deaths, and where access to smartphones and technologies may be limited and this application viewed with scepticism?

My Lords, the evidence before me suggests that the British public have an enormous amount of support for the app. Recent research by Johnson and Lubbock partners for ITV showed that 59% of British adults report that they would download the app. We remain committed to reassuring all British people that the app is safe. I take completely on board the noble Baroness’s recommendations to engage with community and faith leaders who may have particular misgivings; it would be worth engaging with them on a particular basis.

My Lords, I understand that a second version of the tracing app is now undergoing testing and that, following the outcome of this trial, the plan is to issue the new version to Isle of Wight residents as an update. Is this the case? If so, what are the differences in the information gathered between the first and second versions? Will Isle of Wight residents have to consent to any update or does their original consent include all future updates?

My Lords, we are currently assessing the value of a specific Isle of Wight update and whether it would be worthwhile before we move on to issuing the full app. When we have finished that assessment, I would be glad to answer the questions asked by my noble friend.

My Lords, we need the tracking app to succeed. For this to happen, as has already been mentioned, the Government need to make sure that they are honest and transparent with the public to gain their trust. Can the Minister say when the Government will publish the performance data from the Isle of Wight trial? Further, can he confirm that the Government have been following their own code of conduct for data-driven technologies in healthcare and in the development of the app? For example, principle 4 refers to transparency and principle 10 refers to commercial models. Can he tell us what process will determine secondary uses of the data?

My Lords, I can confirm that the Government have been following the code of conduct, as the noble Lord suggested. I am also hungry to publish the performance data. I can confirm that, so far, there have been 73,365 users of the Isle of Wight app, 53,490 of whom were on the Isle of Wight. The user experience has been largely benign, and we look forward to publishing fuller technical and user details shortly.

My Lords, on timing, was the analysis of the Isle of Wight results, particularly as regards privacy, available to Ministers before we started to roll out the system across England? If so, how did that influence the rollout? On the Isle of Wight, were participants told that management of their data would be contracted out to a private company, now in the national context known to be Serco? If so, what was their reaction?

My Lords, the greatest insight from the Isle of Wight experiment was that human contact tracing needed to be the first stage of our rollout of the test and trace programme and that, in the sequence of things, the app should come later, when people have got used to the principle of contact tracing. The use of private companies by the Government is commonplace, and we have had no adverse comment on or reaction to that usage.

Ten years is the norm for holding medical research data, so what epidemiological reasons require data from the app uploaded to the NHS central database to be held for 20 years?

My Lords, the data that an individual puts on the app is entirely voluntary. No data is held for more than 28 days until somebody takes a test. Once that test has taken place, the individual has the opportunity to upload further data. That data is held for clinical trials and to help us understand the epidemic. There is the opportunity for us to delete all that data at the end of the epidemic, and that assessment will be made at the right time.

My Lords, like many, I pay tribute to my noble friend for his indefatigable hard work over these past weeks, but does he accept that, following the events of three weeks ago, there has been an erosion of public trust and confidence? It has been seen on the beaches and in demonstrations. Further, does he accept that it is absolutely essential that these tests are conducted in such a way that there is total public confidence in their probity? Can he give me an assurance that everything possible will be done to ensure that no vital personal information is misused in any way?

My Lords, the test and trace programme will publish data later today; the noble Baroness, Lady Harding, will do the No. 10 presentation. In that presentation, I hope that noble Lords will see an enormous amount of data suggesting that public trust in the test and trace programme is profound, that it has made an enormous amount of progress and that it will be an important part of our arrangements for Covid. I assure my noble friend that the Government’s approach remains that they put privacy at the heart of all of their arrangements and will continue to do so.

My Lords, will this tracing application be interconnected with the tracing applications in the other three nations of the United Kingdom? Secondly, since we have a common travel area with the Republic of Ireland, will its tracing application be interconnected with the four nations of the United Kingdom?

The noble Lord makes an important point about Ireland. We have regular conversations with the Irish Government about the app that they are working on. It is our aspiration that the two will work together. That has not been confirmed, since neither has been launched yet, as I understand it, but it is very much at the top of our priorities.