Apple and Google block NHS Covid-19 app update over privacy issues
Apple and Google's Exposure Notification API specifically disallows asking people to share their location data
Apple and Google have blocked a scheduled update to the NHS Covid-19 contract tracing app, over location sharing issues.
The NHS Covid-19 app, which aids contact tracing in England and Wales, uses the Exposure Notification API, jointly built by Apple and Google to track interactions between users with their Bluetooth signals.
The current version of the app alerts users if they spend 15 minutes or more within two metres of another user who subsequently tests positive for Covid-19. Users are also able to scan QR codes to check in at venues like stores, restaurants and bars. In case a venue is later identified as a potential coronavirus hotspot, each device is sent a notification, alerting them about the potential exposure. The data generated in this process is stored on the user's phone and so not accessible to others.
The new version of the app was supposed to be made available on the App Store and Google Play Store simultaneously, as lockdown rules ease nationwide ahead of the complete removal of restrictions on 21st June. It was planned to automate the process further, by asking people to share their logs of venue check-ins if they tested positive. The data could have been used to alert other users.
'If an app user tests positive, they will be asked to share their venue history in a privacy-protecting way via the app,' the Department of Health and Social Care said in a press release last week.
'This will allow venue alerts to be generated more quickly, and improve the ability to identify where outbreaks are occurring and take steps to prevent the virus spreading.'
However, Google and Apple explicitly ban this type of location tracking, over privacy grounds. The tech firms have therefore refused to allow the new version of the NHS app to be downloaded from their app stores.
The Exposure Notifications System FAQ clearly states that any contact tracing app using the Apple-Google API must 'not share location data from the user's device with the public health authority, Apple, or Google.'
In addition, they 'may not use location-based APIs' or 'collect any device information to identify the precise location of users.'
'The goal of this project is to assist public health authorities in their efforts to fight COVID-19 by enabling exposure notification in a privacy-preserving manner, and the system is designed so that the identities of the people a device comes in contact with are protected,' the Exposure Notification FAQ states.
The older version of the NHS app is still available on the app stores of Apple and Google.
"The deployment of the functionality of the NHS Covid-19 app to enable users to upload their venue history has been delayed," a spokeswoman for the Department of Health told the BBC.
"This does not impact the functionality of the app and we remain in discussions with our partners to provide beneficial updates to the app which protect the public."
The development of NHS Covid-19 app was a "bumpy and painful" process, the head of the NHS' innovation division (NHSX) said October last year.
The first version was based on a system that stored data in a centralised database. But in April 2020, more a hundred academics and privacy experts from across the country wrote an open letter to government, raising concerns over the threats to data security and user privacy due to centralised approach to data collection.
Privacy groups argued that a decentralised app, where the data is kept encrypted on the smartphone, would provide users stronger guarantees of privacy and anonymity.
Taking note of the criticism, the NHS later announced that it would abandon the centralised contact tracing app in favour of one that would use the decentralised mobile API created by Apple and Google.
The NHS app was finally launched in September, offering more features than similar apps launched in other countries.
More than 22 million people are currently using the NHS app.