UK contact tracing app: will it be effective?

Emma Wright, Partner at technology and digital specialist law firm Kemp Little, discusses the various thorny issues around the NHSX contact tracing app, including its effectiveness, the privacy issues surrounding the technology, and possible discriminatory effects

It was the 17th of March when Channel 4 raised the use of a UK contact tracing app. Since then coverage has been building, a pilot has been rolled out on the Isle of Wight and a NHS Ethics Advisory Board has been created. Yet the thorny issues remain unanswered:

1. Efficacy - is the app the best tool to use for the task?
2. Privacy - will the app will lead to mass surveillance of the population; and
3. Discrimination - what happens if I decide not to or don't have the tech in order to download it?

So will the app actually work to assist the Government in getting ahead of the spread of the virus? Non-scientists struggle to question the efficacy. In fact it is reported only this morning (15th May) that the NHS Ethics Advisory Board seems torn on this very point. Many countries are rolling out contact tracing apps and South Korea's test and trace is lauded as exemplary and the main reason why South Korea never fully locked down.

Nevertheless, it is unclear to what extent the UK version of the app is merely the best solution on offer considering the timeframes and haphazard approach to test and tracing more generally. Nor would this be the first digital transformation project where the change has been dictated by the tech rather than a means to implement the optimal solution. Tech-led, rather than user led approaches often struggle to gain sufficient user adoption.

Use of the app is critical to the usefulness of the app. It is a generally held view that a take up of 20 per cent or less by the population will render the app totally useless and 60 per cent of the population need to use it for it to be effective. The fact that the app requires a smart phone makes that figure even harder to achieve and in those countries where its use is not compulsory, the level of initial take up achieves nowhere near these figures- although it's early days.

NHSX is currently piloting a centralised approach and database rather than the Apple and Google decentralised approach that keeps all contact data local to an individual's phone; although there are reports that there is also a decentralised system in development. This means the UK system will not interoperate with other countries' tracing apps - a real issue for the effectiveness of the app.

The discovery of unsecure documents by Wired journalists on a NHSX Google drive on 13 May also appears to set out grander plans for mass collection of personal data. The current UK Government view is that a centralised system is needed for it to spot wider trends in the spread of the virus and to spot misuse of the system. Both of these concerns could be readily addressed by not allowing self-declaration of the virus via the app but relying on Covid 19 test results (as is planned in Germany) yet this would obviously require a readily available and reliable testing capability.

Nevertheless, lack of transparency in relation to the Government's long term plans for the data collected, the third parties it will be shared with and detailed cost benefit analysis of the centralised system will only serve to limit the effectiveness of the app. The Joint Committee on Human Rights concluded last week ‘it is nearly impossible for the public to understand what it means for their data which may be collected by the digital contact tracing system' and concluded that Government assurances around data protection and privacy should be enshrined in legislation in order to carry sufficient weight and called for an Independent Commissioner to oversee the use, effectiveness and privacy protections of the app.

The discrimination point is more nuanced. Any restrictions on civil liberties for those that will not download the app cannot currently be anticipated. The susceptibility of one group to contract the virus rather than another and the prevalence of smart phone ownership within that group is not fully understood and the algorithm built into the app to assess whether there has been high risk contact with someone notifying the app with Covid19 symptoms is simply not there - this increases the chances of users of the app either receiving false positives or negatives - neither encouraging use of the app or confidence in the tracing system.

These differences may also be used to try and justify future scope creep for the app and increased data collection. New primary legislation setting out a person cannot be discriminated against for failure to download the app is needed. The argument for an Independent Commissioner who is also sufficiently resourced to assess whether the use of the app or the algorithm itself is compounding inequalities is strong.

In current times, lack of transparency and scrutiny allows disinformation to race to the foreground. What is clear is that there is much to be gained from collaborating on an international level - as western democracies struggle to get the engagement required to make the app successful.

In one of the greatest tests of trust and confidence in the use of a digital tool the Government appears to be stuttering. The lack of clear messaging around where the app fits into a wider test and trace plan, why it is following a centralised approach and what this means to an individual's data will impact user adoption if there is a true choice whether to use it or not. With the announcement of an immunity test, will the next step be a digital immunity passport with facial recognition? The public has demonstrated they will agree to all kinds of things in exchange for free items let alone post lockdown freedom.

Emma Wright is a Partner at technology and digital specialist law firm Kemp Little LLP www.kemplittle.com