Asked by
To ask Her Majesty’s Government what steps they are taking to
protect personal privacy in the trial on the Isle of Wight of the
NHSX COVID-19 contact tracing application.
The Parliamentary Under-Secretary of State, Department of Health
and Social Care ()
(Con) [V]
My Lords, we have prioritised privacy and security in all stages
of the app’s development, working in partnership with experts
across government and industry, including the Information
Commissioner’s Office and the National Cyber Security Centre.
Demonstrating our commitment to transparency, we have published a
data protection impact assessment and a privacy notice.
(Lab) [V]
My Lords, there have been numerous failings over the Isle of
Wight contact tracing app meeting its promised deadlines,
alongside other serious errors in the Government’s track and
trace system. Also, the NHS failed to carry out its legal data
protection obligations prior to the launch and entered into
data-sharing relationships on unnecessarily favourable terms to
large companies. Will the Government now give full disclosure on
every aspect of how its track and trace currently works, and
commit to fully disclose details of any changes to that scheme,
including the app, before they are rolled out?
[V]
My Lords, we have agreed up front to an enormous amount of
transparency. We have open source for the code, we have published
the data protection impact assessment and the privacy notice, we
have committed to publish the privacy and security models, and we
have published numerous blogs setting out the approach we are
taking. The approach towards the app completely embraces
transparency and we will continue down that path.
(Non-Afl) [V]
My Lords, in addition to the questions laid before the House by
the noble Lord, , can the Minister address the
fact that the Covid-19 impact on minority communities has seen
pertinent questions about structural discrimination, and
inequality is now rightly acknowledged? Does he accept that the
deep-seated misgivings about privacy and protection of personal
data management within many communities is real? How will the
Government work with community leaders, including women’s and
faith organisations, to create confidence in the NHSX contact
tracing system in areas such as Tower Hamlets, Newham, Hackney
and Brent, which have a disproportionate number of deaths, and
where access to smartphones and technologies may be limited and
this application viewed with scepticism?
[V]
My Lords, the evidence before me suggests that the British public
have an enormous amount of support for the app. Recent research
by Johnson and Lubbock partners for ITV showed that 59% of
British adults report that they would download the app. We remain
committed to reassuring all British people that the app is safe.
I take completely on board the noble Baroness’s recommendations
to engage with community and faith leaders who may have
particular misgivings; it would be worth engaging with them on a
particular basis.
(Con)
[V]
My Lords, I understand that a second version of the tracing app
is now undergoing testing and that, following the outcome of this
trial, the plan is to issue the new version to Isle of Wight
residents as an update. Is this the case? If so, what are the
differences in the information gathered between the first and
second versions? Will Isle of Wight residents have to consent to
any update or does their original consent include all future
updates?
[V]
My Lords, we are currently assessing the value of a specific Isle
of Wight update and whether it would be worth while before we
move on to issuing the full app. When we have finished that
assessment, I would be glad to answer the questions asked by my
noble friend.
(CB) [V]
My Lords, we need the tracking app to succeed. For this to
happen, as has already been mentioned, the Government need to
make sure that they are honest and transparent with the public to
gain their trust. Can the Minister say when the Government will
publish the performance data from the Isle of Wight trial?
Further, can he confirm that the Government have been following
their own code of conduct for data-driven technologies in
healthcare and in the development of the app? For example,
principle 4 refers to transparency and principle 10 refers to
commercial models. Can he tell us what process will determine
secondary uses of the data?
[V]
My Lords, I can confirm that the Government have been following
the code of conduct, as the noble Lord suggested. I am also
hungry to publish the performance data. I can confirm that, so
far, there have been 73,365 users of the Isle of Wight app,
53,490 of whom were on the Isle of Wight. The user experience has
been largely benign, and we look forward to publishing fuller
technical and user details shortly.
(Lab) [V]
My Lords, on timing, was the analysis of the Isle of Wight
results, particularly as regards privacy, available to Ministers
before we started to roll out the system across England? If so,
how did that influence the rollout? On the Isle of Wight, were
participants told that management of their data would be
contracted out to a private company, now in the national context
known to be Serco? If so, what was their reaction?
[V]
My Lords, the greatest insight from the Isle of Wight experiment
was that human contact tracing needed to be the first stage of
our rollout of the test and trace programme and that, in the
sequence of things, the app should come later, when people have
got used to the principle of contact tracing. The use of private
companies by the Government is commonplace, and we have had no
adverse comment on or reaction to that usage.
(LD) [V]
Ten years is the norm for holding medical research data, so what
epidemiological reasons require data from the app uploaded to the
NHS central database to be held for 20 years?
[V]
My Lords, the data that an individual puts on the app is entirely
voluntary. No data is held for more than 28 days until somebody
takes a test. Once that test has taken place, the individual has
the opportunity to upload further data. That data is held for
clinical trials and to help us understand the epidemic. There is
the opportunity for us to delete all that data at the end of the
epidemic, and that assessment will be made at the right time.
(Con) [V]
My Lords, like many, I pay tribute to my noble friend for his
indefatigable hard work over these past weeks, but does he accept
that, following the events of three weeks ago, there has been an
erosion of public trust and confidence? It has been seen on the
beaches and in demonstrations. Further, does he accept that it is
absolutely essential that these tests are conducted in such a way
that there is total public confidence in their probity? Can he
give me an assurance that everything possible will be done to
ensure that no vital personal information is misused in any way?
[V]
My Lords, the test and trace programme will publish data later
today; the noble Baroness, Lady Harding, will do the No. 10
presentation. In that presentation, I hope that noble Lords will
see an enormous amount of data suggesting that public trust in
the test and trace programme is profound, that it has made an
enormous amount of progress and that it will be an important part
of our arrangements for Covid. I assure my noble friend that the
Government’s approach remains that they put privacy at the heart
of all of their arrangements and will continue to do so.
(CB)
My Lords, will this tracing application be interconnected with
the tracing applications in the other three nations of the United
Kingdom? Secondly, since we have a common travel area with the
Republic of Ireland, will its tracing application be
interconnected with the four nations of the United Kingdom?
[V]
The noble Lord makes an important point about Ireland. We have
regular conversations with the Irish Government about the app
that they are working on. It is our aspiration that the two will
work together. That has not been confirmed, since neither has
been launched yet, as I understand it, but it is very much at the
top of our priorities.
