Northern Ireland has officially launched its contact tracing app, StopCOVID NI. This is the first fully operational app that has been launched in the UK to track and trace a substantial population who may have come into contact with the virus. StopCOVID NI uses Bluetooth technology on smart phones to detect proximity to other app users. This enables anonymous alerts to be sent to app users where they had been in close contact with a confirmed case of Covid-19.
It is anticipated the StopCOVID NI app will be compatible with the Republic of Ireland's contact tracing app, which came into operation in early July. It is hoped that this will ensure effective operation of contract tracing on an all island basis. Given the relaxation of lockdown restrictions, the introduction of compatible apps North and South of the border has been a significant consideration in the development of StopCOVID NI. Nearform's development of both Northern Ireland and Ireland's contact tracing apps has been described as a "world first" development, in that for the first time, people can be contacted and traced across a border.
The development of tracing apps across the UK has not been without challenge. The pilot trial of NHSX's app on the Isle of Wight proved controversial, having been based on a centralised approach in which personal data was uploaded to a single database. A number of challenges emerged regarding technological limitations and the question of data privacy when using the centralised model. Despite verbal assurances from the UK government that existing data protection law was sufficient, a number of politicians called for the introduction of new legislation to safeguard privacy and data protection rights.
The UK Government's 'Test and Trace' programme also came under scrutiny following privacy campaigner, the Open Rights Group's complaint to the Information Commissioner's Office ("ICO"). The Open Rights Group claim that the UK Government admitted it did not undertake a Data Protection Impact Assessment ("DPIA") when implementing the 'Test and Trace' programme. Whilst the ICO has confirmed organisations are responsible for completing DPIAs, a spokesperson for the Commissioner noted that "There is not always a requirement for that DPIA to be shared with us... In this case, we have been working with government as a critical friend to provide guidance and advice for some elements of the scheme and to seek assurances that people's personal data is protected".
Despite various legal challenges over privacy concerns, overcoming key technological issues proved to be a major factor in the UK Government's decision to abandon its plans to produce a bespoke centralised based app, focussing instead on the development of a hybrid model. The effect of this decision means that individuals' data will not be held in a single centralised database. Roll out of a new hybrid design however is some way off. Whilst this switch in approach has been welcomed by many promoters of privacy rights, further concerns have emerged regarding the effectiveness of the technology based on the decentralised model.
In order to assess an app's performance, it is important to determine whether the Bluetooth is working reliably or producing false results. The difficulty with the decentralised model is that data remains encrypted on the app user's device. With such little data exposure, it is claimed that performance of the decentralised model across the island of Ireland could prove problematic. However, to date, the Irish tracing app has generated more data than other apps operating on a decentralised basis elsewhere in Europe. It has been suggested that this could be down to specification of user preferences during the installation of the Irish app, where users are asked to consent to the collection of 'anonymous metrics' about the effectiveness of contact tracing processes. Commenting that "the perfect should not be the enemy of the good", Mr Ó Maidín of Nearform remains confident that the all island system will work effectively North and South of the Border. Perhaps effective communication regarding the implications of tracing apps for personal data could secure greater levels of user agreement to collection of 'anonymous metrics'. Whether this will help to strike a balance between the protection of health and privacy remains unclear.
Nevertheless, with any form of contact tracing, there may be room for repercussions, particularly if it is perceived as breaching privacy rights. This in turn could lead to further complaints to the ICO and an increase in civil proceedings. The way in which Authorities will treat such complaints remains to be seen. However, in light of the ICO's comments in recent challenges, it is envisaged that both regulatory bodies and the Judiciary will come under increased pressure to weigh up competing public interests.
This article has been produced for general information purposes and is not intended to provide a comprehensive or detailed statement of the law. Further advice should be sought from a professional advisor on the circumstances of a particular case. Please contact our specialist Data Protection team at Cleaver Fulton Rankin for further advice or information.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
