Apple and Google block update of Covid-19 app in England and Wales

Tech companies feared refresh would breach privacy rules set out in agreement last year with government

An update for the Covid-19 app used in England and Wales has been blocked by Apple and Google, after they found that it breached privacy rules set out in the agreement with the government.

Link:
https://www.nace.org/network/members/profile?UserKey=d91abc06-3042-43e0-b858-884e319e5d83
https://www.nace.org/network/members/profile?UserKey=2d2df552-4387-40c1-b5bd-2131ae54fcc5
https://www.nace.org/network/members/profile?UserKey=370342f9-4bb6-4cc9-acd4-94157640a9f3
https://www.nace.org/network/members/profile?UserKey=eb3a3c85-648a-450a-8d9b-c91f04b2499a
https://www.nace.org/network/members/profile?UserKey=b42c848c-da7f-425e-a4a7-30ca8658451a

The update would have meant that users who tested positive for Covid-19 would be asked to upload details of venues they had checked into recently.

But according to people briefed on the decision, the companies did not make the update available for download from app stores at the allotted time last week — which was designed to coincide with the relaxation of coronavirus lockdown restrictions in England this week.

The UK’s Covid-19 contact tracing app has had a tumultuous ride over the past year. The original app, designed by NHSX, the health service’s innovation arm at a cost of £12m and scrapped last June, was built to store information on people’s symptoms and location on a centralised database — a feature that alarmed privacy campaigners.

Instead, ministers adopted technology designed by Google and Apple, which would only allow “decentralised” storage of information about user contacts on individual phone handsets.

The function of scanning a QR code to “check in” to venues has been used from the start, but at no point has this data been accessible to others. The new update would have meant that users who tested positive for the virus would be given the option to upload a log of recent locations they had visited.

Both Apple and Google had banned health authorities from storing or sharing patient or location data in their original agreements with governments.

“The government should not be able to update software to make it more intrusive without regulatory and legislative safeguards kicking in,” said Jim Killock, executive director of the Open Rights Group, a digital campaigning organisation. “The Government has given no reason to be trusted on privacy during the pandemic, which continues to risk public trust in their health efforts.”

Apple and Google’s Exposure Notifications System FAQ states that apps involved must “not share location data from the user’s device with the public health authority, Apple, or Google”.

A separate document, highlighted by the BBC which first reported the story on Monday, stated that “a contact tracing app may not use location-based API’s . . . and may not collect any device information to identify the precise location of users”.

The department for health said: “The deployment of the functionality of the NHS Covid-19 App to enable users to upload their venue history has been delayed”.

It stressed that the delay would not impact the functionality of the app and added: “We remain in discussions with our partners to provide beneficial updates to the app which protects the public.”

The health department also stated the app does not track individuals and does not hold personal information about individuals such as name, addresses or dates of birth.

One person with knowledge of the situation said Apple was seeking a solution to the current impasse with the government. Google declined to comment on the move.

It will still be a requirement for all members of a party to either check in using the app, or leave their contact details, when visiting outdoor hospitality from April 12.

The app will notify someone and recommend they take a test if an app user has scanned a venue QR poster on the same day that multiple individuals have attended and subsequently tested positive.

According to recent research produced by the Alan Turing Institute and Oxford university, the NHS contact-tracing app has prevented the transmission of hundreds of thousands of Covid-19 cases in England and Wales.

The researchers estimated that every 1 per cent increase in app users can reduce coronavirus cases by as much as 2.3 per cent.

The app has received more than 104m venue check-ins from its nearly 22.3m users.