COVID-19 data collection and your human rights
Article 8 of the Human Rights Act enshrines your right to respect for private and family life. Does contact tracing, as part of tackling the spread of coronavirus, pose a threat to this right?
The dangers of a “centralised approach” to contact tracing
Contact tracing apps around the world either take a centralised or decentralised approach. If data is stored in a central database i.e. one managed by the NHS or the UK government, the approach is centralised. If data is held locally, on the user’s device, it is decentralised. One of the benefits of decentralised technologies is that it removes the need for central silos of data, which can undermine our rights to privacy.
The collection and storage of personal data (such as an individual’s location and phone contacts) by public bodies is already underway as part of efforts to tackle COVID-19 globally. But citizens are worried this could lead to privacy breaches, and people in the UK are nervous about sharing too much data with public bodies. Now moving to a decentralised approach, the NHS initially focused on building an app that would have passed sensitive data to the UK government.
The Open Rights Group have already uncovered issues with the lawfulness of this earlier government scheme: their failure to complete a DPIA (Data Protection Impact Assessment) for the Test & Trace programme meant they fell foul of GDPR (General Data Protection Regulations) –and potentially lost the trust of millions of citizens to protect their privacy.
When can our right to privacy be restricted?
Like all rights, Article 8 is limited. Authorities can restrict our right to privacy if their action is “lawful, necessary and proportionate” in order to, amongst other things, protect health and public safety. As BHRI points out, for this to be the case the government would have to launch digital tracing systems that worked extremely well.
“For the interference of our right to private and family life to be lawful, it must also be proportionate. In this situation, the restriction would only be proportionate if it helped to achieve the aim of reducing the severity of the lockdown and to help to prevent the spread of COVID-19. The app and its digital tracing systems must be effective. If not, the collection of huge amounts of data is not proportionate.” If there are enough privacy concerns to dissuade people from downloading the app, can it ever be effective?
Another issue noted by BHRI is that, if the app relies on self-reporting of symptoms rather than confirmed COVID-19 cases, false alerts could be raised. This calls into question whether asking people to self-isolate for 14 days on receipt of such an alert meets the test of ‘proportionality’ when it comes to the right of liberty.
Could contact tracing become compulsory?
Another concern for human rights advocates is the ability of the government to make a contact tracing app mandatory for citizens. Campaign group Liberty has made it clear that they don’t want people being coerced into sharing sensitive information with the government. Clare Collier, advocacy director, said: “Contact-tracing technology will only work if 60% of people use it. But people will only use it if they trust their rights are being protected. For this approach to have any hope of helping us beat the virus, privacy safeguards must be hard-wired into the design from the outset.”
Liberty has since condemned the renewal of the Coronavirus Act (30 September), stating that it has prioritised criminal justice over public health. "The legislation, passed by Parliament at the end of March, created an array of new powers which Liberty, the UK’s leading human rights organisation, condemned as the biggest threat to human rights in a generation."
Human rights charity Privacy International has also raised concerns about apps becoming mandatory when more borders reopen, and has too pointed to issues of effectiveness if the public don’t adopt it voluntarily due to lack of trust.
What’s the solution?
At Moai, we have created an app that helps track COVID-19 without tracking citizens. Data is encrypted at all times, and we use secure hardware and privacy-preserving algorithms to ensure state-of-the-art privacy. We never ever share data with the government. And academic research can be undertaken on the data, without any personal information being exposed–or human rights to privacy restricted.
Uniquely, our app is also compatible with all smartphone operating systems. That means no additional privacy concerns from leaving your details written on a piece of paper at the venues you visit, just because you can’t download the NHS app.