UK contact-tracing app could fall foul of privacy law, government told

The NHS contact-tracing app must not be rolled out across the UK until the government has increased privacy and data protections, an influential parliamentary committee has said, as rights groups warn that the current trial is unlawful under the Data Protection Act.

The joint committee on human rights said on Thursday it was essential legislation was enacted to ensure the mass surveillance of personal data did not result in a violation before the trial was expanded.

Its report was published following a legal letter from the Open Rights Group warning of “heightened and urgent concerns” that the government had failed to follow laws requiring it to submit an assessment of the risks to the information commissioners office.

The app, which is being trialled on the Isle of Wight, logs users’ movements and can alert people if they have had contact with someone who has developed symptoms.

Ministers have said it is an important tool to study the spread of Covid-19 and to help them ease lockdown restrictions.

But privacy campaign groups have opposed its introduction and a group of UK academics working in cybersecurity, privacy and law recently signed a joint letter saying it could open the door to general surveillance.

Harriet Harman, the chair of the joint committee on human rights, said government assurances on privacy were “not enough”

“The contact-tracing app involves unprecedented data gathering. There must be robust legal protection for individuals about what that data will be used for, who will have access to it and how it will be safeguarded from hacking.

“Parliament was able quickly to agree to give the government sweeping powers. It is perfectly possible for parliament to do the same for legislation to protect privacy,” she said.