Apple, Google block NHS contact tracing app update on privacy grounds
A scheduled update to the NHS COVID-19 app has been blocked because it allows location tracking – something prohibited by Apple and Google, which developed some of the code it uses.
The new version of the app used in England and Wales was due to become available today to coincide with the relaxation of lockdown rules, with the public now able to attend venues such as non-essential shops, pub beer garden, gyms and hairdressers.
The new version of the app would ask users to upload the log of venues they had checked into using QR codes if they subsequently tested positive for COVID-19.
This type of location tracking is however explicitly banned by Apple and Google on privacy grounds, and the two tech giants have now refused to allow the new version to be downloaded from their app stores. The older version of the app is however still available.
Apple and Google collaborated on the development of the contact tracing system that allows people who have been exposed to SARS-CoV-2 to provide a notification of their status, and warn other users of the app who have been in close contact with them to self-isolate.
It's the latest embarrassing setback for the NHS app after the initial model was canned last year after field trials on the Isle of Wight found it was all-but ineffective, despite millions of pounds of development.
That home-grown version was unable to operate effectively because of a feature of Apple’s iPhone operating system, specifically that apps go to sleep when not in use and cannot be activated by Bluetooth – the technology used to determine close contacts.
It also relied on a centralised database off registered participants, a move which sparked concerns about infringement of civil liberties before it was abandoned.
The Department of Health and Social Care (DHSC), which is responsible for the app, subsequently swapped to the exposure notification platform developed by Apple/Google, but in so doing signed up to agreement terms that prohibit location tracing.
The app used in Scotland isn't affected because it has developed a separate app for venue check-ins, rather than building that functionality into the Protect Scotland contact-tracing app, according to the BBC.
Commenting on the delay, Jim Killock, executive director of the UK Open Rights Group (ORG) which campaigns to protect privacy and free speech online, said the proposed changes "would have a significant impact on user privacy".
He went on: "Unfortunately, the government have not put in place any legal safeguards, and the ICO [Information Commissioner's Office] continues to be reluctant to challenge them."
The ORG has previously taken the government to task – and specifically Health Secretary Matt Hancock – for dismissing calls for a data protection impact assessment (DPIA) for the tracing system as "bureaucracy", even though legal advisors indicated one was required.
A spokesperson for the DHSC told Sky news that the new feature had simply been "delayed", adding that "we remain in discussions with our partners to provide beneficial updates to the app which protect the public".
