Jagvinder Singh Kang, a top specialist technology and data protection lawyer, plus the International Head of IT Law at pre-eminent law firm, Mills & Reeve, warns what he deems to be "unhelpful criticism of the upcoming NHSX Contact Tracing App by privacy advocates," could cost lives and plunge the UK into continuous lockdown.
With under a week to go until the Government’s launch of its contact tracing operation with over 25,000 contact tracers, Kang believes such manual contact tracing alone is unlikely to be sufficient to curb the virus. He strongly believes an automated solution is what is needed, hence the requirement for the NHSX app.
Kang provides a simple example to illustrate the deficiencies of a purely manual process. He draws on the scenario of trying to determine who may be infected by a carrier of the virus, who is travelling in a carriage on the London Tube. Not only is that carrier putting others at risk, but so is everyone that has been in close proximity to that carrier, including those who have entered and left the same carriage at various stops during the journey.
Furthermore, all of those individuals, will no doubt come into contact with, and potentially infect, others during that day, the coming days and weeks, until they self-quarantine, either following testing or the appearance of symptoms.
Kang remarks: “Once someone is that they are a carrier of the virus, think about how difficult and time consuming it would be, for that person to then work out: where they had been over the past week or so (when they were contagious); with whom they had had contact during that time (including strangers); and how long the contact has been (to seek to determine exposure risk), such as passing someone whilst exiting the Tube station, versus being seated close by to someone on the London tube."
Kang states: "In such circumstances, it's apparent there will be delays in identifying those who are infected. Such delays will risk the R-Number exceeding one, as infected individuals continue to unknowingly infect others. This in turn, is likely to trigger another potential exponential wave of the coronavirus, thus triggering another lockdown." The widespread resurgence of the virus following relaxing of social distancing in South Korea earlier this month, is a startling reminder of this prospect.
Kang stresses the situation is made more complex, as certain individuals may not be aware at the time that they are coming into contact with others, that they are carriers of the virus, either due to the symptoms not being fully evident, or because the individuals are asymptomatic. In either case, such individuals will still be contagious.
Now consider the above scenario, where all contact with known and unknown individuals, timings of occurrence and exposure periods, are automatically processed, and infection risk warnings issued, without individuals even having to think about it. Those are the benefits which the NHSX app provides.
The Government has already announced that the NHSX app is not going to be launched at the same time as the contact tracing operations next week. This is in part due to further work being required on the NHSX app, and in part to address public confidence in the upcoming NHSX app.
Kang urges the need for public recognition of the tremendous effort which the NHSX development team is undertaking in difficult circumstances. This includes extreme time constraints, the pressure of coming up with a life-saving solution, whilst all the time facing a barrage of negative public commentary. Kang reminds us: “One must not lose sight of the fact, that the development team consists of individuals who are not isolated from the personal effects that the virus is having on them and their loved ones." Furthermore, he highlights: “Overly critical or alarmist remarks about the NHSX app, are therefore, not constructive in helping the NHSX development team, who are spending their time on working to save the UK population and remove them from the restrictions of lockdown.” Consequently, he suggests that privacy advocates and the media should be more mindful of this.
Kang acknowledges that the NHSX app needs further work, including from a data protection alignment perspective. However, as Kang has already noted in his published paper, 'NHSX Covid-19 Tracing App-Nothing to Fear But Fear itself!’ (published on 22 May 2020 by the Society for Computers and Law), it is not the case that the NHSX app is being proposed to be launched where it is devoid of privacy, security and utility considerations. Kang is concerned that privacy advocates and the media seem to be overlooking this, which seems to be fuelling negativity in respect of the NHSX app.
Herein lies the problem according to Kang. He cautions against unnecessarily undermining the UK public's confidence in the NHSX app. Otherwise, this will lead to a low uptake of the NHSX app, which will not deliver the required efficacy for curbing the virus, thus costing further lives. This follows from reports which have suggested that an NHSX app uptake of at least 56% of the UK public is required, to help curb the virus (which translates into 80% of the UK public who have a smartphone).
Kang highlights: "Without a contact tracing app, contact tracing is resource and time intensive. This is already apparent from the need to have 25,000 contact tracers available next week. Such contract tracers will initially, use interviews to seek to determine who someone has been in contact with.”
Kang continues: “As is apparent from the example above, this gives rise to difficulties when people are no longer in lockdown, and individuals are in proximity with strangers, or moving around so that their timing exposure around other individuals is not easy to recall or verify.”
Kang reminds us, that if contact tracing purely through interviews could be effective in curbing the virus, one has to question why other countries have had to supplement their contact tracing operations with additional information, such as mobile location data and credit card transaction information. Of course, the NHSX app does not use any such privacy intrusive information. Kang notes: "The irony is that privacy advocates who are so against the NHSX app, are failing to realise that the potential risks of privacy intrusion are significantly greater through non-app contact tracing compared to app contact tracing.”
Kang concludes by highlighting that certain popular commercial apps, which for example, help someone find out where they left or lost their house keys, collect much more information than the NHSX app, including location data in some cases. Yet, millions of users are using them without giving such data use a second thought. Kang comments: “We as a nation, have to recognise that the NHSX app can be a ‘game changer’ for: mitigating against repeated lockdowns; curbing the spread of the virus; saving lives; as well as safeguarding our NHS Heroes.” He continues: “However, its efficacy is dependent upon a high uptake of the app. Consequently, it is important for the UK public to be aware that the NHSX, ICO and Government are collectively working together (with security, privacy and health objectives in mind), to help ensure that the NHSX app saves lives.”
