Covid-19 contact tracing app switches tack in terms of how it functions

The Government has confirmed officially for the first time that the national contact tracing app to combat Covid-19 which is currently in development has switched tack fundamentally in terms of how it functions.

A deal of mixed messaging has surrounded the application to date in terms of how it will work and as to what technical model it will follow.

The Department of Health has now confirmed that its initial plan had been to follow a “hybrid”, or centralised model of data collection, which would see the contact data submitted by citizens held centrally on a Government server.

However, that model raises significant privacy and data protection concerns and has fallen out of favour recently in the international community.

In a memo to Minister for Health Simon Harris, his department confirms that “following discussions with other countries and GDPR experts” the State has now opted for a decentralised model, operating via short-range bluetooth ‘handshakes’ which “means that the matching of contact traces occurs on each individual’s mobile phone and is not held centrally by the health services”.

Such a move “demonstrably maximises the protection of privacy and this is vital for public trust and confidence in the app,” the memo reads.

However, some of the other facets of the application, such as its request to collate users’ location data and symptoms, remain intact, while no mention is made of Government intention to publish the app’s source code or its data protection impact assessment (DPIA), a privacy fundamental under the EU’s GDPR.

The confirmation was welcomed by Sinn Féin health spokesperson Louise O’Reilly, who said that “privacy must be ensured to guarantee the maximum buy-in needed to make this work”.

She called for the DPIA and the app’s source code to be published and for civil liberties organisations “to have a meaningful input and oversight” regarding its development.

“We need more detail in the symptom tracker as this could potentially lead to concerns over privacy,” Ms O’Reilly added.

Privacy lawyer Simon McGarr said the move to a decentralised model represents a “profoundly welcome change in approach by the State”.

He said however that there is no need for location tracking to be included in the app’s specifications.

Mr McGarr said that the Government had acknowledged in the memo that location data is not necessary for contact tracing and that to include it would be “a recipe for public disquiet, which will undermine the maximum takeup of the app”.

He further said it is “vital” that the State outline the legal basis with which it will gain consent to acquire that location data given GDPR disavows such consent given by a citizen to a Government given the mismatch of power between the two.