Written Evidence Submitted by Google

(C190015)

 

 

 

Across the world, governments and health authorities are working together to find solutions to the COVID-19 pandemic, to protect people and get society back up and running. Software developers are contributing by crafting technical tools to help combat the virus and save lives. In this spirit of collaboration, Google and Apple have announced a joint effort to enable the use of Bluetooth technology to help governments and health agencies reduce the spread of the virus, with user privacy and security central to the design.

 

We understand that Google’s joint announcement with Apple that we are collaborating to support opt-in, government-sponsored contact tracing apps raises important questions. We welcome the opportunity to address these for the Science and Technology Select Committee. We would first like to set out in a bit more detail what this initiative entails, before turning to the committee’s questions, which we are responding to in Google’s name.

 

As COVID-19 can be transmitted through close proximity to affected individuals, public health organisations have identified contact tracing as a valuable tool to help contain its spread. A number of leading public health authorities, universities, and NGOs around the world have been doing important work to develop opt-in contact tracing technology. To further this cause, Apple and Google will be launching an exposure notification solution that includes application programming interfaces (APIs) and operating system-level technology to assist in enabling contact tracing. This is an effort by Apple and Google to implement a solution globally that will ensure iPhone and Android devices work together in order to enable contact tracing for COVID-19, while following principles of privacy, transparency and user control.  Given the urgent need, the plan is to implement this solution in two steps.

 

First, in May, both companies will release APIs that enable interoperability between Android and iOS devices using apps from public health authorities. These official apps will be available for users to download via their respective app stores.

 

Second, in the coming months, Apple and Google will work to enable a broader Bluetooth-based contact tracing platform by building this functionality into the underlying platforms. This is a more robust solution than an API and would allow more individuals to participate, if they choose to opt in, as well as enable interaction with a broader ecosystem of apps and government health authorities.

 

Privacy, transparency, and consent are of utmost importance in this effort. This technology is designed and provided only for the support of the public health response to COVID-19 specifically, and we do not intend to keep it running beyond this pandemic.

 

We look forward to building this functionality in consultation with interested stakeholders. We have published and will continue to publish information about our work for others to analyze. Through close cooperation and collaboration with developers, governments and public health providers, we hope to harness the power of technology to help countries around the world slow the spread of COVID-19 and accelerate the return of everyday life.

        What interactions Apple and Google have had with the UK Government regarding a contact tracing app;

Since our announcement we have spoken with NHSx and their app development teams regarding our approach and the design of their contact tracing app. Initial discussions centred on the Play Store guidelines, and more recently on the API initiative.


We have also kept other relevant government officials informed of developments in this recently announced work, including the Department for Digital, Culture, Media and Sport.

Additionally, we have kept the Information Commissioner’s Office (“ICO”) informed.

 

        What interactions Apple and Google have had with other national governments regarding a contact tracing app;

We have engaged governments around the world on our plans and shared initial technical specifications publicly. The same API will be available to official public health authorities in support of contact tracing activities.

As with the UK Government, we have had discussions with other national governments who are developing contact tracing apps regarding our Play Store guidelines, the API, and our approach to preserving privacy.

        Data privacy issues for contact tracing apps, and how Apple and Google’s work addresses these issues;

 

Strong privacy design is not only part of our core values, but is critical to the success of this endeavour. If people don’t trust that their privacy will be protected, and that their data will be used responsibly, they will not enable any contact tracing features.

We will build strong privacy protections into the foundation of this feature. Specifically:

 

        This is a voluntary system. Individuals must explicitly opt-in to contact tracing to use this feature during both phases.

        People can change their mind at any time by disabling contact tracing.

        The process of recognizing nearby phones, and the process of matching who has come into contact with a coronavirus positive case, happens on-device. The Bluetooth-based “beacons” themselves that leave a user’s phone cannot reveal the user’s identity, and change frequently so they cannot be used to re-identify an individual device.

        This technology allows contact tracing apps to notify people that they may have come in contact with someone who has tested positive for COVID-19 without revealing the infected person’s identity, nor will any user or test result information be shared with Apple and Google.

        The system is only used for contact tracing and isn’t monetised for advertising purposes.

        Google and Apple can disable the API on a regional basis when it is no longer needed.

As with other matters relating to data privacy, we are engaged with the relevant data protection authorities, including the Information Commissioner’s Office in the UK. We welcome the ICO’s formal legal o pinion on this matter, which notes that the proposals appear aligned with the principles of data protection by design and default. We will continue to engage with the ICO going forward.

        What assessment Google and Apple have made of the uptake of contact tracing apps; and

 

Google has not conducted an assessment of what level of user uptake is necessary for the effectiveness of contact tracing apps.


We believe based on guidance from public health agencies and other experts that this exposure notification capability will be a useful piece of overall efforts to reduce COVID-19 spread to the benefit of all. It is intended to be one part of a coordinated response composed of numerous other elements working together, including medical care and routine testing and monitoring of the disease, and should be used in accordance with guidance provided by public health agencies.

The second phase of this framework will work to enable a broader Bluetooth-based contact tracing platform by building this functionality into the underlying platforms. This is a more robust solution than an API and would allow more individuals to participate, if they choose to opt in, as well as enable interaction with a broader ecosystem of apps and government health authorities.

        What legislation and regulatory guidance, if any, would be required to support the development of contact tracing applications in the UK.

 

Existing legal frameworks such as GDPR and the Data Protection Act in the UK provide legislative and regulatory frameworks. This initiative operates within the existing legislative rules and applicable laws. As noted, we have actively engaged with data protection authorities, including the ICO in the UK. As this work continues we will maintain close contact with the ICO and other relevant legislative and regulatory bodies.

 

(April 2020)