Written evidence from Professor Lorna McGregor et al (COV0090)


1.                   The COVID-19 pandemic engages the full spectrum of states’ human rights obligations. In addressing the virus itself, states are required to protect the rights to life and the highest attainable standard of health (right to health).[1] The right to health requires that ‘public health and health-care facilities, goods and services’ be available; physically, economically and informationally accessible; acceptable; and ‘scientifically and medically appropriate and of good quality’.[2] States’ (in)action in meeting their obligations to fulfil the rights to health and life has direct consequences for the enjoyment of all human rights, including the rights to liberty and security, education, food, work, housing, privacy and freedom of movement, association and expression. Therefore, states must take proactive measures to prevent the spread of COVID-19 in order to protect life and health. However, as human rights are indivisible and inalienable, they must only do so in ways that do not violate absolute rights, such as the prohibition of torture, and only limit other rights in ways that are lawful, necessary and proportionate.


2.                   In this submission,[3] the ESRC Human Rights, Big Data and Technology Project at the University of Essex focuses on the human rights implications of the contact tracing app under development by NHSX, in light of the proposed introduction of this app in the coming weeks. In order to fulfil basic principles of good governance and the rule of law, enhance democratic legitimacy and protect human rights, we submit that prior to introduction there is an urgent need for much greater transparency and meaningful public debate and scrutiny of (a) the concrete and specific details of the app (b) the scientific justification for the app and (c) its place in a wider governmental strategy to protect all human rights during the COVID-19 pandemic. The Chief Executive of NHSX has stated that,


We have worked quickly to build the app because that is what the situation demands. But we have not let that urgency compromise our commitment to transparency, ethics and the law. We have been consulting on our plans with the Information Commissioner (see this blog), the National Data Guardian’s Panel and the Centre for Data Ethics and Innovation, as well as with representatives from Understanding Patient Data and volunteers who provided a patient and public perspective.[4]


While this consultation is important, it does not replace full and meaningful public scrutiny and debate, including by Parliament, which is critical to shaping and influencing whether and if so, in what way, an app is introduced.


3.                   Prior to introduction, a clear and accessible legal basis is needed for the app, which must also meet the tests of necessity and proportionality, including the establishment of effective safeguards, oversight and accountability processes. A full equality and human rights impact assessment must also be conducted prior to the introduction of the app; a data protection impact assessment is important but not sufficient to cover the full impact of the app on equality and human rights. These measures will also cultivate trust in the operation, governance and regulation of the app which will be critical to facilitating the widespread adoption necessary for the app to be effective and contribute to preventing the spread of COVID-19. The embedding of equality and human rights obligations in the design and deployment of the app is integrally connected to the successful implementation of the technology.


  1. The Potential Impact of Contact Tracing Apps on Human Rights


4.                   As noted below, NHSX has published some information about the app it is currently developing. It previously indicated that it was working with technology companies, such as Apple and Google (that are working to support exposure contact tracing using Bluetooth and incorporating de-centralised storage and anonymisation techniques) although reports suggest that this is no longer the case.[5] However, there is insufficient detail publicly available on how the app will operate and its data flows; its legal basis, oversight, accountability and remedies; the existence and details of agreements with technology companies and other public sector bodies; and possible future uses of the data and platform to assess its likely impact on human rights and how best to mitigate these risks. Public information is available on whether equality and human rights impact assessments have been conducted, although the Chief Executive of NHSX committed to publicising the data protection impact assessment it has carried out during an appearance before the Science and Technology Committee.[6]


5.                   Contact tracing apps may present one way in which to contribute to the protection of the rights to life and health during the COVID-19 pandemic. However, they also pose significant risks to human rights. Contact tracing apps take many different forms as do their means of implementation, meaning that generalisations cannot be made about them. That said, all contact tracing apps impact human rights in some way, although varied in scale and extent. In this part of this submission, we highlight some of the main human rights concerns that have been raised about contact tracing apps. In the absence of full transparency, it is not possible to assess which of these risks apply to the NHSX app and its regulatory and governance framework. However, the risks outlined here underscore the importance of transparency, public scrutiny and debate and the need for a legal basis, safeguards, oversight and remedies in order to ensure that the UK meets its national and international human rights obligations, when introducing contact tracing apps.


6.                   Yuval Noah Harari has warned that resort to surveillance technologies, such as contact tracing apps, in response to the COVID-19 pandemic constitutes ‘an important watershed in the history of surveillance … signif[ying] a dramatic transition from “over the skin” to “under the skin” surveillance’.[7] The concern is not only that contact tracing apps could introduce an unprecedented level of surveillance during the pandemic, but that through mission creep and normalisation, we may not be able to go back to normal’ and could see such technologies being deployed in other areas of life, during and after the pandemic,[8] as well as an increased involvement of technology companies in the delivery of public bodies’ mandates.


7.                   These risks are particularly acute where contact tracing apps are mandatory (which does not appear to be the proposal in the UK at present) as they facilitate widescale surveillance. However, they may also apply to voluntary schemes. For example, even if ostensibly voluntary, the use of contact tracing apps could become de facto mandatory for some people, if access to work or public spaces and services is conditioned upon use of the app.


8.                   Both mandatory and voluntary schemes put people who do not own smart phones or are unable to install the app at risk of punishment, the drawing of adverse and discriminatory inferences, and unequal access to health information. The Office for National Statistics reported last year that in ‘2018 there were still 5.3 million adults in the UK, or 10.0%’ of the population who are what it terms ‘internet non-users’, defined as people who have ‘either never used the internet or have not used it in the last three months’.[9] It found that, ‘adults over the age of 65 years have consistently made up the largest proportion of the adult internet non-users’; disabled adults make ‘up a large proportion of adult internet non-users’; ‘wide disparities [exist] between ethnic groups’ and ‘[a]mong those of working age, the economically inactive are the most likely to be internet non-users, particularly those adults on long-term sick leave or disabled’.[10] This data underscores that the ongoing digital divide will affect the voluntary uptake of the app.


9.                   The use of the app may also be affected by trust and confidence in the police and other state agencies, which may be lower in particular communities, such as those living in poorer urban communities and asylum seekers, who may fear that the app will lead to greater surveillance and law enforcement. This risk will increase if failure to follow the advice of the app is enforceable and carries legal consequences.


10.              Where individuals are unable to use the app due to the digital divide, or because they fear adverse consequences will follow from using the app, they may be denied the benefits associated with the app such as enhanced mobility and protection from exposure to COVID-19.


11.              The way the app functions also has significant implications for human rights. The level of constant surveillance could mean that apps restrict movement or even constitute a de facto form of deprivation of liberty.[11] Contact tracing apps also pose significant implications for other human rights, including privacy. It is widely accepted that significant insight into an individuals social interactions are possible, even using Bluetooth technology (as opposed to other location-based service, such as GPS). These risks are particularly acute if: they reveal location data (directly or indirectly by proxy) and other identifiable information; data are held centrally rather than localised on a person’s phone; data are retained rather than deleted beyond the isolation period; and are deployed by or are accessible to private companies and law enforcement or intelligence agencies (whether by design or by governments compelling health authorities to share data[12]) with the risk that the data and technologies are repurposed, now or in the future.[13]


12.              As discussed below, many of these issues can be overcome in the design of contact tracing apps and the legal framework put in place to oversee their use. However, it is never possible to fully remove the risks to privacy, even where data are anonymised, and the risk of mission creep and normalisation of such technology will remain high. Significant questions therefore arise over the safeguards and limitations on the use of this data.


13.              The range of potential human rights risks posed by the design of contact tracing apps and the way in which they are regulated and governed, underscores the urgency for transparency on the precise details on the NHSX app and the carrying out of equality and human rights impact assessments.


  1. Is the Contact Tracing App Legal, Necessary and Proportionate?


14.              While insufficient public information exists over the form of the NHSX contact tracing app, and its impact on human rights, it is clear that, to function effectively, it will necessarily engage a range of rights.  International human rights law recognises that certain rights like the right to privacy, can be limited under specific conditions. Both the European Convention on Human Rights,[14] and the 1984 Siracusa Principles on the Limitations and Derogation Provisions in the International Covenant on Civil and Political Rights,[15] foresee response ‘to a pressing public or social need’ such as public health as a possible ground for the limitation of rights. However, they require that the essence of the right must not be undermined and the limitation must be prescribed by a ‘clear and accessible’ law, pursue a legitimate aim, be necessary and proportionate and ‘adequate safeguards and remedies’ put in place.[16] The measures must also be timebound and purpose-limited to the specific aim of ‘preventing disease or injury or providing care for the sick and injured’.[17]


15.              In its report, ‘Artificial Intelligence: How to Get it Right’, NHSX also commits to using a governance framework based on the Nuffield Council on Bioethics Principles for Data Initiatives.[18] These principles include, inter alia, respect for human rights and participation and accounting for decisions.


16.              In proposing to introduce the NHSX contact tracing app, it is not clear if these requirements and NHSXs own commitments have been taken into account.


Establishment in Law


8.               There is currently no clear and accessible legal basis underpinning the proposed contact-tracing app. Human rights law requires that any measure giving rise to an interference with human rights, must be ‘in accordance with the law’.[19] This means that, prior to introduction, any contact tracing app must have a clear legal basis and that legal basis must be of sufficient quality to protect against arbitrary rights interferences. As the European Court of Human Rights has held:


…the expression "in accordance with the law" not only requires the impugned measure to have some basis in domestic law, but also refers to the quality of the law in question, requiring that it should be accessible to the person concerned and foreseeable as to its effects. For domestic law to meet these requirements, it must afford adequate legal protection against arbitrariness and accordingly indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise.[20]


17.              Given the extent of the likely interference with human rights, and the introduction of extensive – potentially population-wide – surveillance, it is imperative that a dedicated legal basis for the deployment of contact tracing apps by the NHS is established. A clear and accessible legal basis includes specification of the circumstances in which the app may be deployed, how it can operate, how long it may operate for, how collected data will be managed and how access to information and insights will be restricted. These requirements must also ensure that the app is necessary and proportionate, and that safeguards are put in place, in line with the requirements discussed below.


18.              Reliance on compliance with data protection laws is critical and in the absence of the publication of the data protection impact assessment and the full details of the app, it is also unclear whether the app meets the requirements of the General Data Protection Regulation and the Data Protection Act 2018, including the exemptions for public health.[21] However, the scale of data collection, level of enrolment, degree of intrusion, level of public trust required and unprecedented nature of the COVID-19 emergency means that, as formulated, existing data protection regimes have insufficient scope to address the range of challenges at stake and therefore compliance with the data protection laws will not address the full equality and human rights implications of the app.


Purpose of the App


19.              There is little information in the public domain on the specific purpose(s) of the contact tracing app and whether they are tightly bound to ‘preventing disease or injury or providing care for the sick and injured’ as required by the Siracusa Principles. The Chief Executive of NHSX has noted that the ‘data will only ever be used for NHS care, management, evaluation and research’.[22] This appears to be a very broad and unclear purpose that could extend beyond prevention of the spread of COVID-19. As set out below, it may also affect the nature of agreements with other public bodies and private companies.




20.              While limitations on human rights should be timebound, there is no information in the public domain on whether the NHSX app will be subject to a time-limit or on the storage or deletion of the data.


Necessity and Proportionality


21.              The case law of the European Court of Human Rights requires that ‘relevant and sufficient’[23] justifications for any rights limitations be provided, and that these justifications be ‘convincingly established’.[24] In the context of COVID-19 contact tracing apps, this indicates that scientific justification must be both provided, and convincingly established. To date, it has not been clearly demonstrated that the proposed contact-tracing app can achieve the desired aims.


22.              Contact tracing is a common technique in public health surveillance.[25] It is used to identify people who may have been in contact with someone diagnosed with a virus in order to provide them with information about prevention and treatment. At this stage in the pandemic, contact tracing by humans is considered to have many limitations due to the labour required, the limited testing available and the spread of the virus.[26] In addition, considerable differences exist between the form of contact tracing suggested for the COVID-19 app and other forms of health contact tracing. For example, notable prior uses of contact tracing for diseases such as Ebola rely on transmission through direct contact.[27] These hold different implications for scale, anonymity and, potentially, defined purpose. Commentators have questioned whether contact tracing apps present an alternative to human contact tracing at all or whether they will only work in combination with other approaches, such as widespread testing.[28] NHSX has not clarified the conditions needed for the app to work and whether these conditions can be realised and it is therefore difficult to understand and assess its utility.


23.              NHSX has also not disclosed the percentage of users that will be needed for the app to work effectively. Professor Ross Anderson, the Ada Lovelace Institute and Privacy International, point out that if voluntary, there is likely to be a low-level of buy-in.[29] In Singapore, reports suggest only 17% of the population use the app.[30] However, Oxford researchers predict a much higher rate in the UK and argue that while a 60% take-up would work best, a lower rate of engagement could still contribute to a reduction in cases.[31] Organisations, such as the Ada Lovelace Institute , have suggested that voluntary uptake of the app will be integrally connected to the transparency, assurances, rights-protection, regulation and oversight in place, thus underscoring the importance that the app complies with the UK’s national and international human rights obligations.[32]


24.              The risk of denial of service attacks and abuse are high as is the likelihood of failing to report symptoms or diagnosis or reporting false information. This risk increases if adverse consequences attach to self-reporting, such as extended lockdown, inability to work or access public spaces. The Government has not stated whether there will be any consequences of failing to follow the advice of the app. Rather, NHSX has only noted that the ‘exact advice on what you should do will depend on the evolving context and approach’.[33]


25.              Moreover, even if scientifically justifiable, to constitute a proportionate measures, the Siracusa Principles (and international and regional jurisprudence[34]) set out that states must ‘use no more restrictive means than are required for the achievement of the purpose of the limitation’.[35] Thus, the burden lies with states to show that they cannot achieve the goal of preventing the spread of COVID-19 by ‘less-restrictive-means’, including non-technological. However, insufficient information exists in the public domain to assess whether the NHSX contact tracing app meets this requirement.


26.              First, the Chief Executive of NHSX has stated that, ‘the app will be part of a wider approach that will involve contact tracing and testing’.[36] However, the Government has not yet published details of what this wider approach entails. It is critical that the Government publish full details of its proposed wider approach; the basis for it; and the options it has considered and discounted. Moreover, it is vital that the credibility of the overall strategy is made available for independent oversight and scrutiny in order to justify the intrusion of the app on the basis of its claimed utility. Detailed information on the location of contact tracing apps within a wider strategy to preventing the further spread of COVID-19 and its treatment is necessary in order to being able to make assessments of the necessity and proportionality of contact tracing apps. It is also critical in order to ensure that there is not an overfocus on technological solutions or contact tracing apps, particularly given the digital divide that exists in the UK as set out above which may result in many people being denied their right to health through a lack of accessible information on health advice and ways in which to avoid exposure to COVID-19,[37] and that resources are not diverted away from investment in public health.[38]


27.              Second, the least restrictive means test provides strict parameters for the form and nature of contact tracing apps in order to minimise their impact on human rights. Design options to minimise the impact on rights include avoiding centralised databases, not using location or identifying proximity, interaction or aggregated forms of data, and data deletion. Tech companies, non-profits, civil society and academics, are actively investigating how apps could be designed to minimise the impact on privacy.[39]


28.              Currently, there is only partial information on the nature of the app in the public domain and whether in its design, the app minimises the impact on human rights, although it appears that NHSX will use a centralised database which has been identified as an element that heightens the risk to human rights, for example, through the potential to de-anonymise data and develop profiles of individuals’ social interactions,[40] as well as to data security. NHSX has explained that the app will be operate using Bluetooth by anonymously ‘logging the distance between your phone and other phones’.[41] This log will be stored on the user’s phone and the app can be deleted at any time. The Chief Executive for NHSX has explained that, ‘[i]f you become unwell with symptoms of COVID-19, you can choose to allow the app to inform the NHS which, subject to sophisticated risk analysis, will trigger an anonymous alert to those other app users with whom you came into significant contact over the previous few days’.[42]


29.              In terms of utility, there is little information over potential shortcomings of the technology. While it is clearly important to generate public confidence in the app, technological limitations hold a series of rights concerns.  For example, there are risks of false positives and amplified harms for particularly groups in positions of vulnerability, such as possibilities of false ‘connections’ between the walls of densely populated accommodation risking over-alerting in urban areas where need is greatest, positional vulnerability is highest and healthcare already most likely to be stretched. Many additional questions on the app remain, including:


30.              The Chief Executive of NHSX has also stated that,


In future releases of the app, people will be able to choose to provide the NHS with extra information about themselves to help us identify hotspots and trends. Those of us who agree to provide this extra information will be playing a key role in providing additional information about the spread of COVID-19 that will contribute towards protecting the health of others and getting the country back to normal in a controlled way, as restrictions ease.[43]


31.              There is no clarity on what this means. This is of particular concern as it appears to be suggesting even wider purposes; that identifiable information could be sought from the app; and that users who choose to do this will be making a positive contribution to the health protection and ending lockdown. Presented in this way could incentivise people to disclose data without meaningful consent and without realising the implications for their human rights. This again underscores the need for clarity and precision on the operation of the app and the regulation and governance framework rather than placing the burden on individuals to use the app with vague promises that it will bring about a change in circumstances.


Transparency on Involvement and Agreements in Place with Tech Companies and Other State Agencies


32.              NHSX had previously noted that it was working with Apple and Google on contact tracing apps but with no details on this arrangement, although this no longer appears to be the case. When appearing before the House of Commons, Science and Technology Committee, the Chief Executive of NHSX stated that, ‘I see no context in which [the data] would be shared with the private sector.[44] However, there is no information on what tech companies may have already had access to, and whether and how existing agreements have been terminated or revised.


33.              There is also little information on the current or future involvement or access to data by other state agencies. This is particularly important in relation to agencies such as law enforcement and immigration as significant inferences could be drawn from this data, even if anonymised. As has been underscored by the Director of the Privacy and Data Project at the Center for Democracy and Technology before the US Senate Committee on Commerce, Science and Transportation, ‘[s]uccessfully fighting the coronavirus will mean ensuring a government response does not evolve into law enforcement and broad surveillance functions’.[45] Clarity over the nature of such relationships, and detailed explanation of the uses of data (in its widest sense) could prove valuable in addressing public concerns and building trust.


34.              The purpose-limitation requirement as well as the least restrictive means test can prevent the repurposing of data by other state agencies (such as law enforcement or immigration authorities) as well as private companies for commercial purposes. However, as noted above, the purpose of the NHSX contact tracing app may be formulated much more widely than international human rights law permits.


35.              Where other actors, such as tech companies or state agencies are involved in the design or operation of the app, it is critical that the purpose limitation is enshrined within transparent agreements. These agreements should be made public, and as argued in a Joint Civil Society Statement by over 100 organisations in relation to businesses, they should contain ‘sunset clauses, public oversight and other safeguards by default’, including ensuring that ‘any intervention is firewalled from other business and commercial interests’.[46]


36.              To fully minimise the impact on human rights, further safeguards are needed to assess whether the involvement of other state agencies and private companies in the design and operation of the app is necessary and proportionate. This should include a presumption against involvement; independent oversight and assessment of the rationale for their involvement; temporary use of the apps; minimisation of the categories of data collected and processed through the apps;  and due diligence, vetting and scrutiny of the risks of involving other bodies, particularly private companies, based on their human rights records, including in digital surveillance. Vetting should include the possibility of external organisations, such as civil society, submitting evidence on such records.


37.              Another area of public concern that may have long term rights implications is the nature of long-term relationships and vendor lock in between particular technology companies and UK public bodies as a result of this specific collaboration.[47] Such concerns underline the need for greater transparency and public awareness of the procurement process.


38.              Transparency on such issues is crucial in order to foster public trust and gain a genuine sense of consent among app users.


Oversight Framework


39.              NHSX notes that it is working with an ethics advisory board but makes no reference to independent oversight, ongoing review and remedies.[48] Given the intended scope and reach of the app, and that its operation is conditional on extensive surveillance of the public, adequate oversight akin to that governing other forms of surveillance is required. Current documentation highlights the role of an ethics advisory board yet such mechanisms are restricted in their ability to address the range of issues at stake. Ethics boards are often implicated at the beginning of a process (authorisation) while oversight extends to cover the operation of surveillance technology and post-hoc review. Such forms of oversight could also provide a valuable mechanism for understanding the merits and deficiencies of similar responses to future pandemics.  An effective oversight framework could be rapidly mobilised and capitalise on approaches developed for other forms of surveillance, such as the Investigatory Powers Commissioner’s Office (IPCO). In addition, the oversight body could adopt additional responsibilities for public reporting. IPCO has achieved success in responsible public reporting of intelligence agency activity so it is likely that something similar could be achieved in this context.




40.              As set out in this submission, the NHSX app is likely to have significant implications for human rights. We therefore suggest that the Joint Committee on Human Rights request NHSX to provide full and transparent details of the app and the legal basis and proposed safeguards, oversight, accountability and remedial framework for the governance and regulation of the app to the Committee and the wider public alongside the data protection impact assessment already carried out. We also propose that NHSX urgently carry out and publish a full equality and human rights impact assessment.


41.              While time is of the essence, once this information has been entered into the public domain, we recommend that the Committee invite submissions on the human rights implications of the app and the regulatory and governance framework and that the Committee issue an urgent report on the app’s compliance with the UK’s national and international human rights obligations prior to the roll-out of the app.


42.              We also recommend that the Committee keep the implementation of the app under active review in order to ensure that its operation and the regulatory and governance framework can be revised or the app withdrawn, depending on the consequences to human rights. Parliamentary scrutiny and oversight do not replace the role of a dedicated oversight body or the courts but play an essential component in a matrix of monitoring and oversight to ensure the full protection of human rights during the COVID-19 pandemic.


Professor Lorna McGregor

Principal Investigator and Director


Professor Pete Fussey

Dr Daragh Murray

Dr Chris Fox

Dr Ayman Alhelbawy

Professor Klaus McDonald Maier

Dr Ahmed Shaheed

Professor Geoff Gilbert  

ESRC Human Rights, Big Data and Technology Project




[1] Human Rights Act 1998, article 2 (right to life); European Convention on Human Rights, article 2 (right to life); International Covenant on Civil and Political Rights 1966, article 6 and International Covenant on Economic, Social and Cultural Rights, article 12 (right to health).

[2] UN Committee on Economic, Social and Cultural Rights, ‘General Comment No 14: The Right to the Highest Attainable Standard of Health (Article 12 of the Covenant’ E/C.12/2000/4 (11 August 2000) at para. 12.

[3] This submission is based on a blog originally published in EJIL Talk!, Lorna McGregor, ‘Contact Tracing Apps and Human Rights’ EJIL Talk! (30 April 2020).

[4] Matthew Gould and Dr Geraint Lewis, ‘Digital contact tracing: protecting the NHS and saving lives’ NHSX (24 April 2020), available at: https://www.nhsx.nhs.uk/blogs/digital-contact-tracing-protecting-nhs-and-saving-lives/

[5] Dev Kundaliya, NHS Rejects Apple-Google API in Favour of Centralised Contact Tracing System’ Computing (28 April 2020)

[6] House of Commons, Science and Technology Committee, Oral evidence: UK Science, Research and Technology Capability and Influence in Global Disease Outbreaks, HC 136 (28 April 2020).

[7] Yuval Noah Harari, ‘Yuval Noah Harari: the world after coronavirus’ The Financial Times (20 March 2020) available at: https://www.ft.com/content/19d90308-6858-11ea-a3c9-1fe6fedcca75

[8] Christopher Haley et al, ‘There will be no ‘back to normal’ Nesta (9 April 2020) available at: https://www.nesta.org.uk/blog/there-will-be-no-back-normal/

[9] Office for National Statistics, ‘Exploring the UK’s Digital Divide’  (4 March 2019) available at: https://www.ons.gov.uk/peoplepopulationandcommunity/householdcharacteristics/homeinternetandsocialmediausage/articles/exploringtheuksdigitaldivide/2019-03-04

[10] Id.

[11] UN Working Group on Arbitrary Detention, ‘United Nations Basic Principles and Guidelines on the right of anyone deprived of their liberty to bring proceedings before a court’ WGAD/CRP.1/2015 (4 May 2015) at para 9.

[12] Carrie DeCell, ‘Can Governments Track the Pandemic and Still Protect Privacy: A Team of Europeans Thinks So’ Just Security (6 April 2020) https://www.justsecurity.org/69549/can-governments-track-the-pandemic-and-still-protect-privacy/

[13] For concerns about contact-tracing technologies, see reports by Access Now, ‘Recommendations on Privacy and Data Protection in the Fight against COVID-19’ (March 2020); Daniel Kahn Gillmor, ‘Principles for Technology-Assisted Contact-Tracing’ American Civil Liberties Union (16 April 2020); Ada Lovelace Institute, ‘Exit Through the App Store? Rapid Evidence Review’ (20 April 2020); Algorithm Watch, ‘Automated-Decision Making Systems and the Fight against COVID-19: Our Position’ (2 April 2020); Privacy International, ‘There’s an app for that: Coronavirus apps’ (20 April 2020).

[14] See, for example, Article 8(2),  9(2), 10(2), 11(2) European Convention on Human Rights.

[15] Section I(A)(10)(b), April 1985, available at: https://www.icj.org/wp-content/uploads/1984/07/Siracusa-principles-ICCPR-legal-submission-1985-eng.pdf

[16] Siracusa Principles, section I.

[17] Siracusa Principles, para 25.

[18] NHSX, ‘Artificial Intelligence: How to Get It Right’ (October 2019) https://www.nhsx.nhs.uk/media/documents/NHSX_AI_report.pdf

[19] Times Newspapers Ltd (Nos. 1 and 2) v. the United Kingdom, Judgment, ECtHR, App. Nos. 3002/03, 23676/03, 10 March 2009, para. 37; Big Brother Watch and Others v. the United Kingdom, Judgment, ECtHR, App. Nos. 58170/13, 62322/14, 24960/15, 13 September 2018, para. 304.

[20] Catt v. the United Kingdom, Judgment, ECtHR, App. No. 43514/15, 24 January 2019, para. 94.

[21] Schedule 3, Part 2, Data Protection Act 2018.

[22] Matthew Gould and Dr Geraint Lewis, ‘Digital contact tracing: protecting the NHS and saving lives’ NHSX (24 April 2020), available at: https://www.nhsx.nhs.uk/blogs/digital-contact-tracing-protecting-nhs-and-saving-lives/

[23] Catt v. the United Kingdom, Judgment, ECtHR, App. No. 43514/15, 24 January 2019, para. 109. Segerstedt-Wiberg and Others v. Sweden, Judgment, European Court of Human Rights, Application No. 62332/00, 6 June 2006, para. 88

[24] Autronic AG v. Switzerland, Judgment, ECtHR, App. No. 12726/87, May 22, 1990, para 61; Weber v. Switzerland, Judgment, ECtHR, App. No. 11034/84, May 22, 1990, para 47

[25] World Health Organization, Contact Tracing (9 May 2017) https://www.who.int/news-room/q-a-detail/contact-tracing

[26] Alejandro de la Garza, ‘What is Contact Tracing? Here’s How It Could Be Used to Help Fight Coronavirus’ Time (22 April 2020).

[27] World Health Organization, Contact Tracing, available at: https://www.who.int/csr/disease/ebola/training/contact-tracing/en/

[28] Sarah Bolsey, ‘NHS App, Testing, and Contact-Tracing: How Will the UK’s Coronavirus Plan Work?’ The Guardian (28 April 2020) available at: https://www.theguardian.com/politics/2020/apr/28/uk-contact-tracing-plans-an-nhs-app-and-an-army-of-health-staff

[29] Ada Lovelace Institute, ‘Exit Through the App Store? Rapid Evidence Review’ (20 April 2020); Privacy International, ‘There’s an app for that: Coronavirus apps’ (20 April 2020); Professor Ross Anderson, ‘Contact Tracing in the Real World’ (12 April 2020) available at: https://www.lightbluetouchpaper.org/2020/04/12/contact-tracing-in-the-real-world/?campaign_id=158&emc=edit_ot_20200413&instance_id=17604&nl=on-tech-with-shira-ovide&regi_id=92203289&segment_id=24985&te=1&user_id=499cd06b9db1b1406d960a894ac7486a

[30] Guardian, Digital contact tracing will fail unless privacy is respected, experts warn (20 April 2020) available at:


[31] Oxford University, ‘Digital contact tracing can slow or even stop coronavirus transmission and ease us out of lockdown’ (16 April 2020) https://www.research.ox.ac.uk/Article/2020-04-16-digital-contact-tracing-can-slow-or-even-stop-coronavirus-transmission-and-ease-us-out-of-lockdown

[32] Ada Lovelace Institute, ‘Exit Through the App Store? Rapid Evidence Review’ (20 April 2020); Privacy International, ‘There’s an app for that: Coronavirus apps’ (20 April 2020).

[33] Matthew Gould and Dr Geraint Lewis, ‘Digital contact tracing: protecting the NHS and saving lives’ NHSX (24 April 2020), available at: https://www.nhsx.nhs.uk/blogs/digital-contact-tracing-protecting-nhs-and-saving-lives/

[34] In relation to the UK’s obligations see, for example, Roman Zakharov v. Russia, Judgment, ECtHR, App. No. 47143/06, 4 December 2015, para. 260.

[35] Siracusa Principles, para 11.

[36] Matthew Gould and Dr Geraint Lewis, ‘Digital contact tracing: protecting the NHS and saving lives’ NHSX (24 April 2020), available at: https://www.nhsx.nhs.uk/blogs/digital-contact-tracing-protecting-nhs-and-saving-lives/

[37] See paras 1 and 8 above. For further details on the UK digital divide, see, Ofcom, ‘Digital divide narrows, but 1.1m UK homes and businesses cannot get decent broadband’ (15 December 2017); and in the context of COVID-19 specifically, see Tim Bradshaw, ‘The Next Digital Divide: Virus Contact-Tracing’ (21 April 2020) available at: https://www.msn.com/en-us/news/technology/the-next-digital-divide-virus-contact-tracing/ar-BB12YV7P

[38] Lisa Forman, ‘The Evolution of the Right to Health in the Shadow of COVID-19’ Harvard Health and Human Rights Journal (1 April 2020) available at: https://www.hhrjournal.org/2020/04/the-evolution-of-the-right-to-health-in-the-shadow-of-covid-19/; Javier Ruiz, ‘Contact Tracing Apps: No Substitute for Public Healthcare Interventions’ Bot Populi (21 April 2020).

[39] For example, see, Apple, ‘Apple and Google partner on COVID-19 contact tracing technology’ Newsroom (10 April 2020) available at: https://www.apple.com/newsroom/2020/04/apple-and-google-partner-on-covid-19-contact-tracing-technology/; Pan-European Privacy-Preserving Proximity Tracing, see https://www.pepp-pt.org/, MIT, Safepaths, https://safepaths.mit.edu/; Access Now, ‘Recommendations on Privacy and Data Protection in the Fight against COVID-19’ (March 2020); Daniel Kahn Gillmor, ‘Principles for Technology-Assisted Contact-Tracing’ American Civil Liberties Union (16 April 2020); Ada Lovelace Institute, ‘Exit Through the App Store? Rapid Evidence Review’ (20 April 2020); Privacy International, ‘There’s an app for that: Coronavirus apps’ (20 April 2020).

[40] For a discussion on centralisation, see Ada Lovelace Institute event, https://www.adalovelaceinstitute.org/contact-tracing-to-centralise-or-not-to-centralise-that-is-the-question/

[41] Id.

[42] Matthew Gould and Dr Geraint Lewis, ‘Digital contact tracing: protecting the NHS and saving lives’ NHSX (24 April 2020), available at: https://www.nhsx.nhs.uk/blogs/digital-contact-tracing-protecting-nhs-and-saving-lives/

[43] Id.

[44] House of Commons, Science and Technology Committee, Oral evidence: UK Science, Research and Technology Capability and Influence in Global Disease Outbreaks, HC 136 (28 April 2020).

[45] Statement of Michelle Richardson, Director, Privacy and Data Project Center for Democracy and Technology, Enlisting Big Data in the Fight Against Coronavirus Before the Committee on Commerce, Science, and Transportation April 9, 2020 available at: https://cdt.org/insights/cdts-written-testimony-in-senate-paper-hearing-on-privacy-big-data-in-coronavirus-response/

[46] Joint civil society statement: States use of digital surveillance technologies to fight pandemic must respect human rights (2 April 2020) https://www.amnesty.org/download/Documents/POL3020812020ENGLISH.pdf

[47] Oscar Williams, ‘Revealed: Palantir Commits 45 Engineers to NHS Coronavirus Data Project, Earns Just £1’ New Statesman (27 April 2020).

[48] Matthew Gould and Dr Geraint Lewis, ‘Digital contact tracing: protecting the NHS and saving lives’ NHSX (24 April 2020), available at: https://www.nhsx.nhs.uk/blogs/digital-contact-tracing-protecting-nhs-and-saving-lives/