Written Evidence to the Science and Technology Committee

Dr Audrey Guinchard, School of Law, University of Essex and

Dr Subhajit Basu, School of Law, University of Leeds

We are writing as two academics working in the fields of data protection law and regulation of emerging technologies.  Dr Audrey Guinchard is a Senior Lecturer (Law), the University of Essex and Dr Subhajit Basu is an Associate Professor (Law) at University of Leeds and Chair of BILETA. Dr Guinchard latest paper has focused on DeepMind, now absorbed by Google Health UK. Dr Basu is co-author of the critically acclaimed book Privacy and Healthcare Data: Choice of Control to Choice and Control. Routledge, 2016)

Our submission presents a legal perspective on technological issues and highlights where the technology needs to evolve to comply with the legal provisions. This concerns the Committee’s terms of reference n. 5 and n. 7: ‘the capturing during the crisis of data of the quantity and quality needed to inform’; and ‘the UK’s readiness for future outbreaks’.

Summary of proposed steps:

1. In the circumstances, and in light of current legal guidance on the GDPR, consent is very unlikely to justify processing for the Covid-19 app. NHS X should explain as to why they still consider consent as the ground to justify the processing, especially for research purposes. (issue 1)

2. Regarding the use of Bluetooth technology, the discussion around the NHS X app has revealed wider underlying issues that need investigation so that trust in the smartphone ecosystem can be re-established.  (issue 2)

3. Finally, the Government should consider how it could weave more efficiently the digital technologies into its management of public health beyond the Covid-19 app. It may want to consider a public consultation leading to a White paper. (issue 3)

Page 5 of 5

Introduction – Our focus and objectives

We are not opposed to the ‘contact tracing app’. Our focus is to improve the environment in which this innovative technology is being developed.

In this submission, we are not repeating what has been discussed; instead, we want to add to the existing discussions, bringing to the Committee new perspectives on the current debate about the Covid-19 app and beyond this pandemic.

We think that the Covid-19 issues are not specific to the pandemic. Some of the problems reflect the recurring challenges that the NHS faces for the development and use of digital technologies, along with inherent problems that exist in the development and use of smartphone technology. The solutions lie not in the change of the law, but in better strategic decisions and in the technology underlining the processing of personal data acknowledging that it ‘should be designed to serve mankind’ (Recital 4 GDPR).

1 – The use of consent to justify the processing

The processing of sensitive personal data, i.e. health data, cannot on principle be processed (Article 9(1) GDPR) unless specific grounds apply and justify the processing (Article 9(2) GDPR, and Article 6 GDPR). Consequently, the processing by NHS X remains an exception and, as all exceptions in the law, it calls for a restrictive interpretation that colours the decisions NHS X has to take for processing.

Articles 6 and 9 GDPR allow consent as a means to justify processing. If consent is used, it must be free, informed, specific and unambiguous (Article 4(11) GDPR; Recital 43 GDPR). Consent is not free when there is an imbalance of power between the data subject (the app user) and the controller (NHS X), whereby the data subject feels s/he cannot refuse the use of the technology without fearing negative consequences.[1] Consent for undertaking scientific research has been expressly discouraged.[2] In addition, when relying on consent, the controller must provide for the withdrawal of consent and the ensuing deletion of the data at any given time.

For Covid-19 apps, on 4 May 2020, the ICO pointed out that the voluntary download of the app is not ‘consent’ for the purpose of the GDPR.[3] Nevertheless, it leaves the door open to consent, mentioning that other grounds may be ‘more appropriate, such as performance of a task in the public interest (particularly where an app is developed by or on behalf of a public health authority).’[4] The Joint Committee on Human Rights has also pointed out that the consent model is broken. [5]  The EU regulator has indicated as early as 16 March 2020 that consent is an unlikely ground, and that public authorities should rely on a public interest ground.[6] The French data protection regulator on 24 April 2020 has discarded consent for the French centralised Covid-19 app, explaining instead that the public interest ground should be used (Article 6(1)(e) GDPR) as well as the public health ground (Article 9(2()(i) GDPR). [7] The French regulator has now welcomed the use of these grounds in the draft statutory instrument which the French Government is proposing on its Covid-19 app.[8]

NHS X has continuously indicated that consent will be sought, presenting consent as an indicator of its commitment to privacy and the law.[9] It is however extremely unlikely that consent can justify the processing, especially for research. The trial of the app, i.e. the live testing in the Isle of Wight, is likely to be considered as research, and therefore would fall under Article 9(2)(g) GDPR, the ground for scientific research, not under consent. NHS X seems to confuse the voluntary nature of using the app with the legal justification for processing data, despite the ICO having expressly pointed out the difference.[10] Consequently, NHS X appears misguided as to the use of consent to justify the processing.

If consent were to be used, not only it needs to be free but also unambiguous, specific and informed. Reasonable expectations of users are here important to understand what they are consenting to. Given the context, a pandemic, expectations reasonably centre around medical research. As it transpired, the Ministry of Defence envisages to move and use the data for behavioural research.[11] For most users, this research is not within their reasonable expectations. And therefore, consent would be negated. In addition, Recital 33 GDPR indicates that broad consent can only be tolerated as a temporary measure. Data subjects so users of the app would need to have the opportunity to provide further consent to certain defined, specific, areas of research.[12]

Our questions:

• Has the Committee considered asking NHS X the reasons behind the use of consent for each use of the data (for example, research and tracing)?
• Has NHS X considered how they would ensure that for scientific research purposes, consent will consistently remain free, unambiguous, informed and specific (i.e. not broad consent)?

2 – Bluetooth             

The technology was initially developed to connect two devices within close range, like headphones to a computer. A new use was invented, transforming Bluetooth into a proximity tracing tool for commercial benefits.[13] This tracing function of Bluetooth is going to be used in the Covid-19 tracing app. We think this raises security and human rights issues. The following focuses on the latter: the privacy risk and how technological solutions could help to minimise the risk.

By adopting this technology for the purpose of tracing, the re-purposing of Bluetooth has highlighted its inherent drawbacks, notably the difference in signal strength depending on the model, make, and OS system considered.[14] This lack of standardisation obliges developers to request access to the phones’ identifying information. At present the processing of this additional information can be deemed necessary; but in the medium term, an argument can be made for standardisation of signal strength being a better alternative to fulfil the requirement of data minimisation in the GDPR. Given Android’s dominance at 75% of the smartphone market, exploring how to achieve standardisation is likely to make Bluetooth more privacy-friendly.

Furthermore, while the app does not collect location data, in an Android operating system, for the app to perform, the user has to allow access to location data in order to use Bluetooth.[15] NHS X does not address the issue it creates by its use of Bluetooth. In effect, the app reveals a systemic and long-standing issue in the Android operating system. The design of the operating system is not privacy-friendly because the user will have to make a concerted effort to switch off location for each app, assuming this is possible for every app and that the operating system does not collect location data either. This issue has not been raised for iOS operating systems as iOS does not request access to location data for Bluetooth to function. In data protection terms, the difference between Android and iOS means that one operating system (iOS) complies with the data minimisation requirement but not the other (Android). This is privacy by design issue (Article 25, GDPR). It affects 75% of smartphone users, putting more users in a disadvantageous position. This issue is beyond the NHS X app, but it is such a fundamental element of the smartphone ecosystem that in our view, the Committee should consider directing ICO to investigate.

Our questions:

• In the short term, shall the Committee intervene and ask NHS X to discuss the matter with the various stakeholders involved in the use of Android operating systems?
• In the medium term, should the Committee explore other avenues, including asking the Government and ICO to outline a strategy to tackle the inherent weakness in the ecosystem regarding data protection by design? 

3 – ‘Exercise Cygnus’ (we also raised this issue before the Joint Committee on Human Rights)

Exercise Cygnus conducted in October 2016 involved all major departments (including NHS), and local authorities across Britain. As we understand, it showed gaping holes in terms of preparedness, resilience and response plans. The report published by the Guardian (not yet confirmed or denied by the Department of Health and Social Care) does not seem to mention the use of digital technologies. The capability to create digital contact tracing apps already existed in 2016; the NHS was already considering apps for some specific direct care issues as part of its strategy to enhance care.[16] This raises the question as to why the use of digital apps to support the response to the exercise was not discussed.

Our questions:

• Why in 2016 were the digital technologies not considered? To have done so would have increased government capability to respond and save lives. It would have given public authorities the time to consider complex technical and legal issues without the pressure of an unfolding real-time pandemic.
• Should the Government consider a public consultation leading to a White paper to explore the development and use of digital technologies as part of its public health management strategy?

Page 5 of 5