New BCS study supports the COVID-19 Track & Trace app

The implementation of an app that traces Coronavirus contacts is necessary but must overcome “perceived Big Brother elements” to ensure the public get on board, a new report from BCS, The Chartered Institute for IT has found.

The proposed NHS contact tracing app will alert smartphone users if they are in – or have been – in close contact to someone who has tested positive for the COVID-19 virus.

The Chartered Institute for IT has today published its new policy position paper drawing on its members’ experience, which backs the technology, alongside extensive testing and a strong communications campaign to increase public confidence in the technical and ethical aspects of the app.

‘Big Brother’ elements of the app

Kathy Farndon, Vice President, BCS, The Chartered Institute for IT said: “The biggest threat to the success of the contact-tracing app is that perceived ‘Big Brother’ elements of the implementation, for example the use of a centralised database, may have a negative effect on uptake from the public and minimise the chance of reaching the 60% uptake implementation target. BCS considers that a sustained campaign to increase public confidence in IT, supported by assurances of real safeguards, open and ethical data governance and protection by design is fundamental.

“Contact tracing apps must be founded on ‘privacy by design, privacy by default’ principles and Government must set a high bar for transparent and ethical data governance as its future legitimacy and trust with public data is at stake.”

She continues: “It is vital that the impacts of a contact tracing app – as part of the UK’s response to COVID-19 – are considered in terms of the key challenges it presents such as data protection, privacy, public trust and civil liberties.”

BCS makes several recommendations that the government, public health authorities and developers should consider when developing contact-tracing apps including:

1. Facilitate mass levels of COVID-19 testing to work in tandem with the contact tracing app, “you cannot ‘big data’ your way out of a ‘no data’ situation”
2. Engage and work strategically across the UK’s devolved administrations, with civil society to develop and implement a wide-ranging, inclusive communication programme regarding app installation and use, including guidelines on what is needed for maximum compliance and how the public can appropriately seek recourse
3. Ensure minimum interference with people’s personal ‘data’ lives and that data isn’t sold or shared beyond its intended stated purpose

A spokesperson for the Information Comissioner’s Office said: “We are reviewing the Data Protection Impact Assessment for NHSX’s pilot of its contact tracing app in the Isle of Wight. We’ll feedback our comments as quickly as possible so that they can be usefully included in the learnings from the trial.”

About Data Protection Impact Assessment (DPIA)

DPIAs are used by organisations to help them identify and minimise the data protection risks of a project.

The law only requires organisations to consult the ICO if, through their DPIA, they identify a high risk which they can’t mitigate. The ICO can then provide advice, but it is not an approval process.

More detailed information about DPIAs can be found here.

About BCS, The Chartered Institute for IT

The purpose of the BCS is to promote and advance the education and practice of computing for the benefit of Society as a whole. We bring together industry, academics, practitioners and Government to share knowledge, promote new thinking, inform the design of new curricula, shape public policy and inform the public.

As the professional membership and accreditation body for IT, we serve over 60,000 members including practitioners, businesses, academics and students, in the UK and internationally. We also accredit the computing degree courses in ninety-eight universities around the UK and offer a range of widely recognised professional and end-user qualifications.

For further information visit https://www.bcs.org/