Scotland’s different path on contact tracing is to be welcomed, but questions remain
Scotland seems to be taking a different path on the question of covid19 contact tracing, while this is welcome, questions remain the need to make sure this works for all of Scotland.
Today, the Scottish Government released their Test, Trace, Isolate, Support guidance, setting out the role technology will play in Scotland. The guidance reveals that the Scottish Government will be operating its own test and trace system, developed by the Digital Health and Care Institute.
The recent discussion about the structure of contact tracing apps using Bluetooth have been side-stepped, and the status of the NHSX contact tracing in Scotland’s strategy is unclear.
Citing caution about privacy, trust, and uptake of proximity tracking tool, the First Minister said: “We’re not building our whole system around that.”
Importantly, this appears to signal a desire from the Scottish Government to only use technology that fit their strategy, rather than have their strategy fit the technological choices of others. This is to be encouraged.
The tool is a development on manual contact tracing where an individual, once a confirmed case from a test, is invited to enter details of other individuals they have been in contact with. This then generates an invitation to those individuals to track their symptoms, and if the symptoms escalate or persist the individual is invited to begin their own assessment and test.
This practice relies on individuals being in a position to know, personally, the individuals they have been in contact with. It seems it requires them to know these individuals phone number too, given the model in the paper released today suggests that the individuals would be invited to download via SMS.
This process is very different to the Bluetooth proximity tracing, a UK Government project, that is currently being tested on the Isle of Wight. This app, and the whole family of contact tracing apps, have been subjected to a significant amount of scrutiny about their effectiveness, data governance approaches, and even lawfulness.
The Scottish guidance does make reference to this proposed app but only to acknowledge its existence. It seems that the Scottish Government have not been involved particularly with the app development, and as a result they are seeking further discussions but at this stage it doesn’t form a core part of the strategic response.
While the Scottish Government can’t prevent individuals from downloading the NHSX app, by potentially removing it from a central role in NHS Scotland’s response, the Scottish Government may have just removed one of the big drivers for uptake of this app: social pressure in assisting public health response.
Instead of being distracted by a “will they, won’t they” storyline between the Scottish Government and NHSX it is now time to ask some questions of the Scottish Government’s system.
The Scottish tool is seeking to receive and store a large amount of personal data:
– an identified individual with covid19;
– the names of individuals they have been in contact with;
– the contact details of those individuals.
1. Has a Data Protection Impact Assessment been carried out? Will it be made public to ensure adequate standards of data governance are upheld?
2. What personal data is to be processed? Will location be recorded at all? (either automatically or provided by the user)
3. Who is going to be the data controller of that information?
4. Will the data be shared with any other bodies?
5. How long will the personal data be held for?
6. Will the data be matched with any other datasets?
7. Will the tool sort individuals across different categories (confirmed case, suspected contact-tool downloaded, suspected contact – tool not downloaded etc.)?
8. What happens if an individual, mistakenly or maliciously, uploads they had contact with an individual that they did not? Would that incorrectly uploaded individual be able to dispute or delete that personal data?
These are a few of the key questions – and there are always more- that Scottish Government and NHS Scotland will need to demonstrate leadership on. Open Rights Group are looking forward to seeing the steps taken by Scotland to safeguard the privacy of citizens during the pandemic and helping to improve.
The Government have clearly decided to take a different path to contact tracing, and that path is to be cautiously welcomed, now its time to see their thinking on why this path, and how it works for the rights of everyone in Scotland.
See more of ORG’s commentary on during covid19 on the Main Site.