Joint letter to Scottish Government and Digital Health and Care Institute

To,

Scottish Government (Jeane Freeman, Cabinet Secretary for Health and Sport)

cc Digital Health and Care Institute

We write to you as Scottish academics, activists, and policy specialists involved in human rights and the protection of privacy through law and technology, as academics involved public health, and as institutions committed to upholding human rights standards across Scotland. We are writing to request clarity on the data protection and human rights standards you have put in place to safeguard the personal data being collected, analysed and stored from the Digital Health and Care Institute’s tool documented in the Scottish Government’s Test, Trace, Isolate, Support framework[1].

While there has been a great deal of focus on the proposed NHSX app from the UK Government, we understand from Scotland’s Test, Trace, Isolate, Support framework that a different approach will be taken here for contact tracing. This process will rely on more familiar contact tracing techniques, with a digital component added in an effort to increase the efficiency.

We are supportive of this effort and want to assist in contributing to a system that responds to the pandemic responsibly, maintaining public trust and respect for fundamental rights

We welcome the Scottish Government’s more cautious approach, which would seem to have less privacy challenges than the proposed NHSX app. Yet collecting sensitive personal data at this scale will always attract a need to provide leadership and strong data protection by design.

We urge the Scottish Government to release more information about the tool and its functioning as soon as possible.

In particular, we ask:

Please release to the public the Data Protection Impact Assessments carried out on the proposed DHI tool.

Please release to the public the Equality and Human Rights Impact Assessments carried out on the proposed DHI tool.

Please provide the public with more information about how this tool will be accessed and accessible by people with all levels of digital literacy, will be accessible to those who are visually impaired, and across all languages spoken in Scotland.

Demonstrate to the public in a legally enforceable manner that:

• The data collected will only be used for contact tracing in the context of the COVID-19 pandemic;
• Will not be used for any other purposes; and
• Will be deleted once the pandemic has concluded. In particular this data should not be accessed by the Police nor Home Office e.g., for immigration enforcement purposes.

Release to the public the security standards that the tool operates to, and any security assessments that have been carried out to ensure the personal data collected will be secure, and the security of the system actively monitored.

Demonstrate to the public that there is adequate, independent oversight of the digital tool and that individuals are able to access their own data and bring complaints about how their data is being used to an independent oversight body.

Please ensure that the data which is collected through this digital tool is not available to NHSX and its corporate partners.

[1] https://www.gov.scot/publications/coronavirus-covid-19-test-trace-isolate-support/pages/11/

Sincerely

Organisations

Open Rights Group

Amnesty International

Human Rights Consortium Scotland

Individuals

Dr Angela Daly, Senior Lecturer, Co-Director of the Centre for Internet Law & Policy, School of Law, University of Strathclyde.

Professor Abbe E.L. Brown, Chair in Intellectual Property, University of Aberdeen.

Heather Burns, Internet Policy and Regulation Specialist.

Professor Lilian Edwards, Prof of Law, Innovation & Society, Newcastle University.

Dr Justine Gangneux, Research Associate, The University of Glasgow.

Arletta Górecka, PhD Candidate, School of Law, University of Strathclyde.

Dr Jay Gormley, Centre for Law Crime & Justice and Centre for Internet Law & Policy, University of Strathclyde.

Dr James Irvine, Reader, Electronic Engineering, University of Strathclyde.

Dr Darshana Jayemanne, School of Design and Informatics, Abertay University.

Kaspar Rosager Ludvigsen, PhD Candidate, University of Strathclyde.

Dr Shishir Nagaraja, Reader in Cybersecurity, University of Strathclyde.

Prof Mike Nellis, Emeritus Professor of Criminal and Community Justice, Law School, University of Strathclyde.

Judith Rauhofer, Senior Lecturer in IT Law, Associated Director of the Centre for Studies of Intellectual Property and Technology Law, School of Law, University of Edinburgh.

Prof Burkhard Shafer, Director, SCRIPT Centre for IT and IP Law, University of Edinburgh.

Ruchir Shah, member of UK Open Government Steering Group.

Prof Daniela Sime, Chair in Youth, Migration and Social Justice, School of Social Work and Social Policy, University of Strathclyde.

Dr Daniel R. Thomas, Chancellor’s Fellow, University of Strathclyde.