Open Letter: Contact Tracking and NHSX

Rachel Coldicutt
6 min readMar 23, 2020

As responsible technologists, we call upon the NHSX leadership and the Secretary of State for Health and Social Care to ensure new technologies used in the suppression of Coronavirus follow ethical best practice

Global map showing the spread of Coronavirus in shades of red
By Raphaël Dunant — Own work, data from 2019–20 coronavirus pandemic, List of countries and dependencies by population and Coronavirus map: The COVID-19 virus is spreading across the world, CC BY 4.0,

21 March 2020

During this global emergency, technology and data-driven decisions have a vital role in saving lives by delivering essential information, building communities and managing capacity across the NHS. But they are not a magic bullet to solve unsolvable problems. As Yuval Noah Harari says in the Financial Times this weekend, “We must act quickly and decisively. We should also take into account the long-term consequences of our actions.”

The imperative to innovate quickly, and the immense pressure being placed on teams within the NHS and NHSX to deliver at speed must not lead to ethical corners being cut that will undermine trust in the NHS.

As responsible technologists, we call upon NHSX leadership and the Secretary of State for Health and Social Care to urgently:

  1. Institute a culture of working in the open, with clear, regular public communication about projects being undertaken and the publication of machine readable data and models — to build trust and minimise speculation
  2. Introduce bold emergency governance measures, including privacy and rights impact assessments and the drafting of an expert governance panel, with public and patient participation, to ensure innovation works and is held to account
  3. Develop collective mechanisms for social license, to balance the needs of individuals and the benefit to society, ensuring the communities and groups affected by data collection have a say, and publish clear terms and conditions for any new applications, following in the footsteps of the Singapore government app TraceTogether.

Any technology initiatives put in place now to suppress Coronavirus must protect human rights, be proportionate and work within the rule of law — not least because they will set the template for what comes next in the delivery of health services in the UK.

This is vital because we understand that NHSX are looking at app-based solutions for tracking and managing Coronavirus.

Contact tracking has been a successful factor in suppressing Coronavirus in South Korea, but those technologies and the South Korean social and political context cannot be reproduced in the UK.* Information published by Oxford BDI and SAGE indicates that any digital contact-tracking app will instantly trace (and perhaps identify) individuals who are exposed to someone who has tested positive to Coronavirus.

There is little detail in the public domain about who will build the app, how it will work, how its effectiveness will be monitored and who will provide oversight over its proportionality and compliance with fundamental rights. It is unclear how data will be collected and processed, whether there are strict legal limitations on the purposes for which this data can be used now and in the future, how and where it will be stored, for how long, and who will have access to this data, either now or in the future.

Additionally, mobile phone data from O2, EE and BT is already being used to understand the movement of people; information about this is coming to light in a piecemeal and ad hoc way and it is unclear what this data is and who has access to it. Part 3, section 61A of the Investigatory Powers Act enables people with symptoms or a diagnosis of Coronavirus to be tracked without notice, and it is unclear if the UK government is following the practices developed during the Ebola crisis.**

At the same time, the Coronavirus Bill gives immigration officers and police the power to detain people if they have “reasonable grounds to suspect … a person is infectious”. The combination of this new bill with existing far-reaching data-gathering powers creates the risk that location and contact tracking technology could be used as a means of social control.

Too much, too late

Contact tracking is unlikely to be effective in a country where not everyone has a mobile phone, and where many people live in shared accommodation — not everyone who carries the virus can or will be tracked, and cell recognition is not good enough to differentiate between people who, for instance, live in a single block of flats. Not only does this kind of surveillance risk contravening human rights, but it is not guaranteed to work — particularly at this stage of the Coronavirus outbreak.

In the UK, OFCOM figures show that 22% of UK adults do not have a smartphone, rising to 45% of adults over 55, and figures on device ownership for young children vary wildly. Relying on this data exclusively risks reinforcing existing inequalities, especially if it could be used to establish reasonable or reliable grounds for a person to be detained.

It is not yet clear how data will be collected, or used, within the legal framework. Nor what technical safeguards will be used. We are also concerned that data collected to fight Coronavirus could be stored indefinitely or for a disproportionate amount of time, or will be used for unrelated purposes.

Testing times, do not call for untested new technologies.

These are testing times, but they do not call for untested new technologies. Ethical data-driven decision-making requires good governance, transparency and willingness to course correct. We ask that the CEO of NHSX and the Secretary of State for Health and Social Care prioritise putting the best practices outlined here at the heart of how new technologies are delivered by NHSX, for the good of everyone in the United Kingdom.


Rachel Coldicutt

Jeni Tennison, Open Data Institute

Sarah Gold, Projects by IF

Peter Wells

Frederike Kaltheuner

Lilian Edwards, Professor of Law, Innovation and Society, Newcastle Law School.

Michael Veale, Lecturer, Faculty of Laws, UCL

Ian Brown

Dr Elinor Carmi, Faculty of the Humanities and Social Sciences, Liverpool University

Jennifer Cobbe, Department of Computer Science and Technology. University of Cambridge

Gemma Milne, science and technology journalist

Dr Laura James

Prof Mark Graham, Oxford Internet Institute

Harriet Kingaby, Mozilla Fellow

Maria Niedernhuber, PhD student in cognitive neuroscience at the University of Cambridge

David Mann, dxw

Amina Ahmad

Iain Henderson, JLINC Labs

Dr Becky Faith, Institute of Development Studies, University of Sussex

Andew Eland

Cori Crider and Martha Dark, Foxglove

Catherine Stihler, Open Knowledge Foundation

Andrew Strait

Dr. Jonathan Andrew, Geneva Academy

Ghislaine Boddington — Speaker / curator — BDS Creative Ltd — body>data>space

Elizabeth Renieris, Fellow, Berkman Klein Center for Internet & Society at Harvard University

Pat Walshe, Privacy Matters

Umesh Pandya

Dr Amanda M L Taylor-Beswick

Elettra Bietti, Harvard Law School

Anna Bacciarelli

Gemma Shields

Mary Branscombe, technology journalist

Heather Burns

James Mullarkey,

Daragh O’Brien

Dr Garfield Benjamin

Gavin Starks,

Silkie Carlo, Big Brother Watch

Mark Surman, Mozilla

Sheila Hayman, Director’s Fellow, MIT Media Lab

Faine Greenwood, humanitarian technology researcher and writer

Dr Matthew Lariviere, UKRI Innovation Fellow of Ageing, Care and Technology, Centre for International Research on Care, Labour and Equalities at the University of Sheffield.

Denise McKenzie, Ben Hawes, Benchmark Initiative

Please add my name- Dr Ernesto Priego, Centre for Human-Computer Interaction Design, City, University of London

Jim Killock, Open Rights Group

Jake Jooshandeh, The RSA

Anushka Sharma, Founder, Naaut

James Jefferies

Daren Williams, Consorticon Group

Tom de Grunewalk, Open Rights Group, Forward Democracy

Prof Chris Marsden, University of Sussex

StJohn Deakins, CitizenMe

Dr Gerasimos Chatzidamianos, Manchester Metropolitan University

If you would like to add your signature to this letter, please email or leave your name in the comments below.

*See Q5 response from UK CMO Chris Whitty

*See and

Edited 24 March to correct a typo, re: the no of UK adults aged 55+ who do not use a smartphone.



Rachel Coldicutt

Exploring careful innovation, community tech and networked care. Day job: @carefultrouble .