Open Letter: Contact Tracking and NHSX
As responsible technologists, we call upon the NHSX leadership and the Secretary of State for Health and Social Care to ensure new technologies used in the suppression of Coronavirus follow ethical best practice
21 March 2020
During this global emergency, technology and data-driven decisions have a vital role in saving lives by delivering essential information, building communities and managing capacity across the NHS. But they are not a magic bullet to solve unsolvable problems. As Yuval Noah Harari says in the Financial Times this weekend, “We must act quickly and decisively. We should also take into account the long-term consequences of our actions.”
The imperative to innovate quickly, and the immense pressure being placed on teams within the NHS and NHSX to deliver at speed must not lead to ethical corners being cut that will undermine trust in the NHS.
As responsible technologists, we call upon NHSX leadership and the Secretary of State for Health and Social Care to urgently:
- Institute a culture of working in the open, with clear, regular public communication about projects being undertaken and the publication of machine readable data and models — to build trust and minimise speculation
- Introduce bold emergency governance measures, including privacy and rights impact assessments and the drafting of an expert governance panel, with public and patient participation, to ensure innovation works and is held to account
- Develop collective mechanisms for social license, to balance the needs of individuals and the benefit to society, ensuring the communities and groups affected by data collection have a say, and publish clear terms and conditions for any new applications, following in the footsteps of the Singapore government app TraceTogether.
Any technology initiatives put in place now to suppress Coronavirus must protect human rights, be proportionate and work within the rule of law — not least because they will set the template for what comes next in the delivery of health services in the UK.
Contact tracking has been a successful factor in suppressing Coronavirus in South Korea, but those technologies and the South Korean social and political context cannot be reproduced in the UK.* Information published by Oxford BDI and SAGE indicates that any digital contact-tracking app will instantly trace (and perhaps identify) individuals who are exposed to someone who has tested positive to Coronavirus.
There is little detail in the public domain about who will build the app, how it will work, how its effectiveness will be monitored and who will provide oversight over its proportionality and compliance with fundamental rights. It is unclear how data will be collected and processed, whether there are strict legal limitations on the purposes for which this data can be used now and in the future, how and where it will be stored, for how long, and who will have access to this data, either now or in the future.
Additionally, mobile phone data from O2, EE and BT is already being used to understand the movement of people; information about this is coming to light in a piecemeal and ad hoc way and it is unclear what this data is and who has access to it. Part 3, section 61A of the Investigatory Powers Act enables people with symptoms or a diagnosis of Coronavirus to be tracked without notice, and it is unclear if the UK government is following the practices developed during the Ebola crisis.**
At the same time, the Coronavirus Bill gives immigration officers and police the power to detain people if they have “reasonable grounds to suspect … a person is infectious”. The combination of this new bill with existing far-reaching data-gathering powers creates the risk that location and contact tracking technology could be used as a means of social control.
Too much, too late
Contact tracking is unlikely to be effective in a country where not everyone has a mobile phone, and where many people live in shared accommodation — not everyone who carries the virus can or will be tracked, and cell recognition is not good enough to differentiate between people who, for instance, live in a single block of flats. Not only does this kind of surveillance risk contravening human rights, but it is not guaranteed to work — particularly at this stage of the Coronavirus outbreak.
In the UK, OFCOM figures show that 22% of UK adults do not have a smartphone, rising to 45% of adults over 55, and figures on device ownership for young children vary wildly. Relying on this data exclusively risks reinforcing existing inequalities, especially if it could be used to establish reasonable or reliable grounds for a person to be detained.
It is not yet clear how data will be collected, or used, within the legal framework. Nor what technical safeguards will be used. We are also concerned that data collected to fight Coronavirus could be stored indefinitely or for a disproportionate amount of time, or will be used for unrelated purposes.
Testing times, do not call for untested new technologies.
These are testing times, but they do not call for untested new technologies. Ethical data-driven decision-making requires good governance, transparency and willingness to course correct. We ask that the CEO of NHSX and the Secretary of State for Health and Social Care prioritise putting the best practices outlined here at the heart of how new technologies are delivered by NHSX, for the good of everyone in the United Kingdom.
Signed
Rachel Coldicutt
Jeni Tennison, Open Data Institute
Sarah Gold, Projects by IF
Peter Wells
Frederike Kaltheuner
Lilian Edwards, Professor of Law, Innovation and Society, Newcastle Law School.
Michael Veale, Lecturer, Faculty of Laws, UCL
Ian Brown
Dr Elinor Carmi, Faculty of the Humanities and Social Sciences, Liverpool University
Jennifer Cobbe, Department of Computer Science and Technology. University of Cambridge
Gemma Milne, science and technology journalist
Dr Laura James
Prof Mark Graham, Oxford Internet Institute
Harriet Kingaby, Mozilla Fellow
Maria Niedernhuber, PhD student in cognitive neuroscience at the University of Cambridge
David Mann, dxw
Amina Ahmad
Iain Henderson, JLINC Labs
Dr Becky Faith, Institute of Development Studies, University of Sussex
Andew Eland
Cori Crider and Martha Dark, Foxglove
Catherine Stihler, Open Knowledge Foundation
Andrew Strait
Dr. Jonathan Andrew, Geneva Academy
Ghislaine Boddington — Speaker / curator — BDS Creative Ltd — body>data>space
Elizabeth Renieris, Fellow, Berkman Klein Center for Internet & Society at Harvard University
Pat Walshe, Privacy Matters
Umesh Pandya
Dr Amanda M L Taylor-Beswick
Elettra Bietti, Harvard Law School
Anna Bacciarelli
Gemma Shields
Mary Branscombe, technology journalist
Heather Burns
James Mullarkey, notochrome.org
Daragh O’Brien
Dr Garfield Benjamin
Gavin Starks, IcebreakerOne.org
Silkie Carlo, Big Brother Watch
Mark Surman, Mozilla
Sheila Hayman, Director’s Fellow, MIT Media Lab
Faine Greenwood, humanitarian technology researcher and writer
Dr Matthew Lariviere, UKRI Innovation Fellow of Ageing, Care and Technology, Centre for International Research on Care, Labour and Equalities at the University of Sheffield.
Denise McKenzie, Ben Hawes, Benchmark Initiative
Please add my name- Dr Ernesto Priego, Centre for Human-Computer Interaction Design, City, University of London
Jim Killock, Open Rights Group
Jake Jooshandeh, The RSA
Anushka Sharma, Founder, Naaut
James Jefferies
Daren Williams, Consorticon Group
Tom de Grunewalk, Open Rights Group, Forward Democracy
Prof Chris Marsden, University of Sussex
StJohn Deakins, CitizenMe
Dr Gerasimos Chatzidamianos, Manchester Metropolitan University
If you would like to add your signature to this letter, please email hello@careful.industries or leave your name in the comments below.
—
*See Q5 response from UK CMO Chris Whitty
*See https://www.gsma.com/mobilefordevelopment/wp-content/uploads/2014/10/gsma-Ebola-Mobile-Response-Blueprint.pdf and https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_statement_2020_processingpersonaldataandcovid-19_en.pdf
Edited 24 March to correct a typo, re: the no of UK adults aged 55+ who do not use a smartphone.
