Impact case study database

.

(i) Global impact: Design of protocol for privacy-protecting contact tracing

While manual contact tracing relies on COVID-positive individuals being able to name contacts and places they have been, contact tracing through smartphones potentially reaches a larger universe of individuals, anonymous to the infected person but nevertheless near them for long enough to be exposed to the virus (e.g. in public transport and some workplaces). As knowledge about all aspects of COVID-19 has continued to develop, the precise impact of digital contact tracing been subject to ongoing analysis. Early studies have suggested that digital contact tracing has the potential to ‘ meaningfully reduce the number of coronavirus cases, hospitalisations and deaths across the population’ at any level of uptake (S1), and statistical analysis of the NHS COVID-19 app has indicated that for every 1% increase in app users, the number of infections can be reduced by 2.3% (S2). Significantly, the DP-3T protocol allowed the deployment of apps which could achieve such effects in a privacy-protective way.

*Adoption of DP-3T by Apple and Google

On 10 April 2020, days after the DP-3T consortium published the first iteration of its White Paper and legal analysis (R1), Apple and Google announced a partnership to bring contact tracing to smartphones. The influence of DP-3T—and specifically the privacy-protective design advocated by Dr Veale—was publicly recognized:

‘Google’s Burke has acknowledged that his team was specifically inspired by the work of DP-3T, noting that he thought it “gives the best privacy preserving aspects of the contacts tracing service”. *One specific example inspired by DP-3T is the idea of using rotating codes … [which] allows the app to notify people who may have been exposed, without having to know their identities—or allowing those identities to be stored and tracked by any central authority.*’ (S3).

Facilitating deployment of decentralised apps around the world

Apple and Google’s dominance in the global smartphone operating system market meant that, with their adoption, the DP-3T protocol was embedded in the operating systems of approximately 94% of iPhones and 92% of Android devices. This facilitated rapid deployment by national authorities of decentralised apps. As of December 2020, official apps had been released by at least 65 national and regional public health authorities around the world, with many achieving significant uptake: e.g. Germany reporting 24.2m downloads by December 2020 (~45% of adult population); Italy reporting 10.13m downloads in December 2020 (~27% of adult population); Ireland reporting active user base of 1.31m in October 2020 (~34% of adult population) (S4) (generally only adults are permitted/recommended to download the apps).

Enabling of seamless contact tracing across borders

Decentralised contact tracing systems are, unlike centralised systems, able to interoperate across borders: they can be linked in such a way that individuals using one national app can be alerted if they have been in proximity to an infectious individual, even if the contact which exposed them is using a different national app. This advantage is particularly important for Northern Ireland and Ireland, and in continental Europe. T he decentralised design provided by DP-3T, supported by European Commission Implementing Decision 2020/1023 (establishing digital infrastructure for interoperability), has provided up to 372m people (excluding France and Hungary, which continued with centralised designs) with interoperable privacy-protecting contact tracing, supporting safer trade and personal mobility.

(ii) UK impact: Influencing scrutiny of UK government’s approach to contact tracing

As the DP-3T solution was being developed, Dr Veale, through the press, public events and Parliamentary evidence, stimulated and informed policy debate about legal concerns associated with contact tracing that could not be addressed by technical solutions; and about the desirability of decentralised (versus centralised) app design.

Informing policy debate about rights concerns raised by contact tracing apps

Although the protocol provided a means of privacy-protective digital contact tracing, it did not address other rights concerns associated with use of contact tracing apps and related technologies which might develop in future, particularly ‘immunity certificates’: could individuals be required to use an app or an immunity certificate as a condition of entry to venues, of eligibility for services or benefits? Could even anonymous data about individual movements be used for population-wide surveillance for reasons unconnected to management of COVID-19? The model Coronavirus (Safeguards) Bill 2020 (R5) co-authored by Dr Veale articulated and sketched means of addressing these concerns, adaptable for a centralised or decentralised app. The model Bill became a point of reference in policy discussion, helping raise awareness of the need for a more robust legal framework for digital contact tracing. The Biometrics Commissioner stressed that ‘ it is important that public trust in such [surveillance of COVID-19] is encouraged by regulation approved by Parliament as to the limitations of that surveillance’, and referred to the model Bill as evidence of what a group of lawyers believed would be necessary (S5). The Open Rights Group ( ORG), an NGO working on free expression and privacy issues in the digital age (to which Dr Veale contributes as an advisory council member), publicised the Bill on its blog, with the Executive Director of ORG testifying that the Bill ‘became an important part of our advocacy strategy’ for greater rights protections surrounding use of technology (S6).

In May 2020, Dr Veale was invited to give evidence to the Joint Committee on Human Rights, with Dr Veale and another co-author of the model Bill, Orla Lynskey (LSE), the only witnesses (other than the Information Commissioner) providing oral parliamentary evidence on the need for a legislative framework for the app. The Committee’s report, Human Rights and the Government’s Response to Covid-19: Digital Contact Tracing (S7) referred to the model Bill; and points raised in the model Bill, including the need for an independent commissioner to oversee use of the app, featured in the Committee’s own draft Bill, sent to the Secretary of Health on 7 May 2020. The Committee’s report embraced the point that use of the app ‘ raises issues that go beyond data protection and privacy’ (S7, p. 13). On 22 May 2020, the Secretary of State for Health rejected the immediate need for new legislation, but R5, and evidence drawing from it, shaped the first real policy discussion of questions that remain pressing for the future of contact tracing technology.

Influencing reversal of NHS England’s commitment to centralised contact tracing app

The UK government had initially invested in a centralised app for England and Wales, and continued on this course for months despite many European states opting for decentralised apps. Development of DP-3T provided a foundation for pressure to switch to a decentralised design. In May 2020, the UK Information Commissioner’s Office issued an opinion that the DP-3T model was ‘aligned with the principles of data protection by design and by default’ (S8); and Matrix Chambers published a legal opinion concluding that:

‘*A de-centralised smartphone contact tracing system – the type contemplated by “DP-3T” and being considered by governments across Europe and also Apple and Google – would be likely to comply with both human rights and data protection laws. In contrast, a centralised smartphone system – which is the current UK Government proposal – is a greater interference with fundamental rights and would require significantly greater justification to be lawful.*’ ( S9)

Dr Veale helped maintain pressure on the government to switch to the DP-3T model, giving oral evidence to the Joint Committee of Human Rights on differences between centralised and decentralised approaches (cited in the Committee’s report **(S7, pp. 7, 8)**); addressing groups like Labour Digital and the Society of Conservative Lawyers; and engaging actively with the media to improve understanding of the technology and privacy issues surrounding contact tracing (including BBC Radio 4 Today and PM programmes; Sky News; British Medical Journal; Mail Online; Guardian; New Statesman; Telegraph) (S10). Lord Clement-Jones CBE (Digital Spokesman for the Liberal Democrats in the House of Lords, and former Chair of the Lords Select Committee on Artificial Intelligence) has testified that the existence of the DP-3T protocol was ‘important and influential’ in enhancing understanding of the app possibilities in Parliament and ‘made visible the shortfalls of a centralised system’; it being ‘difficult to criticise fast-moving technological developments where alternatives do not exist’. Dr Veale’s research ‘supported [Lord Clement-Jones’] understanding of the stakes and the options, and directly informed questions asked in Parliament’ by Lord Clement-Jones, Baroness Ludford, Lord Scriven and Daisy Cooper MP (S11).

On 18 June 2020, the government abandoned the centralised app. An updated ‘NHS Covid-19’ app, using the decentralised design inspired by DP-3T, launched in September 2020. This allowed interoperability that would have been barred by a centralised design, with complete interoperability of apps in England and Wales, Scotland and Northern Ireland achieved by November 2020. It reduced risks of function and mission creep associated with the centralised approach, and assured users’ privacy was protected. In an indication that these features are valuable in inducing uptake, the NHS App Library description makes prominent reference to the fact that the app is ‘ designed so that nobody will know who or where you are’ ( S12). As of 31 December 2020, the app had been downloaded over 21m times (corresponding to ~44% of the adult population of England and Wales), and, on a statistical analysis, its use had averted approximately 594,000 cases of COVID-19 (S2).