Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what data risk assessment has been carried out for the new covid-19 tracing app being developed by NHSX.

The COVID-19 contact-tracing app will give the public a simple way to make a difference and to help keep themselves and their families safe. It will be one of a number of tools we use in the fight against COVID-19 but it will be voluntary. People will have the choice of whether or not to download the app and they will be able to delete it whenever they like. If users delete the app, all data stored on the phone and not shared with the National Health Service would be deleted. If users do not opt to share their data, it will be deleted on a continuous 28-day cycle within the app, on the phone. We intend to withdraw the app once the epidemic is over.

It is entirely possible for users to use the app without providing personally identifiable data or location data (unless they wish to request a test). We hope the public will opt-in to donate more data, which will help the NHS to understand and manage the pandemic.

We will always comply with the law around the use of data, including the relevant provisions of the GDPR and the Data Protection Act 2018.

We have been consulting on our plans with the Information Commissioner, the National Data Guardian’s Panel and the Centre for Data Ethics and Innovation, as well as with representatives from Understanding Patient Data and volunteers who provided a patient and public perspective. We have established an ethics advisory board for the app, chaired by Professor Sir Jonathan Montgomery from University College London who previously headed the Nuffield Council on Bioethics. This expert input, and the rigorous design process will ensure the data is free from bias and meets the highest standards. We will be publishing a Data Protection Impact Assessment in due course.