Concern over ability of Covid-19 tracking app to fully protect user data

The Government’s Covid-19 tracker app has been criticised for failing to ensure the full protection of users’ data and offering “no clear evidence” that it will accurately detect close contacts with the disease.

The Irish Council for Civil Liberties (ICCL) and Digital Rights Ireland (DRI) on Thursday issued a report card on the smartphone app, which aims to stop the spread of Covid-19. The HSE says the app is "ready to launch" but has not specified when the public will be able to download it to their phones.

The app, delayed for several months as it went through design changes, uses a phone’s bluetooth function to alert someone if it indicates they have been in close contact with a person who is confirmed to have Covid-19.

The app records if a user is in close contact with someone else who has it installed by exchanging anonymous codes held on their phones. Those who test positive for Covid-19 will be able to choose if they want to anonymously alert other app users with whom they have been in close contact.

Ireland faces 'deep downturn' this year and may not rebound until 2024 if there is a second wave

---

A ‘rock’ and a ‘patriot’: Tributes paid to Tony Holohan as he steps back

---

Covid-19: Taoiseach pledges support and safe return to work for all

---

Tony Holohan stepping back from role as chief medical officer

---

The ICCL and DRI said the location data and symptom tracking used by the app extended beyond the single purpose of contact tracing and that there was no proof in documents published by the HSE and Department of Health that the app could improve the speed and accuracy of contact tracing.

“European data protection guidance says Covid-19 apps must pursue a single purpose of contact tracing to alert people potentially exposed to Covid-19,” said ICCL information rights director Elizabeth Farries. “Unfortunately, location data and symptom tracking extend beyond this single purpose.”

The report queries a HSE claim that the app can accurately detect 72 per cent of close contacts using the Google/Apple software. It cited research carried out at Trinity College which found that a 72 per cent accuracy rate may not be possible and that Bluetooth contact-tracing would struggle to discern whether contacts were more or less than 2m away.

The ICCL and Digital Rights Ireland published a “principled framework” for the development of the app last month, which outlined nine principles they said must be followed to ensure the app aligns with “legal and human rights requirements” and protects people’s privacy.

These included a call for the app to have a “clear and limited purpose”; that it embrace transparency and promote trust; that it be subject to “timely deletion of personal data”; that the design include privacy and data protection; and that it be subject to a “sunset clause”.

Thursday’s report card awarded the Government an overall grade of C+ for its efforts to develop an app to deal with contact tracing during the pandemic and commended the department and HSE for their “good faith efforts towards transparency” in publishing documentation related to the app’s development.

The HSE published key design and data privacy documents last week, including the app’s source code and a data protection impact assessment analysing the potential risks of the project.

A HSE spokeswoman said it welcomed external scrutiny of the app and would review the assesment by the groups.

“The app has followed a privacy by design methodology throughout its development and we are committed to openness and transparency in this important part of our public health response to Covid-19,” she said.