Since the announcement of the NHSX contact tracing app, there has been considerable criticism by privacy advocates. However, contact tracing without the use of an app is going to risk lives and potentially lead to repeated lockdowns due to the associated inefficiencies and delays.

Jagvinder Singh Kang

Jagvinder Singh Kang

Let us illustrate this, by considering the simple scenario of a carrier of the virus, travelling on the London Tube. Not only is that carrier putting others at risk, but so is everyone that has been in close proximity to that carrier, including those who have entered and left the same carriage during the journey. Furthermore, all of those individuals, will no doubt come into contact with, and potentially infect, others during that day, the coming days and weeks, until they self-quarantine, either following testing or the appearance of symptoms.

Once someone is aware that they are a carrier of the virus, just think about how difficult and time consuming it would be, for that person to then work out: where that individual has been over the past week or so (when they were contagious); with whom that person has had contact during that time (including strangers); and how long the contact has been (to seek to determine exposure risk), such as passing someone whilst exiting the station, versus being seated close by to someone on the London tube.

In such circumstances, it is apparent that there will be delays in identifying those who are infected. Such delays will risk the R-Number exceeding one, as infected individuals continue to unknowingly infect others. This in turn, is likely to trigger another potential exponential wave of the coronavirus, thus triggering another lockdown. The resurgence of the virus in South Korea earlier this month is a startling reminder of this prospect.

The situation is made more complex, as certain individuals may not be aware at the time that they are coming into contact with others, that they are carriers. This may be due to the symptoms not being fully evident, or because the individuals are asymptomatic. In either case, such individuals will still be contagious.

Now consider the above scenario, where all contact with known and unknown individuals, timings of occurrence and exposure periods, are automatically processed, and infection risk warnings issued, without individuals even having to think about it. Those are the benefits the NHSX app provides. 

The NHSX app needs further work (and this is being undertaken), including from a data protection alignment perspective. Consequently, as I have already noted in my published paper, 'NHSX Covid-19 Tracing App-Nothing to Fear But Fear itself!' (published on 22 May 2020 by the Society for Computers and Law), it is not the case that the NHSX app is being proposed to be launched where it is devoid of privacy, security and utility considerations. It is important that privacy advocates do not overlook this, nor simply fuel alarmist negativity in respect of the NHSX app.

Unnecessarily undermining the UK public’s confidence in the NHSX app, will lead to a low uptake, which will not deliver the required efficacy for curbing the virus, thus costing further lives. This follows from reports which have suggested that an NHSX app uptake by at least 56% of the UK public is required, to help curb the virus (which translates into 80% of the UK public who have a smartphone).

Without the NHSX app, contact tracing will be resource and time intensive. This is already apparent from the need to have 25,000 contact tracers available for the government’s initial tracing programme. Such contact tracers will start by using interviews to determine who someone has been in contact with. As is apparent from the example above, this gives rise to difficulties when individuals are in proximity to strangers, or moving around so that their timing exposure with others is not easy to recall or verify.

If contact tracing purely through interviews could be effective in curbing the virus, one has to question why other countries have had to supplement their contact tracing operations with additional information, such as mobile location data and credit card transaction information. Of course, the NHSX app does not use any such privacy-intrusive information.

The irony is that privacy advocates who are raising alarmist concerns against the NHSX app, are failing to realise that the potential risks of privacy intrusion are significantly greater through non-app contact tracing compared to app contact tracing.

As privacy practitioners, we should be offering constructive solutions rather than undermining the huge efforts of the NHSX development team in seeking to provide a life saving app.


Jagvinder Singh Kang is international head of IT law at Mills & Reeve