The Health Service Executive released key design and data privacy documents ahead of the launch of its Covid-19 tracking app.
The smartphone app, designed to facilitate the contact tracing process, is expected to be available in the coming days.
Data protection and civil liberties groups gave the publication a cautious welcome, praising the HSE and Department of Health for their transparent approach. But they reiterated some concerns about the app’s effectiveness
The published documents include the source code of the application, or its basic computing structure, as well as a data protection impact assessment, a document analyzing the potential data protection risks of a given project.
Read the documents here.
A product explainer and a series of reports on application design and development have also been published on the HSE website. The app, which was delayed for months due to design changes, uses a phone’s Bluetooth feature to alert someone if it indicates it has been in close contact with someone they are confirmed that she has Covid-19.
The app records whether a user is in close contact with someone else who installed it, by exchanging anonymous codes kept on their phone. Those who test positive for Covid-19 will be able to choose whether they wish to anonymously alert other app users with whom they have been in close contact.
The contact tracing app initially faced opposition from data protection, civil liberties and privacy campaigners, who raised concerns about how the data would be stored and processed. Issues have also been raised regarding the app’s technological limitations and how it works on the most popular smartphone models.
These have largely been resolved, after the HSE decided to develop the app on a decentralized basis, meaning the data would not be collected and stored centrally by the state, but would largely remain party on users’ phones. Issues with the operation of contact tracing apps have been resolved in collaboration with Apple and Google, who have developed a platform to allow them to run on their operating systems.
Some concerns remain, however, about the effectiveness of the Bluetooth technology on which the contact tracing element is based. Researchers at Trinity College Dublin questioned the accuracy and efficiency of measurements provided by Bluetooth, especially in crowded environments.
Elizabeth Farries, director of the Irish Council for Civil Liberties (ICCL) Information Rights Programme, said she was pleased that the HSE and the department had released the material ahead of the launch and encouraged by the department’s engagement with “our panel of experts to encourage diverse viewpoints”. and entries.
However, she said she still had concerns about the Bluetooth technology at the heart of the app, saying ‘signal strength is not a reliable way to detect contact with people infected with Covid-19’. .
TJ McIntyre, chairman of advocacy group Digital Rights Ireland (DRI), welcomed the creation of an advisory board that will assess the effectiveness of the Covid-19 app, and the inclusion of a ‘self-destruct’ mechanism which will see injury enforcement within 90 days if deemed ineffective.
HSE Chief Information Officer Fran Thompson said its development was “informed by a robust development and testing programme”. HSE chief executive Paul Reid said the app “will be an important part of our test and trace measures”.
Mr Reid said it will “augment existing contact tracing operations by quickly notifying users if they have been a close contact of a confirmed case, allowing users to record symptoms and providing a trusted source information about Covid-19”.
The HSE said data processing will be limited to the stated purpose of the app. “All personal data processed is kept to a strict minimum. Users can choose to delete the app at any time and have full control over the information they share through the app.
The Health Service Executive has pledged to dismantle the app once the Covid-19 crisis is over.
In a joint statement, ICCL and DRI said: “We understand the terrible reality of Covid-19 for the population and everyone wants to do everything possible to fight Covid-19. However, to ensure that Ireland’s Covid-19 tracking app is effective, respects rights and legalities and adheres to our expert’s principled framework, we encourage the app’s advisory board to include a member of society civil. The Irish Council for Civil Liberties is available and willing to participate.
Daragh O’Brien, managing director of consultancy firm Castlebridge, said the level of disclosure “is impressive” and “to be commended”. “I can’t fault the structure of this one. . . the amount of disclosure of what has been done is a very good reference for other public bodies.
Mr O’Brien said he would be “concerned that the functioning and operation of the app does not meet all of the consent requirements under the GDPR and that other alternative bases of processing may be available for them without compromising the voluntary basis of the app.” He argued that the fact that it has multiple functions, including symptom tracking, alongside its main contact tracing app, could prove problematic.
The inclusion of several functions, he said, goes against the advice given by the European Data Protection Board in April, but a justification is at least presented for this in the evaluation of the impact on data privacy. “They said the focus of contact tracing apps should be limited to contact tracing, and the HSE has defined that to include symptom onset data here.”
How the application governance works will be a key future test to ensure that only the effective and necessary elements remain in use.
In a blog post, Nearform – which developed the app – said contact tracing apps are “pushing smartphone technology to its limits”.
“The reality is that all of these smartphones were never designed to facilitate contact tracing. Bluetooth technology was not created to allow this type of communication between devices. Yet that is what we have. The technology may not be perfect, but it is effective and available.