PRIVACY campaigners have welcomed Scotland’s caution on using a controversial UK Government app to try to halt the spread of Covid-19. However, the Scottish Government has been urged to give more details on its own plans for a digital tool to help the tracing of coronavirus cases as lockdown eases.

The UK Government is currently testing its contract tracing app on the Isle of Wight, which is aimed at letting people know if they have been in close proximity with someone who later reports positive for the virus.

It has been developed by NHSX – a digital unit under both the UK Department of Health and NHS England.

While the downloading of the app won’t be compulsory, it is seen as a key part of Downing Street’s strategy on lifting coronavirus restrictions.

UK Health Minister Matt Hancock urged people to use it, saying: “You’re protecting your own health, you’re protecting the health of your loved ones and the health of your community.”

Last week a report from the House of Commons joint committee on human rights said the NHSX app could help pave the way out of the lockdown and prevent the spread of coronavirus.

But it warned in its current form it did not sufficiently protect the right to privacy and a lack of data protection measures could make it illegal.

Committee chair Harriet Harman said: “The contact tracing app involves unprecedented data gathering.

“There must be robust legal protection for individuals about what that data will be used for, who will have access to it and how it will be safeguarded from hacking.”

One key concern raised is the way in which the NHSX app will store data using a centralised database.

This is in contrast to the “decentralised” approach being taken in many other countries developing similar apps, which instead keeps data on the phone.

Dr Julie Nixon, senior associate and expert in IP and data protection law at Scottish law firm Morton Fraser, said both systems worked in a similar way using Bluetooth to “match” to someone who has tested positive for coronavirus.

But she said: “With the decentralised system, if you’ve been near somebody who has been diagnosed [with Covid-19] the match happens on your phone.

“In the case of the UK app, there’s an NHS database which the data gets uploaded to and the match happens within that database.”

Nixon added that while the data in this system would be anonymised, there were concerns it could be linked to other pieces of information and potentially be used to identify an individual.

“That’s what people are nervous about – if you’ve got a whole database of big data, there is the potential for misuse,” she said. “The bottom line is centralised or decentralised, it is still anonymised data.

“But with the decentralised approach that data never goes anywhere, it doesn’t get uploaded to a central database.

“I wouldn’t imagine it would be an easy endeavour, but if there was some way to create personal data [from the centralised database] or if somebody hacked into it, there is a potential for misuse.”

Tech giants Apple and Google explicitly ruled out using the “centralised” model after teaming up to develop technology which turns phones into contact tracing devices.

And on Thursday it was reported the UK Government may yet ditch the NHSX centralised app to use the Apple and Google system instead.

The Scottish Government has chosen to take a different approach, which includes refusing to commit to the use of the NHSX app.

Last week it outlined plans to have a testing and tracing system to help halt the spread of coronavirus by the end of May.

It will take on thousands of contact tracing staff, who will work in an “old-fashioned” way of talking to people who have tested positive for the virus to try to pin down who they have been in close contact with, so they can be alerted.

NEW “digital tools” will also be developed to support and automate the process, which could, for example, use online forms or an app for people to provide information required.

On the issue of the NHSX app, the Scottish Government document said it was seeking greater involvement in its development and to understand how it will work in conjunction with the Scottish approach to contact tracing.

An open letter, signed by civil society, activists, academics and policy specialists from across Scotland has welcomed this approach, saying it “would seem to have less privacy challenges than the proposed NHSX app”.

However, it also requested greater clarity and more information from the Scottish Government on the approach they plan to take on digital contact tracing. Matthew Rice, of privacy campaign group Open Rights Group Scotland, said there was a balance in using technology to assist pre-existing practices. “Contact tracing is not a new thing, they do it for in public health for lots of different infectious diseases,” he said.

“What we have to deal with is a disease that operates at a scale that is unprecedented in terms of other kind of public health and contact tracing scenarios.

“So technology will play a role here and what Scotland has done is take the existing strategies that are in place for NHS Scotland around contact tracing and try and scale them up to meet that demand.

“To us, this meets a solid principle of how technology can support pre-existing strategies.”

Rice said another issue with the NHSX app was it may be a struggle to get enough users involved to make it effective. “Basically, no country that runs their contact tracing strategy via an app has met the threshold which is around over 50% or at 60% [of the population] – at best Australia have gone towards 40%.”

Rice also warned while the contact tracing app was innovative, it may not deliver on its promises. “It may create a lot of false positives or false negatives and if anybody starts to feel like it’s a bit of an empty application, they won’t trust it,” he said.

“That’s the biggest problem, particularly when lockdown starts to get lifted, and the rules are no longer just stay inside.

“I think England are taking a much bigger risk by introducing an app that’s kind of unproven, and not doing great internationally, and so that’s where we kind of see a level of sensible caution from Scotland.”

Dr Angela Daly, senior lecturer in law at Strathclyde University and co-director of its Centre for Internet Law and Policy, said she had concerns about the involvement of “big tech” companies in the UK Government’s response to the Covid-19 crisis.

At the beginning of the crisis in March, executives from giants such as Google, Facebook, Uber, Microsoft, Amazon and controversial big data firm Palantir were invited to a meeting at Downing Street, attended by Boris Johnson’s chief adviser Dominic Cummings.

Daly said: “They were invited in very early on, even before the lockdown happened and probably around the time contact tracing had kind of been given up on.

“Why was the UK Government abandoning some less techie, less ‘sexy’ ways of collecting data about infections and inviting these big companies to come on board early on?”

Daily also pointed out relying on an app such as the one being developed by NHSX also raised questions about the issue of the “digital divide” in society, with the risk of some groups being left behind. “There’s this idea that everyone’s going to download an app for a smartphone and keep it running and connected to the internet, at least intermittently anyway,” she said.

“That’s kind of a fantasy because so many people don’t have that for whatever reason, for instance, maybe not being able to afford it. If you have an app, you’re assuming that everyone is a young to middle-aged, middle-class person, and that’s not the case.’’

“If this is part of the solution, it has to acknowledge all of these limitations.”