Apple and Google have forced the UK ministers to halt a scheduled update for the NHS Covid-19 app on the grounds it violates user privacy.
This decision sits in stark contrast to the Department of Health's statement last week claiming the app was 'privacy protecting'.
What does the NHS Covid-19 app do?
Both Apple and Google have helped build the technology being used in the NHS Covid-19 app, which tracks users through Bluetooth signals and venue check-ins.
The app alerts users who have visited pubs or other establishments at the same time as a person/people who later tested positive for Covid. Punters scan QR codes when they enter a venue, and if it is discovered to be a 'virus hotspot', then anyone who recently scanned the QR code would be notified.
The app was created for use by local governments to combat infection rates in specific areas. Until now, the information derived from these QR codes regarding a person's previous whereabouts stayed on users' phones and was used simply to cross-check these notifications.
Sky News reported in early March that due to 'capacity issues at a local level', the app wasn't being used very often. 106 million people had checked in as of April 6.
What was the proposed change?
Last week, the UK government announced that, following an imminent update, users would be able to share data about their prior locations using QR codes, expanding their usage. The idea was that more information about infected individuals' most recent movements would help stem the spread of the virus.
Explaining the change, The Department of Health published a statement on the government's website last week:
If an app user tests positive, they will be asked to share their venue history in a privacy-protecting way via the app. This will allow venue alerts to be generated more quickly and improve the ability to identify where outbreaks are occurring and take steps to prevent the virus spreading
Assurances that the process would be anonymous and that privacy considerations had been taken into account were treated with an air of suspicion due to the fact that the Check-In Scotland app – which has had no input from Google or Apple – takes user information like email addresses and mobile numbers and stores it on a centralized database.
Why has the update been blocked?
It has now been revealed that the government's decision to 'pause' the update – which should have been rolled out on April 8 – is due to the fact that it violates the privacy-preserving rules Google and Apple were adhering to when they built the app last year.
The major bone of contention is that Google and Apple specifically made efforts to create a 'decentralized' piece of technology that would circumvent the potential privacy issues that may arise from uploading location data and other information to a core database.
The Exposure Notification API – a technology designed by Apple and Google that hasn't been directly used by, but is part of the Covid-19 app – is bound by privacy rules set out by the two companies. The Exposure Notification FAQs, published by Apple, states that the technology can only be utilized by an app if it does not "share location data from the user's device with the public health authority, Apple, or Google". The Government's planned update would break this rule.
Some experts suggest that the government – who were well aware of this stipulation when creating the update – thought they could skirt around it by making it an 'opt-in' feature, a decision which has now backfired.
A lose-lose situation
On the one hand, it's disheartening to see that the UK government is willing to go back on agreements it made with technology companies regarding a piece of technology that is effectively a public utility and, more specifically, in a way that could jeopardize their citizens' privacy. Apple and Google didn't just include this rule to make life difficult for their political partners.
However, the situation feels as if the UK government is now at the mercy of these tech companies. They've essentially blocked one of the world's most powerful, democratically elected administrations from pressing forward with an aspect of a public health plan, however agreeable their intentions are.
With this sort of clash becoming more and more common, the question of who's really in charge looks increasingly up for debate.