ProPrivacy is reader supported and sometimes receives a commission when you make purchases using links on this site.

Google and Apple block NHS Covid-19 app update on privacy grounds

Apple and Google have forced the UK ministers to halt a scheduled update for the NHS Covid-19 app on the grounds it violates user privacy. 

This decision sits in stark contrast to the Department of Health's statement last week claiming the app was 'privacy protecting'.


What does the NHS Covid-19 app do?

Both Apple and Google have helped build the technology being used in the NHS Covid-19 app, which tracks users through Bluetooth signals and venue check-ins.

The app alerts users who have visited pubs or other establishments at the same time as a person/people who later tested positive for Covid. Punters scan QR codes when they enter a venue, and if it is discovered to be a 'virus hotspot', then anyone who recently scanned the QR code would be notified.

The app was created for use by local governments to combat infection rates in specific areas. Until now, the information derived from these QR codes regarding a person's previous whereabouts stayed on users' phones and was used simply to cross-check these notifications. 

Sky News reported in early March that due to 'capacity issues at a local level', the app wasn't being used very often. 106 million people had checked in as of April 6. 

What was the proposed change?

Last week, the UK government announced that, following an imminent update, users would be able to share data about their prior locations using QR codes, expanding their usage. The idea was that more information about infected individuals' most recent movements would help stem the spread of the virus. 

Explaining the change, The Department of Health published a statement on the government's website last week:

If an app user tests positive, they will be asked to share their venue history in a privacy-protecting way via the app. This will allow venue alerts to be generated more quickly and improve the ability to identify where outbreaks are occurring and take steps to prevent the virus spreading

Deaprtment of Health

Assurances that the process would be anonymous and that privacy considerations had been taken into account were treated with an air of suspicion due to the fact that the Check-In Scotland app – which has had no input from Google or Apple – takes user information like email addresses and mobile numbers and stores it on a centralized database. 

Why has the update been blocked?

It has now been revealed that the government's decision to 'pause' the update – which should have been rolled out on April 8 – is due to the fact that it violates the privacy-preserving rules Google and Apple were adhering to when they built the app last year.  

The major bone of contention is that Google and Apple specifically made efforts to create a 'decentralized' piece of technology that would circumvent the potential privacy issues that may arise from uploading location data and other information to a core database. 

The Exposure Notification API – a technology designed by Apple and Google that hasn't been directly used by, but is part of the Covid-19 app – is bound by privacy rules set out by the two companies. The Exposure Notification FAQs, published by Apple, states that the technology can only be utilized by an app if it does not "share location data from the user's device with the public health authority, Apple, or Google". The Government's planned update would break this rule. 

Some experts suggest that the government – who were well aware of this stipulation when creating the update – thought they could skirt around it by making it an 'opt-in' feature, a decision which has now backfired. 

A lose-lose situation 

On the one hand, it's disheartening to see that the UK government is willing to go back on agreements it made with technology companies regarding a piece of technology that is effectively a public utility and, more specifically, in a way that could jeopardize their citizens' privacy. Apple and Google didn't just include this rule to make life difficult for their political partners. 

However, the situation feels as if the UK government is now at the mercy of these tech companies. They've essentially blocked one of the world's most powerful, democratically elected administrations from pressing forward with an aspect of a public health plan, however agreeable their intentions are. 

With this sort of clash becoming more and more common, the question of who's really in charge looks increasingly up for debate. 

Written by: Aaron Drapkin

After graduating with a philosophy degree from the University of Bristol in 2018, Aaron became a researcher at news digest magazine The Week following a year as editor of satirical website The Whip. Freelancing alongside these roles, his work has appeared in publications such as Vice, Metro, Tablet and New Internationalist, as well as The Week's online edition.


There are no comments yet.

Write Your Own Comment

Your comment has been sent to the queue. It will appear shortly.

Your comment has been sent to the queue. It will appear shortly.

Your comment has been sent to the queue. It will appear shortly.

  Your comment has been sent to the queue. It will appear shortly.

We recommend you check out one of these alternatives:

The fastest VPN we test, unblocks everything, with amazing service all round

A large brand offering great value at a cheap price

One of the largest VPNs, voted best VPN by Reddit

One of the cheapest VPNs out there, but an incredibly good service