Question to the Department of Health and Social Care:

To ask Her Majesty's Government what (1) security, and (2) privacy, provisions are being used to protect the data of the users of the NHSX COVID-19 contact tracing application; and what steps they have taken to ensure that the information gathered by that application is what is required by (a) epidemiologists, and (b) public health officials.

We have worked rigorously to make the app as privacy-conscious as possible, only collecting the data necessary to fulfil its epidemiological purpose and save lives. Security and privacy have been prioritised at all stages of the app’s development and we have drawn on expertise from across Government and industry to review our app’s designs.

Any user data collected centrally by the National Health Service will be held to the highest security standards. In addition to the continual monitoring, review and oversight undertaken by the NHS, we have consulted with the National Cyber Security Centre to review and supplement our processes. The app has been designed to calculate a user’s risk of infection using a heuristic model developed in collaboration with expert epidemiologists from the University of Oxford’s Big Data Institute. We have published an explanation of how the risk scoring algorithm works on the online only FAQ page of the NHS COVID-19 website. NHS doctors and scientists will continuously update the risk scoring algorithm to make it as accurate as possible.

The data collected supports the wider public health approach of manual contact tracing and testing. Anyone who has symptoms that are consistent with COVID-19, whether or not they are an app user, will be able to report those symptoms and get a test to find out if they have the virus.