Biometrics Commissioner statement on the use of symptom tracking applications
Biometrics Commissioner statement on the use of symptom tracking applications, digital contact tracing applications and digital immunity certificates.
Getty Images
I have been approached by a number of journalists asking for my comments on the possible use of symptom tracking applications, digital contact tracing applications and digital immunity certificates. Strictly speaking this is not part of my responsibility since my role is limited to the police use of biometrics both for criminal investigation and national security. However, the possible use of phone applications to track coronavirus (COVID-19) is a form of surveillance more normally associated with policing and could have a policing purpose, albeit one connected to controlling a pandemic. In that sense the way in which the police use of biometrics has been regulated may hold some lessons.
The first question about any public use of biometrics for surveillance is: is there a public interest in doing so? That is, not a private interest but one that benefits the society and its citizens to such an extent as to outweigh any intrusion into an individual’s general right to privacy. Such questions are of such significance that they should be decided by Parliament and enshrined in law, as was the case for the police use of DNA and fingerprints in the Protection of Freedoms Act 2012 (PoFA).
Given the general and public threat from coronavirus such a public interest test may well be accepted in this case. However, unless we believe that the coronavirus threat is permanent (and at present we do not know) then it may be that the public interest test is only passed for so long as the threat remains. That means that public surveillance to try and control coronavirus probably should be regarded as time limited and should be included in emergency legislation. Parliament certainly acted in this manner when it passed the Coronavirus Act 2020 which, in part, suspended some aspects of PoFA in response to the health emergency. It did so by insisting that the emergency provision had to be limited initially to 6 months and the relevant regulations made in consultation with the Biometrics Commissioner.
If surveillance of coronavirus is regarded as valid only during the pandemic then it is important that public trust in such a process is encouraged by regulation approved by Parliament as to the limitations of that surveillance. A group of university lawyers have produced a suggested Coronavirus (Safeguards) Bill that they believe would be necessary in order to protect an individual’s right not to participate, their anonymity, to limit the period for which it could be done and to regulate what use could be made of any data which was collected and who it could be shared with.
The Ada Lovelace Institute, an independent research body, have also carried out some initial analysis of the evidence and made some recommendations about accountability and the need for legislation. Such protections would go some way to limit use to the emergency period and to balance the immediate public interest against citizen’s longer-term interest in privacy and to ensure that such surveillance is not extended beyond the coronavirus emergency or into other areas of public life without further consideration by Parliament and further legislation. The coronavirus emergency has highlighted the very rapid development of new biometric technology in general and its possible use by the State but also by private interests and why that is something that needs a new framework of governance backed by legislation.
For more on this latter point see my forthcoming Annual Report 2019.