Protecting citizens from surveillance overreach during the COVID-19 pandemic

UCL Laws research led by Dr Michael Veale underpinned the rapid development of privacy-preserving contact tracing apps for smartphones, which went on to be used globally.

20 April 2022

Digital contact tracing has been at the centre of efforts to curb the spread of COVID-19 during the 2020/21 pandemic. This technology has advanced rapidly, creating urgent new questions around digital privacy and rights.

At the start of the pandemic, some governments, including the UK’s, began work on designs for digital contact tracing involving communication between smart phones and centralised databases. While all contact tracing systems are open to abuse, centralised systems, such as those proposed by the UK government, are more vulnerable and present the potential for data about “who-saw-who and when” to be used for purposes beyond public health.

Dr Veale from UCL Laws noted that as the notification of exposure to a COVID-positive individual didn’t require an individual to be identifiable to anyone else. Together with a rapidly-assembled international research team, they found that a technical, on-device solution could achieve this while also respecting privacy and data protection rights to the highest degree.

Global takeup of decentralised system

As a digital rights and regulation expert, Dr Veale worked in collaboration with the École Polytechnique Fédérale de Lausanne (EPFL), Swiss Federal Institute of Technology (ETH Zürich), ISI Foundation (Italy) and the universities of Porto and Oxford to design, test and publish a protocol for Bluetooth-based proximity-tracing called the Decentralised Privacy Preserving Proximity Tracing Protocol (DP-3T). The designs were made available via a Creative Commons licence on GitHub to allow for urgent use.

The DP-3T protocol led to 65 official national decentralised COVID-19 contact tracing apps globally and Dr Veale’s insights convinced the UK government to abandon a centralised app for England and Wales.

Rapidly after the DP-3T consortium published its White Paper and legal analysis, Apple and Google announced a smartphone contact tracing partnership inspired by the DP-3T protocol for focussing on smartphones. This was subsequently embedded in the operating systems of approximately 94% of iPhones and 92% of Android devices for national government apps to draw upon.

Supporting safer trade and personal mobility

At this stage, the UK government was set on a centralised database approach for England and Wales, but Dr Veale’s communication with the Joint Committee of Human Rights and the media raised awareness of the technology and privacy issues surrounding contact tracing. This helped create pressure which led to the government abandoning the centralised app. An updated ‘NHS Covid-19’ app, using the decentralised design inspired by DP-3T, launched in September 2020.

By December 2020, at least 65 national and regional public health authorities around the world had released apps based on the DP-3T protocol, with many achieving significant uptake. The NHS app has been downloaded over 21 million times, corresponding to approximately 44% of the adult population of England and Wales. Statistical analysis estimates its use had averted approximately 594,000 cases of COVID- 19 by the end of 2020.

Decentralised contact tracing systems have the benefit of enabling seamless contact tracing across borders and this allowed DP-3T to provide up to 372m people in Europe with privacy-protecting contact while supporting safer trade and personal mobility.

Dr Veale’s work on the privacy concerns associated with contact tracing and related technologies is ongoing and his co-authored model Coronavirus (Safeguards) Bill 2020 is shaping current policy in this area, and an adaptation of another protocol he collaborated on, Crowdnotifier, has been deployed for decentralised QR code hospitality check-ins in Germany.

Research synopsis

Enabling COVID-19 contact tracing apps that protect privacy and reduce surveillance risk

UCL Laws research led by Dr Michael Veale has underpinned the rapid development of privacy-preserving contact tracing apps for smartphones. The DP-3T protocol led to 65 official national decentralised COVID-19 contact tracing apps globally and his insights convinced the UK government to abandon a centralised app for England and Wales.