England’s NHS vaccine passport has arrived, and with it the promise of a return to international travel unencumbered by swab tests or lengthy periods of quarantine. Most people will have received this news with excitement, but it’s my job to look closer at what’s going on behind the app. And what I found is troubling.
Instead of impact assessments that provide us with reassurance that risks have been responsibly mitigated, the vaccine passport has been released with a privacy notice that appears to contradict the caution and care the UK government has so far professed to be applying to this controversial technology.
Earlier in 2021, the government acknowledged that “deep and complex issues” around vaccine passports would need addressing before their release. Critics fearful of government data grabs and unfair applications of the technology were placated by the promise that serious limitations would be placed on the application of vaccine passports – ruling out their use in pubs and restaurants, for instance.
Yet that’s not what we see in the new app service’s privacy notice – which is, in its most generous interpretation, rather sloppy. The stated purpose for the vaccine passport is to make it an integral part of “unlocking” society – but that comes with serious surveillance and discrimination concerns.
Trying out the NHS app
On April 28, the transport secretary, Grant Shapps, made the casual announcement that the NHS App – not the NHS Covid-19 app – was going to be extended to function as a vaccine passport for international travel. This was my cue to install the app and try it out.
Logging in, I discovered the app already knew about my first COVID-19 vaccination, listed alongside all my prescriptions going back 15 years – not information I would normally choose to share at border control.
But this was not the vaccine passport functionality, it has now turned out. The next app update, on May 18, added yet another tab: “Share your COVID-19 status”. Initially it adds “for travel”, but the new privacy notice that accompanies it tells a different story:
As the country resumes normal functions, this data will be useful for further aspects of unlocking as they arise.
International travel was merely an example of how the data would be used. Here lie significant problems that critics have been concerned about for some time. For one, the broader use of vaccine passports raises issues of discrimination between those who have and have not been offered vaccinations.
But using vaccine passports in scenarios other than international travel also necessarily increases surveillance, seeing as you’ll need to prove that the vaccine certificate on your phone truly belongs to you. When we travel internationally, we’re used to carrying a passport along with flight tickets and required vaccination certificates – but for events and social gatherings, we don’t expect to have to identify ourselves.
The list isn’t an exhaustive collection of all types of “special category data”, which receive extra legal protection due to their sensitivity, so until we receive clarification it’s unclear why such data are even listed. The NHS has expressed that it does not collect this list of data.
The service is designed as a simple and easy means to enable users to show their covid vaccine status for international travel. It does not collect data on national insurance numbers, car registrations, employer or occupation details or any such equivalent data.
— NHS (@NHSuk) May 19, 2021
Also concerning is the fact that the data governance of the vaccine passport itself is managed by the Department for Health and Social Care rather than being left with the NHS England data service. This puts a UK government department in charge of a service that works only for England – again, it’s unclear why this is the case.
All this leaves me with enough unease about the vaccine passport that I do not intend to sign up to it unless circumstances force me to use it for international travel, and I may still prefer the paper alternative in that case.
Is there anything NHSX could do to reassure me? Absolutely. A data protection impact assessment should be produced and published. This would tell us all about what data is actually used, including an explanation of why data collection is both necessary and proportional.
I’d be looking out for an assessment of the risk of “function creep”: the widening of the scope of use, which could see our tickets for international travel converted into something more sinister and concerning. It would also need to address general impacts to rights and freedoms, such as those related to equality.
Performing such an impact assessment is actually specifically legally required, and should already have been done. Publication is unfortunately not compulsory, but we still don’t know whether one was done at all.
For now, however, it appears that the UK government has definitively abandoned its previous cautious position on vaccine passports, without providing any reassurances that would enable broad public support.