29 April, 2020
Covid-19 is a threat to us all. Ireland’s health services are developing a Covid Tracker Ireland App, which has both contact-tracing and symptom-reporting elements.
We, the undersigned civil societies, scientists, and academics believe that more consideration needs to be given to the production of an app solution. The Ada Lovelace Institute’s assessments of contact-tracing apps warn of insufficient evidence saying the ‘technical limitations, barriers to effective deployment and social impacts demand more consideration’.
If Ireland decides to use an app we must ensure that it respects legality and human rights norms. Failing to do so will undermine the public trust required for it to have public health benefits. In developing the app, the Health Service Executive (HSE) and the Department of Health should:
- Embrace transparency and promote trust. To better protect privacy and personal data, the European Data Protection Board advises that source code cannot be concealed and must be shared publicly and regularly audited by external experts. It is vital that the public trusts the solutions of our government.
- Design for privacy and data protection. Protection of citizens’ public data must be considered in the basic design. The architecture must be designed with this in mind. We welcome the reported rejection of the centralised architecture by the HSE. All aspects of the app need similar careful consideration.
- Limit purpose. Other countries are developing tracing apps which are for contact tracing alone. They do not track location or symptoms. There is no known justification for location tracking. Symptom-tracking, if it is really needed, can be handled in a different app.
- Get it right the first time. It is important to resolve and address concerns ahead of the launch. Germany is setting an example by abandoning the flawed and centralised PEPP-PT to ensure the app is fit-for-purpose and the public trusts its use.
We ask that the Health Service Executive (HSE) and the Department of Health seek the best solutions for Ireland. To ensure the app works and is supported by the public we request that HSE:
- Adopt a rights respecting decentralised approach, rather than a centralised one.
- Follow the European Data Protection Board recommendations by (i) publishing the app’s draft specification and user requirements, Data Protection Impact Assessment (DPIA), and source code and (ii) allow for input from experts and public scrutiny of what is proposed.
- Ensure purpose limitation by preventing mission creep, mandatory uptake, or discrimination against those who have not installed the app.
Irish Council for Civil Liberties, Elizabeth Farries, Director of Information Rights
Digital Rights Ireland, Antoin O Lachtain, Director
Dr Marguerite Barry, School of Information and Communications Studies, University College Dublin
Dr Stephen Farrell, School of Computer Science and Statistics, Trinity College Dublin
Dr Heike Felzmann, School of Humanities, National University of Ireland, Galway
Dr Aphra Kerr, Department of Sociology, Maynooth University
Prof Rob Kitchin, Maynooth University Social Sciences Institute, Maynooth University
Prof Douglas Leith, School of Computer Science and Statistics, Trinity College Dublin
Dr Maria Helen Murphy, Law Department, Maynooth University
Laura Nolan, Tech Won’t Build It Ireland
Daragh O Brien, Founder, Castlebridge
Dr Katherine O’Keefe, Director of Training and Research, Castlebridge
Dr Eoin O’Dell, School of Law, Trinity College Dublin
Prof Barry O’Sullivan, University College Cork and Vice Chair of the European Commission High-Level Expert Group on AI
Simon McGarr, Director, Data Compliance Europe
Transparent Referendum Initiative
Prof Kalpana Shankar, School of Information and Communications Studies, University College Dublin
Prof Eugenia Siapera, Head of School, Information and Communications Studies, University College Dublin
Prof Alan Smeaton, Insight Centre for Data Analytics, Dublin City University