Department of Health and the HSE announce the publication of the Covid Tracker App Data Protection Impact Assessment and source code

The Department of Health and the Health Service Executive have today (Friday, 26 June) published several important documents as part of our ongoing commitment to openness and transparency in the development of the Covid Tracker App for Ireland.

The Data Protection Impact Assessment, the source code, the Product Explainer for the Covid Tracker App, and a series of app design and development reports are available on the HSE website here: www.hse.ie/!DW3Q7R.

As the country reopens, contact tracing and the early identification of symptoms, will become increasingly important as more people are visiting family and friends, exercising, socialising, shopping, returning to work and using public transport.

The Covid Tracker App will allow each individual to play an important part in controlling COVID-19, helping everyone to stay safe and protect each other. The app will record if a user is in close contact with another user by exchanging anonymous codes that are held on the users’ phones.

People who test positive for COVID-19 will be able to choose if they want to anonymously alert other app users who they have been in close contact with. In this way the app will augment the existing testing and tracing operation and enable the notification of close contacts that are unknown to each other.

The app will also allow the user to anonymously record information about how they feel every day. The symptom tracker has the potential to generate valuable national data relevant to COVID-19. The accurate reporting of the timing of the first onset of symptoms will improve the speed and the accuracy of the tracing process.

In line with data protection law, the processing of data will be limited to this stated purpose. All personal data that is processed is kept to an absolute minimum. Users can choose to delete the app at any time and have full control over what information they share through the app. Further, a governance commitment is in place to dismantle the operation of the app once the COVID-19 crisis is over.

Chief Information Officer (CIO) of the HSE, Fran Thompson said:

Supporting the development of the technology, a programme of public health research has been completed to ensure that the app is easy to use, protects privacy, and supports users over time. The findings of independent research the recent Lero study published this week by Science Foundation Ireland (SFI) found that 82% of the population said that they would be willing to install an app for contact tracing.

This work at a national level has been situated in an unprecedented global collaboration between governments, industry and the scientific community. The Irish app, designed employing the decentralised model, allows us to align fully with the privacy principles and public health guidance issued by the EU Commission, the OECD, WHO and the European Centre for Disease Prevention and Control.

CEO of the HSE, Mr Paul Reid said:

ENDS

Documents and publications

In line with the government’s roadmap for introducing a national mobile phone application to support contact tracing today the HSE and Department of Health have published a series of documents to provide insight into the decentralised model and privacy by design approaches that underlie the Covid Tracker App for Ireland.

Documents are available on the HSE Covid Tracker App page: www.hse.ie/!DW3Q7R.

A GitHub site for the Covid Tracker App has been set up and can be accessed here: github.com/HSEIreland.

Data Protection Impact Assessment

A DPIA is an important document that clearly and transparently defines what data the app uses and how it protects that data in full compliance with GDPR. The DPIA for the Covid Tracker app has been finalised on the basis of feedback from the Attorney General’s Office and from the Office of the Data Protection Commissioner.

Source code

The source code contains the set of instructions used to make the app do its job. For people who can read the code (computer scientists/software developers) it provides complete transparency in relation to how the app functions.

The product explainer

The Product Explainer provides a detailed overview of what the app does and how it fits within the national effort to combat COVID-19.

Development and Testing

Ireland has actively participated in the European eHealth Network and engaged with the DPT-3 group (Estonia, Switzerland, and Germany). The Covid Tracker App (both technically and in terms of privacy) is wholly in line with emerging international best practice and guidelines in relation to the use of mobile apps to support contact tracing for COVID-19 published by the European Centre for Disease Prevention and Control.

In addition to the results from the testing programme, showing that the app was able to accurately detect 72% of close contacts using the Google Apple API, based on the roll out of the Warn-App in Germany which also uses the Google Apple API and is currently achieving an 80% detection rate, we are confident that this can be further improved. Google and Apple are committed to continuing to increase the accuracy of the technology based on data received from testing in Ireland and other countries and the inclusion of other contextual information from devices, such as if a user is walking, in-transit, outside/inside etc. It is also important to note that the Google Apple API isn't solely focused on distance and time but is built on a risk model which can be tuned by HSE.

Public health research

A programme of research to support the development of the app was completed through cross-governmental and cross-sectoral collaboration across HSE, the Irish Government Economics and Evaluation Services (IGEES), Department of Public Expenditure and Reform, and the Economic and Social Research Institute (ESRI) Behavioural Research Unit. The programmes included baseline research: an international literature review; survey analysis of smartphone ownership and consumer behaviour; and user preferences and experience. Final stage research involved a behavioural experiment (completed by the ESRI Behavioural Research Unit).

Our findings have shown that:

• 84% of the population aged 16+ own a smartphone in Ireland
• the Lero study published this week by the Science Foundation Ireland Research Centre for Software, University of Limerick (UL) and National University of Ireland Galway (NUI Galway) substantiated these findings and showed that the vast majority of Irish adults – 82% – are willing to download a contract tracing app to their smartphone to curb the COVID-19 pandemic

Collectively, this research demonstrates significant support for the app among the Irish people and provided insights to inform the design and development of the app in order to ensure that it is easy to use, protects privacy, and supports users over time.

Active Engagement

As part of the development process, we have engaged with a wide variety of key stakeholder including:

• SFI and their respective centres of expertise for expert advice and guidance in relation to five key areas: data analytics; low energy Bluetooth proximity analysis; ethics and trust; privacy and security; and enhancing user experience
• the National Patient Forum when planning and designing the app to gather their feedback and views
• the National Council for the Blind of Ireland assessed the app from an accessibility perspective and support the deployment of the app
• the Irish Council for Civil Liberties in relation to the principled framework for the development of a contact tracing app for COVID-19 which reflects legal and human rights requirements to protect privacy. The framework was published by the Council and with Digital Rights Ireland, academics, and data protection experts and the app for Ireland is aligned with the nine principles contained in the framework

International interoperability of contact tracing apps

Interoperability for contact tracing apps is a priority at EU level. EU citizens should be able to receive alerts of close contact with a possible case of COVID-19 in a secure and protected way, wherever they are in the EU, and whatever app they are using.

The EU has agreed guidelines to support the achievement of cross-border interoperability between tracing apps. Member States, including Ireland, that use a de-centralised architecture should be able to interoperate with other Member States using a similar architecture.

For Ireland, it is particularly important to find a solution to these challenges because of the amount of traffic north and south of the border and across the Irish Sea. Technical teams north and south have been engaged over the past number of weeks on how best to address solutions for interoperability. A number of options are being considered and there is growing confidence that interoperability will be achievable on an all-island basis.

The Department of Health and the HSE are in regular contact with counterparts in Northern Ireland and England and have provided them with full access to developments in the Irish app.