The new Covid-19 contact tracing app in Ireland has been a major success on a number of levels. But it has also raised questions about data privacy.
Some privacy experts believe that the Health Service Executive (HSE), which has managed the project, should look into whether it should list Google as a data controller for the app, due to the data collected by the Android system on users.
Researchers at Trinity College Dublin this week raised concerns about the data collected by the Android system using a piece of software that runs in the background on users’ phones, known as Google Play Services.
Although the research was conducted with the Covid Tracker Ireland app in mind, the issue is not down to the HSE app, but rather how Google Play Services functions.
The software connects apps to other Google services, such as Google Maps or Google Sign In. It cannot be uninstalled, and although it can be disabled, it would also mean core elements of the operating system would not work. That includes the exposure notification system on which the Covid Tracker Ireland app needs to function.
The HSE, Google and others have work to do to reassure users that their data privacy is being respected
However, it is understood that Google does not have access to data within the app, including whether or not the log of bluetooth identifiers has been uploaded to the HSE servers following a positive coronavirus test, nor does the app have access to the data gathered by Google Play Services.
Google issued a statement to clarify that it does not receive information about the end user, location data, or information about any other devices the user has been in proximity of.
Responding to the Trinity research, the HSE said it welcomed any research that helped it improve the app, noting that privacy had been at the forefront throughout the rapid development of the app.
Questions remain and, with a vaccine or medicine for the virus still some time off, the HSE, Google and others have work to do to reassure users that their data privacy is being respected and protected.
