NHS develops second contact-tracing app as privacy concerns mount
Discussions with Big Tech become more productive after "serious legal flaws" are uncovered


The UK is reportedly developing a decentralised contract-tracing app powered by Google and Apple’s technology despite dismissing this idea just weeks ago, all while pursuing the rollout of its own centralised version.
Development is underway on the project after the first app, which is being trialled on the Isle of Wight, receiving a slew of negative feedback, according to the Financial Times (FT). NHSX, however, denies planning any kind of transition.
This is in addition to mounting data protection concerns based on experts’ assessments of the data protection impact assessment (DPIA) conducted on the software, on top of security fears. The pilot version of the app reportedly failed cyber security tests last week, for instance.
The government had initially entertained the idea of using a Google and Apple-developed API to build a contact tracing app to control the spread of coronavirus as lockdown measures are lifted in the coming weeks.
This software would register contacts between individuals in a decentralised manner, however, with users only being alerted when a contact may be experiencing symptoms from the virus. This goes against the wishes of the UK government as such a system wouldn’t allow for a central database and a granular view on where contacts are being made.
The tradeoff, however, as feared, has come in the form of functionality, with many individuals reporting compatibility issues with iOS, as well as implications for battery life on devices. Initial concerns were based on the fact it would take longer to develop software with critical features to its functionality, such as the app working in the background.
Discussions with Apple and Google weren't fruitful and the UK decided to pursue its own version of the app that structured and collected personal data in a centralised manner.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
The NHSX also released a DPIA for the app being trialled, with digital rights and regulation lecturer UCL Michael Veale breaking down “significant legal flaws” from his perspective in a piece of written analysis.
One major concern is whether the app preserves user anonymity, with Veale suggesting that legally misleading and contradictory statements confuse any assurances offered.
RELATED RESOURCE
How to overcome the barriers to personalisation
Leap over every obstacle and jump ahead of your competitors in the process
“The data in the NHSX app is ‘capable’ of revealing an individual’s identity,” Veale wrote. “Whether NHSX intends to do this is not a relevant question from a legal standpoint, the question is whether it reasonably could.
Moreover, the document consistently misuses the terms ‘anonymous’ and ‘anonymity’, and primarily processes pseudonymous, not anonymous, personal data. Users are also deprived of data protection rights.
The Information Commissioner’s Office (ICO) has confirmed it’s examining the DPIA for the NHSX’s pilot contact tracing app and will feedback shortly. NHSX has disputed suggestions that its app is unlawful.
Amid concerns over functionality and lawfulness, one person involved with the decision to build a second app suggested talks with Apple and Google had intensified over the previous few days, according to the FT. In particular, there had been a sharp change of direction in the tone of the discussions from week to week, with more “cordial and constructive” talks “exploring how we might change course”.
The UK’s decision to create its own centralised contact-tracing app flies in the face of the overwhelming consensus from across the world, with a series of nations abandoning such ideas to instead adopt the Apple and Google API.
There have also been concerns that apps developed across haven’t been downloaded by enough people to render them effective. The uptake of a custom-built app in Singapore, for example, stands at roughly 25%, as opposed to an uptake of 75% required, according to Singaporean press. As a result, there are suggestions the app may be integrated into existing apps that are far more widespread across the population.
IT Pro approached NHSX for the latest information on the status of its contact tracing app and sought confirmation over whether it’s working on an alternative.

Keumars Afifi-Sabet is a writer and editor that specialises in public sector, cyber security, and cloud computing. He first joined ITPro as a staff writer in April 2018 and eventually became its Features Editor. Although a regular contributor to other tech sites in the past, these days you will find Keumars on LiveScience, where he runs its Technology section.
-
Phishing emails target victims with fake vaccine passport offer
News Scammers could steal victims’ personal information and never deliver the illegal goods, Fortinet warns
By Rene Millman
-
COVID-related phishing fuels a 15-fold increase in NCSC takedowns
News The NCSC recorded a significant jump in the number of attacks using NHS branding to lure victims
By Bobby Hellard
-
COVID vaccine passports will fail unless government wins public trust, ICO warns
News Data watchdog's chief Elizabeth Denham warns that it’s not good enough to claim ‘this is important, so trust us’
By Keumars Afifi-Sabet
-
Fake COVID vaccination certificates available on the dark web
News Fast-growing market emerges for people wanting quick vaccine proof to travel abroad
By Rene Millman
-
Cyber security firm saw attacks rise by 20% during 2020
News Trend Micro found attackers also heavily targeted VPNs
By Danny Bradbury
-
Hackers using COVID vaccine as a lure to spread malware
News Cyber criminals are impersonating WHO, DHL, and vaccine manufacturers in phishing campaigns
By Rene Millman
-
Website problems slow coronavirus vaccine rollout
News Florida is the epicenter of website issues, as patients struggle with malfunctioning sites and hackers
By Danny Bradbury
-
NHS COVID-19 app failed to ask users to self-isolate due to 'software glitch'
News The bug is the latest in a long line of errors and glitches to plague the government's contact-tracing app
By Keumars Afifi-Sabet