The Information Commissioner’s Office (ICO) has reprimanded the Scottish Government and NHS National Services Scotland for failing to tell users of the Scottish Covid app how their data are used.

The NHS Scotland Covid Status is used by people to demonstrate their vaccination status to satisfy mandatory Covid status checks, which are still in place for certain venues – including nightclubs – in Scotland.

Health data are among the sensitive personal information gathered by the app.

When Covid status checks were first introduced, the ICO worked alongside UK governments to ensure the schemes adequately protected public health while maintaining public trust and sharing personal data responsibly.

When the ICO first received details of how the NHS Scotland Covid Status app would use personal data on the 27th of September 2021, the ICO raised several concerns about the way the app was going to use people’s information.

The ICO was particularly concerned by plans to let the NHS Scotland Covid Status app share the images and passport details of Scottish users with the software company providing the facial recognition technology behind the app.

While the proposal helped the company improve its facial recognition software it was not necessary for the app to function and served no benefit to the app user. As such, the function was ruled unlawful.

The ICO said the app should not be launched until its concerns about potential non-compliance had been addressed. While the Scottish Government and NHS National Services Scotland halted plans to share personal data with the software company, the app was launched on the 30th of September as planned without fully addressing the ICO’s wider concerns about compliance with data protection law.

This prompted an investigation by the ICO, leading to the regulator to issue a reprimand to the Scottish Government and the NHS National Services Scotland.

ICO Deputy Commissioner Steve Wood said: “People need to be able to share their data and go about their lives with confidence that their privacy rights will be respected.

“The law enables responsible data sharing to protect public health. But public trust is key to making that work. When governments brought in Covid status schemes across the UK last year, it was vital that they were upfront with people about how their information was being used.

“The Scottish Government and NHS National Services Scotland have failed to do this with the NHS Scotland Covid Status app.”

Recommended

• Adtech startup Good-Loop raises £4.5m to accelerate US expansion
• Unique camera tech set to fundamentally change high-speed imaging
• Secretary of State for Levelling Up tours Edinburgh’s National Robotarium

The Scottish Government and NHS National Services Scotland were criticised for their initial failure to provide adequate privacy information within the NHS Scotland Covid Status app at launch to explain how people’s information is being used.

In addition, the reprimand highlighted an ongoing failure to provide concise privacy information so that the average person can realistically understand how the NHS Scotland Covid Status app is using their information.

Wood added: “We require both bodies to act now to give people clear information about what is happening with their data. If they don’t, we will consider further regulatory action. The ICO, including our office in Scotland, remains committed to working with both bodies to address these outstanding issues and ensure this learning is applied to future activities, including the development of any future government apps that store and use people’s information.”

The ICO now expects the Scottish Government and NHS National Services Scotland to act swiftly on these findings and apply the wider learning from the roll out of the NHS Scotland Covid Status app to any similar activities in the future to make sure people can continue to have trust in the way both organisations use their information.

If both bodies fail to take action to address the ongoing issues with the NHS Scotland Covid Status app then the ICO will consider whether further regulatory action is required.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.