Open letter: Tracking and tracing vulnerable populations

As countries around the world develop contact tracing apps to contain the spread of Coronavirus, they keep facing a problem: for them to be effective a certain percentage of the population has to download them. Something like 60% is the threshold for the app to be effective. So far only Iceland has gotten close with 38% of their country downloading it.
The UK is currently trialling an app, which is designed to notify people if they've been close to someone with symptoms of covid-19 for 15 minutes or more.
The app is currently using a centralised model for the data it collects, meaning it shares a significant amount of data, unlike a decentralised version which would keep the vast majority of data on the individual's phone. The NHS has also said they are looking to retain data from people who test positive for up to 20 years.
This model creates significant concerns both in who will able to download the app, and who will want to.
In recent years in particular, government's treatment of marginalised communities has created a huge amount of distrust. Through the so-called "hostile environment" the government has been seeking to make the UK as unpleasant place to be as possible for migrants. From thousands of asylum seekers and migrants being refused vital healthcare for their urgent healthcare needs they are entitled to the vans Theresa May sent round the UK which read "Go home or face arrest" - the government have been finding increasingly cruel and dangerous ways to make life in the UK harder for migrants.
The government has already made data that they consider useful for immigration enforcement purposes exempt from most data protection laws, something many organisations - including us - are challenging with a formal complaint. Some people will be, understandably, will be reluctant to suddely trust a government that has implemented these extraordinarily cruel policies with their senstive data.
It's important for the government to ask themselves, why would marginalised communities want to download it?
The government isn't just asking people to trust them with their data right now, but it's asking people to trust that that data won't be used against them for up to the next 20 years.
We've already uncovered local authorities using social media monitoring with very few safeguards. And the mistaken conclusions local authorities have drawn from people's profiles is being used to discredit vulnerable families who need support.
The next question the government need to ask is who will even be able to download the app? Some people may not have access to a smartphone to begin with and others might not have access to a phone that supports the app.
That's why we, alongside 6 other organisations including the Joint Council for the Welfare of Immigrants and Medact, have sent a letter to the government asking them to change that.
We, together with the other signatories, are seriously concerned that the government's centralised app will create exlusion and enhance existing discrimination, gather incomplete data, and won't be as effective as it could be in tackling this virus. A virus which we know is already killing black, asian, and minority ethnic people at a disproportionately higher rate.
We're calling on the government to consider switching to a decentralised model with identifiers that change with greater frequency, which has been found to be more likely to comply with both human rights and data protection laws and to enhance trust.
If the government continues with the centralised model, we call for it to:

• Publish its assessment of risks and mitigations for vulnerable and marginalised groups.
• Clarify who holds the collected data, who has access to it, how it will be shared between the platform and private and government agencies. Also, set clear purpose limitations for its use and to avoid function creep. Under no circumstances should the immigration exemption contained in paragraph 4 of Schedule 2 to the Data Protection Act 2018 be relied upon for any processing of/ requests for personal data relating to the contact tracing app.
• Provide guarantees that data shared through the contact tracing app will not be used to deny access to public services or for the purposes of immigration enforcement. These guarantees must be in the form of legal safeguards, such as, but not exclusively, the ones included in the ‘Digital Contact Tracing (Data Protection) Bill’ promoted by the Joint Committee on Human Rights; and through technical safeguards, such as a “firewall” – which will ensure personal information collected by the app will never be shared with the Home Office for immigration enforcement purposes.
• Such safeguards also need to be accompanied by a clear communication campaign from the government and the NHS focused on communities to create much needed trust and confidence in the NHSX app.

You can read the full letter here
You can find out more about identifiers here