Your NHS app collects HUGE amount of personal data to unlock vaccine passport, says expert


Vaccine passports are here, thanks to an update to the NHS smartphone app this week. Confusingly, this is a completely separate app to the NHS Covid-19 app, which is designed to help stop the spread of coronavirus. The Covid-19 app is the one that uses Bluetooth to keep tabs on your proximity to other people – flagging when someone you’ve been in close contact with later tests positive for Covid-19 so that you can self-isolate, hopefully stopping the spread of the potentially fatal virus.

But while you’ll need to download the NHS Covid-19 app to scan QR codes when you enter pubs, restaurants, and cafés …something you’ll be doing a lot more of thanks to a change in advice from the Government [If you haven’t downloaded NHS Covid-19 app yet, now you need it for EVERY pub trip], you will need the NHS app to travel abroad.

The arrival of the much-discussed “vaccine passports” in the NHS app on iPhone and Android comes as England moves to the next step of the lockdown roadmap, with international travel to some countries commencing once again on Monday May 17, 2021 as well as indoor dining and drinking inside pubs, cafés and restaurants. If you’re hoping to travel abroad now that restrictions have been lifted then you may need proof you’ve been vaccinated twice.

Different countries have different entry requirements, and for some, it’s a prerequisite that anyone flying in from abroad has been fully vaccinated against the coronavirus. The NHS app received an update which means the iOS and Android programme can be used to show your Covid-19 vaccination status.

READ MORE: You cannot delete NHS Covid-19 app even when restrictions end

Alternatively, you can call 119 to receive a letter that says you’ve been fully vaccinated against the coronavirus. And this might be the preferred choice for many people, given a new alert issued by a security expert this week.

Professor Eerke Boiten, who is the Head of De Montfort University’s Computer Science and Informatics School, has been digging into the underlying code that powers the NHS app.

The update adds two new features to the Your Health tab in the NHS App: Share your COVID-19 Status, and Check Your COVID-19 Vaccine Record.

The former is the one that will come in handy for international travel, with the app saying it allows users to “view and share proof of your COVID-19 status for travel”. And Professor Boiten, in a thread on Twitter, claimed that to access this feature a “large amount” of sensitive data is collected.

The cybersecurity expert said information such as a National Insurance number, ethnic origin and details on employer and occupation – among a number of other highly personal items – are collected by the app.

Professor Boiten said: “We now have a new feature ‘share your COVID-19 status’ which…is collecting a large amount of sensitive and identifying data it claims it doesn’t need.”

Describing the data collected Boiten said: “Starts out with what you’d reasonably expect. Then the shockers. Vehicle plate, NI number, employer, info on family and lifestyle, ethnic origin, biometric and genetic for identification, crime – most of them not ‘used in certificate’.”

The cybersecurity experts also highlights how the privacy policy information for the Covid Status Certificate also alludes to how this data will be useful for other aspects of unlocking – such as “attendance at domestic events”.

Professor Boiten said: “Its purpose is NOT just international travel (which I supported generally), but the broader ‘unlocking’, which has all sorts of surveillance and inequality impacts.”

Speaking to, however, a Government spokesperson said: “The COVID-19 vaccine status service in the NHS App and NHS website has been built with user privacy and security at its heart, to ensure personal information is safe and secure at all times.

“The service is designed as a simple and easy way for users to show their Covid vaccine status for international travel. It does not collect data on national insurance numbers, car registrations, employer or occupation details or any such equivalent data.”

The full privacy policy for the Covid Status Certificate can be found right here.

Explaining why personal data is processed, the website says: “The principle of the Covid Status Certificate programme is to ensure that illness and death from Covid-19 can be minimised as the UK’s social and economic life is re-established. This will apply both during and after the Government “roadmap” allows citizens to emerge from the restrictions placed on the country during the COVID-19 pandemic response.

“The Covid Status Certificate provides citizens with evidence of their vaccination history. As the country resumes normal functions, this data will be useful for further aspects of unlocking as they arise, e.g for International travel or attendance at domestic events once these have been permitted by government policy and guidance.”

The news isn’t the first time that controversy has been sparked about the terms and conditions for crucial coronavirus services the public has to access. People who requested a home coronavirus test kit last year were left confused that as part of the process they had to agree to a credit check. Speaking to the BBC, one Briton – Laura McCormack – said she was refused a home test kit as a result.

Laura said: “In the end, it became clear that people with no credit history were having very similar problems. People who haven’t taken out loans or don’t have phone contracts or credit cards here in the UK”.

At the time the DHSC said credit reference agency TransUnion was being used to verify identities in order to “reduce fraud and prevent multiple testing kits being ordered, diverting capacity from where it is needed most”.

However Anna Miller, from the charity Doctors of the World, questioned the move saying: “The types of people affected are anybody who has little to no credit history or credit footprint. People whose financial situations tend to be organised by other people in a family and women, like elderly people, are likely to be more disproportionally affected.

“Alongside these groups are young adults who’ve not had much time to build up credit histories, recently arrived migrants in the UK for the same reason and people on low incomes who might not have access to mainstream credit.”

Published at Wed, 19 May 2021 09:01:00 +0000

Your NHS app collects HUGE amount of personal data to unlock vaccine passport, says expert


Please enter your comment!
Please enter your name here