The Irish government’s plans to launch a voluntary Bluetooth-based Covid-19 contact-tracing app were first mooted in media reports in March.
Within weeks, a group of data protection and legal experts, academics, computer scientists and representatives from civil societies, such as the Irish Council for Civil Liberties and Digital Rights Ireland, held a meeting to discuss the proposed app.
As so few details were known about the decentralised app, the group agreed to write and publish an open letter calling on Ireland’s Health Service Executive (HSE) and the Department of Health to publish the app’s Data Protection Impact Assessment (DPIA), design specifications and source code to allow for the group of independent experts to scrutinise the app which was also reported to include a symptom-tracking element.
The letter was published on April 29, 2020 and, the following day, the expert call was raised in the Irish parliament, the Dáil. In his response, the then Health Minister Simon Harris told the Dáil that he would publish the DPIA ahead of the app’s launch.
He also promised: “I commit to coming back to this House prior to launch to take any questions and to publish any information that is relevant and helpful.”
The next day, an 11-page ministerial briefing revealed more details about the proposed app which would involve the pending Google and Apple API.
Over the next number of weeks, scientists from Trinity College Dublin published a number of studies which raised serious concerns about the efficacy and functionality of Bluetooth contact-tracing apps.
Their studies found it would be challenging for Bluetooth contact-tracing apps to discern whether contacts are closer or further than two metres away; that app signals recorded between users can vary substantially depending on whether people have their phones in a pocket, a handbag, if they are on a bus or a tram, or if a person is standing in front of them or beside them; and that for Bluetooth apps using the Google/Apple API, false negatives, where people who have been in contact but are not detected as contacts, may be unavoidable.
On June 3, the expert group, including ICCL, published a set of nine principles for Irish legislators on the implementation of new technologies developed in-house or in partnership with third parties. The principles stated that any tech solution deployed as part of a public policy must:
Have a clear and limited purpose;
Be necessary and proportionate to the problem;
Embrace transparency and promote trust;
Be subject to statutory oversight;
Be subject to timely deletion of personal data;
Have privacy and data protection at the heart of its design;
Be subject to a sunset clause;
Broaden the range of actors involved and foster engagement.
The following day the Minister for Health invited the ICCL for a meeting to discuss a number of matters related to the state’s Covid-19 responses, including the app. ICCL, and other experts involved in the initial call for transparency and the principled framework document, were also later invited to make a submission to the Special Committee on Covid-19 Response.
Members of ICCL met with the minister on June 18 and, during the meeting, he acknowledged the principled framework of June 3.
On June 25, a Department of Health official told the Special Committee on Covid-19 Response that the ICCL had “contributed substantially in setting out key principles that must be observed, and we are confident that we have observed those principles”.
The following day, the HSE and the department published the DPIA, the source code and other documents on GitHub. Press releases from both bodies also claimed that their testing of the app showed “that the app was able to accurately detect 72% of close contacts“.
However, none of the documents uploaded in the GitHub account spoke to that figure.
In response to the publication of these documents, ICCL and Digital Rights Ireland issued a report card evaluating the app. This action was taken because ICCL and DRI believed that the best practice principles were not wholly adhered to.
Overall, ICCL and DRI awarded the government a grade of ‘C+’ but a ‘D’ for the first three principles.
They again highlighted that no evidence has been put forward by the HSE or department to support the 72% efficacy figure.
On July 6, it was announced that the HSE and Department of Health would launch the app on July 7.
(Labelled for non-commercial re-use)