Information Commissioner's Office
ICO reprimands Scottish Government over need to be upfront about NHS Scotland COVID Status app’s use of people’s details
The Information Commissioner’s Office (ICO) has issued a reprimand to the Scottish Government and NHS National Services Scotland over both organisations failure to provide people with clear information about how their personal information – including sensitive health data – is being used by the NHS Scotland COVID Status app.
The NHS Scotland COVID Status app is one method people can use to demonstrate their vaccination status to satisfy mandatory COVID status checks that are still in place for certain venues, including nightclubs, in Scotland.
ICO Deputy Commissioner, Steve Wood, recently said:
“People need to be able to share their data and go about their lives with confidence that their privacy rights will be respected.
“The law enables responsible data sharing to protect public health. But public trust is key to making that work. When governments brought in COVID status schemes across the UK last year, it was vital that they were upfront with people about how their information was being used. The Scottish Government and NHS National Services Scotland have failed to do this with the NHS Scotland COVID Status app.
“We require both bodies to act now to give people clear information about what is happening with their data. If they don’t, we will consider further regulatory action. The ICO, including our office in Scotland, remains committed to working with both bodies to address these outstanding issues and ensure this learning is applied to future activities, including the development of any future government apps that store and use people’s information.”
The ICO’s concerns over the NHS Scotland COVID Status app
The ICO has been working with governments across the UK throughout the COVID pandemic to make sure that the introduction of mandatory vaccination and COVID status checks schemes achieve the right balance between protecting public health and maintaining the trusted and responsible sharing of personal data.
This included the ICO publishing a guidance paper in May last year setting out expectations around how organisations should be developing COVID-status certification schemes in line with data protection law.
The ICO received the full details setting out how the NHS Scotland COVID Status app would be using people’s information on 27 September 2021. The ICO raised concerns with the Scottish Government and NHS National Services Scotland that this critical information was only supplied three days before mandatory status checks were due to be rolled out in Scotland.
After reviewing the details at pace, the ICO advised the Scottish Government and NHS National Services Scotland that they had a number of concerns about the way the app was going to use people’s information. The ICO was particularly concerned by plans to let the NHS Scotland COVID Status app share the images and passport details of Scottish users with the software company providing the facial recognition technology behind the app.
This proposal was there to help the company improve the facial recognition software behind the NHS Scotland COVID Status app, but would have been unlawful in these circumstances as it was not necessary for the app to function and served no benefit to the app user. The proposal had also not been previously communicated to the ICO.
The ICO advised that the app should not be launched until its concerns about potential non-compliance had been addressed. The Scottish Government and NHS National Services Scotland halted plans to share personal data with the software company, but the app was launched on 30 September 2021 as planned without fully addressing the ICO’s wider concerns about compliance with data protection law.
At this point an investigation was launched by the ICO and the regulator has now issued a reprimand to the Scottish Government and the NHS National Services Scotland over:
- their initial failure to provide adequate privacy information within the NHS Scotland COVID Status app at launch to explain how people’s information is being used; and
- an ongoing failure to provide concise privacy information so that the average person can realistically understand how the NHS Scotland COVID Status app is using their information.
The ICO has decided to make this reprimand public because of the significant public interest in the issues raised. The decision to issue a reprimand in this case reflects that this is the most effective and proportionate way to make sure the issues identified are swiftly resolved.
The ICO now expects the Scottish Government and NHS National Services Scotland to act swiftly on these findings and apply the wider learning from the roll out of the NHS Scotland COVID Status app to any similar activities in the future to make sure people can continue to have trust in the way both organisations use their information.
If both bodies fail to take action to address the ongoing issues with the NHS Scotland COVID Status app then the ICO will consider whether further regulatory action is required.
Notes to Editors
- The Information Commissioner’s Office (ICO) upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 2018, the UK General Data Protection Regulation (GDPR), the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
- The ICO has been working with governments across the UK throughout the COVID pandemic to make sure that the introduction of mandatory vaccination and COVID status checks schemes achieve the right balance between protecting public health and maintaining the trusted and responsible sharing of personal data in compliance with UK data protection laws. This work included:
- On 14 May 2021, the ICO published a guidance paper setting out the ICO’s expectations around how organisations should be developing COVID-status certification schemes in line with the data protection law.
- On 29 September 2021, the ICO issued a reminder setting out the data protection considerations that governments across the UK must consider when launching COVID status check schemes. This statement was accompanied by simple introductory guide to help venues responsible for carrying out the checks.
Latest News from
Information Commissioner's Office
Building better business by responsibly unlocking the value of personal information24/01/2023 12:20:00
Ahead of Data Protection Day, the Information Commissioner’s Office (ICO) is encouraging the UK’s 5,501,000* small-and-medium-sized businesses (SMEs) to check they have the right data protection practices in place to help sustain and develop their businesses.
Change to regulation concerning communication service providers20/01/2023 16:05:00
The Information Commissioner’s Office (ICO) has written to communication service providers (CSPs) about their obligations under Regulation 5A of the Privacy and Electronic Communications Regulations 2003 (PECR).
Empowering people to foster trust in tomorrow’s technological advancements20/01/2023 14:05:00
The ICO is encouraging developers to consider privacy at an early stage when implementing new technologies to maintain public trust and confidence.
Blog: Addressing concerns on the use of AI by local authorities19/01/2023 14:10:00
A blog by Stephen Bonner, Deputy Commissioner – Regulatory Supervision
Blog: Commissioner responds to misdirected criticism of journalism code21/12/2022 16:20:00
A blog by John Edwards, Information Commissioner
Five businesses fined a total of £435,000 for making nearly half a million unlawful marketing calls08/12/2022 13:05:00
The Information Commissioner’s Office (ICO) has fined five companies a total of £435,000 for making nearly half a million unlawful marketing calls to people registered with the Telephone Preference Service (TPS).
Providing certainty on how we enforce the laws we regulate08/12/2022 12:05:00
John Edwards, UK Information Commissioner, recently set out our strategic approach to regulatory action where he said: “Members of the public, and those affected by a breach or infringement, are entitled to know that we have held the business or organisation to account, and that they have changed their practices as a result.”
ICO and Ofcom strengthen partnership on online safety and data protection25/11/2022 15:20:00
The Information Commissioner’s Office (ICO) and Ofcom have today set out how we will work together to ensure coherence between the data protection and the new online safety regimes.