What data does the NHS app collect?
The government and NHS have been keen to stress that the app doesn’t collect user data that could identify an individual. Location data is not collected as GPS technology is not used and the app does not ask for a user’s name or other personal information. This extra information will be required if a person reports they have symptoms as they will need to be tested for coronavirus.
There are a few pieces of information the app does collect. When you first download and use the app you will be asked to enter the first half of your postcode. Officials say this is to allow the NHS to track the spread of coronavirus.
The app will also record what phone you are using and information around Bluetooth usage. This includes the unique IDs of the devices you phone has interacted with. It also includes both how long devices were communicating and how strong the signal between the devices was. A stronger signal should, in theory, mean you were closer to an infected person. Health officials hope that these pieces of data can be combined into coronavirus modelling to help understand more about how the virus spreads.
While the app has been created to collect as little user information as possible, this doesn't mean there could be challenges faced. "There are some downsides to our approach though," Ian Levy, the technical director of the National Cyber Security Centre (NCSC), an arm of GCHQ, has said in a blog post. "For example, the system ends up with a list of devices that have been near each other, even though they're anonymous."
The system knows that device 123456 and device ABCDEF, for instance, were near each other on a set of dates when one of the device owners reports their symptoms. "In theory, that's a privacy risk, but it's only stored on the NHS app system and there's no way to link device 123456 to 'Ian Levy' or a particular place," Levy says. "If you discover that my app ID is123456, there are some theoretical things you can do to try to understand my contacts if you've followed me round. But if you've followed me round, you've probably seen my contacts anyway." He adds the attack type couldn't be done remotely.
Levy says the front end of the system will see a person's IP address but the NHSX system does not. "The cyber security monitoring of the system keeps logs which include IP address, but they're strictly access controlled and are only accessible to the cyber security team looking after the app system."
https://www.wired.co.uk/article/nhs-covid-19-tracking-app-contact-tracing