The NHS Covid-19 app must be "decommissioned" once the pandemic eases, the UK’s privacy tsar has said, as she warned ministers against mission "creep". 

Elizabeth Denham, the Information Commissioner, said her office would take action against the Government if it "overreached" and the app strayed from its limited emergency contact-tracing function.

Her comments come as ministers look to alter the app in the wake of the "pingdemic," which is causing widespread disruption across the country as hundreds of thousands of people receive self-isolate notifications.

In an interview with the The Telegraph, the commissioner, who is due to step down at the end of October when her term ends, also warned ministers that the UK public is “very suspicious” of any scheme that resembles ID cards and that any use of domestic vaccine passports has to be only for a limited period.

Ministers are coming under increasing pressure over the NHS Covid-19 app, which pinged a record 600,000 people this week, leading to transport disruption and fears of food shortages as workers isolated en masse.

Keeping a close eye on the Government

Ms Denham said the app had been a “necessary” tool for the Government at the height of the pandemic, but that her office is now watching its development closely.

When it was initially developed last year, ministers had wanted to build a version of the app that would collect anonymised data on users on a single large NHS database.

However, they had to backtrack after a series of technical glitches, and the switch over to a version built by Apple and Google, which kept more of users’ data on their phones, allayed many of the initial concerns over privacy.

Ms Denham said she is now keen to guard against “function creep” and the possibility of Whitehall evolving the app into a more permanent feature of British life.

Elizabeth Denham, the UK Information Commissioner, has expressed concerns over the NHS Covid app and vaccine passports

Credit: Paul Cooper/Paul Cooper

She said: “We will be watching the evolution of the app very carefully. My modus operandi has always been how can we help government get this right and build in privacy to these innovations.

“At the end of the day, if there is a contravention of the law with the app or overreach in its use then we will take action.”

Ms Denham added: “The focus of our office will be how it is used next, how else is it going to be used and how it will be decommissioned when it is no longer necessary.”

The Information Commissioner’s Office (ICO) is also currently advising the Government on plans to use vaccine passports domestically. Nightclub-goers, for example, will have to present them to enter venues from September.

She said ministers must ensure that any such measures are time-limited to deal specifically with the pandemic and not allowed to evolve into a more permanent regime.

Commenting on the plans for domestic vaccine passports, Ms Denham said: “You have seen the UK public being very suspicious of the use of ID cards. The questions we have to ask ourselves are: is it fair? Is it proportionate? And is it necessary.”

Vaccine passports in large venues

Major confrontation 

During her five years at the helm of the ICO, Ms Denham has not shied away from big confrontations. She has taken on some of the world’s most powerful tech companies over their use of British citizens’ personal information.

In 2018, she fined Facebook £500,000 – the highest amount then available to the ICO – for its role in the Cambridge Analytica scandal, which saw people’s data unwittingly harvested on the social media site before being used to target them with political ads.

In September, the ICO will oversee a groundbreaking new code that could lead to tech companies facing fines of billions of pounds if they misuse children’s information to target them with harmful content or features.

The Age Appropriate Design Code comes in the wake of the death of schoolgirl Molly Russell, who took her own life after viewing self-harm and suicide material on Instagram and other sites.

“The kids code will help to prevent the kind of rabbit holes that Molly Russell was sent down and the barrage of messages she received,” said Ms Denham.

As she prepares to step down from the ICO, Ms Denham said she is most looking forward to returning to her native Canada to see her two new grandchildren for the first time.

The 62-year-old added: “Both my son and my daughter delivered a grandchild to me and I am very excited about getting back to Canada to see my grandchildren.

“I have one that is two and a half years old and I have had lots of time with her on FaceTime, but the newborns I haven’t held yet. So like many people at the moment I am missing my family.”