UK data watchdog confirms it's probing complaints about spammy marketing for NHS COVID-19 contact-tracing app
- Reference: 1601543111
- News link: https://www.theregister.co.uk/2020/10/01/ico_investigating_complaints_covid_app_spam/
- Source link:
Between 26 and 27 September, NHS Digital [2]messaged anyone resident in the country who was over the age of 16 and had previously provided their contact details to a GP. Those contacted had not specifically opted in to receive marketing communications regarding the NHS COVID-19 app.
In [3]its FAQ , the NHS justified the mass email-and-text blast by underlining the urgency of the current situation.
"It was determined a matter of public health importance to encourage people to download the app as a critical part of NHS Test and Trace," it wrote.
"England is experiencing a second peak of coronavirus transmission, resulting in a number of local restrictions and tightening of national restrictions. Encouraging people to download the NHS COVID-19 app is considered by the Department of Health and Social Care (DHSC) to be a highly important tool for managing and monitoring the outbreak, and a matter of public interest."
This didn't go down well with everyone that received the message, including Reg readers. "The UK government is spamming people in an attempt to get them to install the test and trace app (what all good app developers do, right?)," one told us.
"I have not opted in to receive emails such as the one below. I've expressly opted out of all data sharing via my GP, anonymous or otherwise. Even worse there is no unsubscribe link in this email. It seems like the only way to opt out of these messages is to tell my GP to remove my email address and phone number from their system, I'll do that now."
In a statement sent to The Register , the ICO confirmed it had started investigating complaints but did not disclose to us how many it had received.
"We have received complaints in relation to text and email messages being sent about the NHS COVID-19 app and we are making enquiries," said an ICO spokesperson.
NHS COVID-19 [4]launched on 24 September . It arrived at an acutely challenging moment for the UK's fight against the pandemic. Infection rates have skyrocketed, prompting local lockdowns across large parts of Wales and Northern England. Given these circumstances, cybersecurity expert Professor Alan Woodward of the University of Surrey, understands why the NHS opted for the path it took – although he noted that data should be used with the strictest safeguards.
"I suppose I can see why they did it. What I was unaware of, and so I suspect are others, is that GPs share our phone numbers with other parts of the NHS. It would be nice to know how it is protected and specifically how NHS digital are ensuring it doesn't become a victim of hackers.
"Much, I suspect, may depend on how it is stored. If it's stored and associated with other personal data, it represents an incredible target. It would effectively be the phone number of everyone over 16 who has a mobile phone (assuming they registered the mobile with their GP which most do ask for as they now send texts from the local surgeries with things such as appointment reminders)."
Woodward added that there should be no need to associate the phone number with other biographical information due to the generic nature of the message. "It goes back to basic GDPR principle of collecting the least amount of data to achieve the objective," he said.
While some may fault the methods of NHS Digital, you can't really argue with the results. By the end of the weekend, [5]nearly 12.4 million people in England and Wales had downloaded the app.
Given the spike in infections – rising to a [6]UK record of 7,143 yesterday – it's a good job the app is finally here. It was once billed as a central component in the fight against coronavirus until [7]development failed and it was relegated to being described as the [8]"cherry on the cake" by Baroness Dido Harding, who leads the test-and-trace programme in England.
The Register has asked the Department for Health and Social Care and NHS Digital to comment. We will update this story should we hear back. ®
Get our [9]Tech Resources
[1] https://www.theregister.com/2020/09/24/uk_covid19_app/
[2] https://www.gov.uk/government/news/nhs-covid-19-app-emails-and-sms-messages
[3] https://faq.covid19.nhs.uk/article/KA-01311/en-us?parentid=CAT-01022&rootid=
[4] https://www.theregister.com/2020/09/24/uk_covid19_app/
[5] https://www.bbc.co.uk/news/technology-54326267
[6] https://www.theregister.com/2020/09/30/nhs_england_awards_16m_deal/
[7] https://www.theregister.com/2020/05/14/nhs_contact_tracing_app/
[8] https://www.theregister.com/2020/06/12/test_and_trace_covid_19_briefing/
[9] https://whitepapers.theregister.com/
Not that they are worried
Unelected beaurocrat Cummings will soon replace the ICO bosses with a Tory yes-man/woman
They won't bother...
He'll just ignore the ICO's findings, and point out that reading spam email and texts is a good way to test your eyesight...
FFS!
It's a global pandemic. It kills. We have shut down our economy. And people are getting up -tight over a text message that wants you to download an app that is likely to help us manage things? The day I don't get a single phone call telling me that I've had an accident because the warranty on my washing machine has run out because of the virus on my pc is the day I'll dedicate a flea's fart worth of energy to getting up tight about unsolicited public health messages for my own FFFing good!
Re: FFS!
If you don't complain when government breaks the rules it's a slippery slope. What if they start using this dataset for other things? They have pretty much just used the pandemic as a cover to get the phone number and email address of nearly every single person. Why not write to everyone? It would have been simpler as they already have that dataset from the electoral roll and previous mailing. It would actually have been cheaper than consolidating all the different GP systems data. Let know what other liberties you are going to allow them to take in the name of the pandemic?
Re: FFS!
1. They already have your phone number and email address (driving licence, car tax, inland revenue etc...and if not it's written in a ledger in a shed in Cheltenham).
2. They can tell me when to wear a mask - I'm good with that.
3. I would be quite happy if they sent people who fail to quarantine after positive tests to Papua New Guinea.
4. I can cope with them telling me not to go to the pub after 10pm (way after my bed-time anyway).
5. In fact if it means me, my family, my friends avoid an unpleasant death in an intensive care ward, I'll accept quite a lot.
I got one...
and pretty sure I've never shared my mobile number with the GP.
Re: I got one...
They probably used the cum-o-base they gathered together for the brexit shenanigans. It has everyone on it.
Re: I got one...
I'd assumed they just had the networks push-to-all on public-health grounds (entirely reasonable in this particular scenario). [1]Cell Broadcast Services exist in the standard to support things like [2]Emergency Alerts .
Emails obviously had to have been sourced from somewhere - my GP has my email, but I didn't get one, just the SMS.
[1] https://en.wikipedia.org/wiki/Cell_Broadcast
[2] https://www.theregister.com/2018/01/30/hawaii_missile_drill_attack_real/
Re: I got one...
I think that's what they're doing. Just ask the networks to send a message to every phone they see.
Re: I got one...
That probably explains it. My partner, who lives at a different address, didn't get one in spite of frequent calls to and from the GP practice.
Re: I got one...
Not bothered, just curious...why the downvote? My post seems pretty innocuous and unlikely to inflame emotions.
I noticed the spam but didn't check closely, assuming that, because it came in via the specific email address, that it was the GP sending out messages on behalf of the NHS which would have been acceptable.
Time to change the email address.
You lot...
Are actually aware we are talking about a virus that can shut down interferon immune messaging by up to 85%, so the body doesn't recognise an infection. A virus that can switch off your immune system? Then it can interfere with antibody production and the active immune system going after infected cells in a serious infection... And after that triggers cytokine storm - killing by stroke, blood clots (*inch long* blood clots), heart attack and organ failure? Not to mention there are at least 6 clades in the tree of cv19 and maybe 50 different genetic versions..
Did this somehow escape you?
Yes, you were spammed technically, boo-fucking-hoo. This message was sent to you in order to save lives. Including possibly yours or your family so FFS..
STOP BEING SO BLOODY ARROGANT AND SELFISH YOU MINDLESS FRIGGING SNOWFLAKES.
The human race disgusts me.
Re: You lot...
Yes, we are aware how serious it can be, and what we should do as responsible citizens to stop the spread of infection. That isn't in question.
The issue is that receiving spam from a source that you might not have expected to have your details can be disconcerting, whether you intend to download the app or not (or in my case after I had already downloaded it).
Particularly when you know tragic Dido is in charge of the operation...
Not to mention that an overly heavy-handed approach might be counterproductive. People are still angry with Dominic "I do what I want, you do what I say" Cummings.
Re: You lot...
No, the issue is you are letting your blood pressure rise over something that a) was almost certainly warranted in the current situation and b) is, on a scale of privacy intrusion in everyday life, inconsequential. High blood pressure is a contributory factor in many COVID deaths - so maybe take some time to calm down. (I'd tell you to take a few deep breaths...but that might be insensitive in the circumstances).
Spammy, but also stupid
We got a text encouraging us to install the app, at 7:30 on Sunday morning. That's a really good way of making sure people decide not to install the app. Sending texts during the hours people are likely either to be awake or not woken up by the text would be something people with functioning brains would think about.
(For the record, we do have the app: it put me off, but not that much.)
I got the email at 7:41 Sunday. I already had the app installed. On most phone's it's possible to set a 'do not disturb' so it doesn't wake you up with a nocturnal notification. Needless to say mine turns back on at 7:30, as that is also when my wake-up alarm goes off. Normally I make a cup of tea and check for any overnight emails and texts then so for my use case it would make more sense than later in the day as I don't live with my phone except when I'm out and about.
What message?
Bit confused my GP has my contact details and for the rest of household too, but none of us received any message about the app.
Good to see the messaging is a reliable as the app
Worked as intended
As the app isn't an NHS app, but a Serco one, this has had the desired effect of allowing a private company access to all that juicy GP data. Move along.
Re: Worked as intended
It is not a Serco app. They had no connection with the design of the software. If you know better please give references.
Old phone = No app, No texts or phone calls from the NHS fuhrer, Herr Cummings.
Not to worry, 70-year-olds don't get ICU beds anyway...
Given the spike in infections...
... it's a good job the app is finally here.
Perhaps it's the app spreading the infection by surreptitiously retrofitting 5G technology to your phone and channelling vaccines into your proudly unmasked face through the microphone.
I didn't get a text or email, I guess that's because it's so long since I visited my GP I bet the mobile number on their records is for an old Nokia in a drawer somewhere
Is that what those messages were??
I think I ignored them.