Other points of view:
Levy repeatedly tried to square this circle, leading to some ludicrous assertions. He stated boldly in bullet points that the app "doesn't have any personal information about you, it doesn't collect your location and the design works hard to ensure that you can't work out who has become symptomatic" and that "it holds only anonymous data and communicates out to other NHS systems through privacy preserving gateways."
But what is literally the first thing the app does when you install and open it? It asks for your postcode, and logs the exact make of your phone.
Levy explained "a big random number" is also generated, which is tied to the copy of the contact-tracing app on your phone. This 128-bit ID is what the app on one phone exchanges via Bluetooth with itself on a nearby phone when they come in range. This exchange includes when exactly the IDs were encountered, how long the phones were near each other, and the signal strength, allowing the distance apart to be calculated. This is the data that is ultimately shared with the NHS, when you choose to.
The exchanged data is also encrypted in such a way that the NHS can decrypt it but not other users. We understand these ID numbers are generated server-side, and are people's unique fingerprints in the centralized system.
Levy also noted that "currently" only "the first part of your postcode" is taken and stored "for NHS resource planning, mainly." He goes on: "Nothing identifying and no personal data are taken from the device or the user."
Does it matter?
Presumably the goal with this kind of explanation is to comfort the vast majority of UK folk who don't understand how the entire internet economy works by connecting vast databases together.
So long as you can rely on one piece of per-user data – like a "big random number" – everything else can be connected. And if you also have a postcode, that becomes 100 times easier. Ever heard of Facebook? It's worth billions solely because it is able to connect the dots between datasets.
Indeed, it may be possible to work outwho is associating with whomfrom the app's ID numbers. Bear in mind, the Apple-Google decentralized approach produces new ID numbers for each user each day, thwarting identification, especially with the ban on location tracking.
Levy also glossed over the fact that as soon as someone agrees to share their information with UK government – by claiming to feel unwell and hitting a big green button – 28 days of data from the app is given to a central server from where it can never be recovered. That data, featuring all the unique IDs you've encountered in that period and when and how far apart you were, becomes the property of NCSC – as its chief exec Matthew Gould wasforced to admit to MPson Monday. Gould also admitted that the data will not be deleted, UK citizens will not have the right to demand it is deleted, and it can or will be used for "research" in future.
And then there's the not insignificant issue that the entire approach may break privacy and human-rights laws, anyway, as one legal firm hasadvised:
A de-centralised smartphone contact tracing system – the type contemplated ... by governments across Europe and also Apple and Google – would be likely to comply with both human rights and data protection laws. In contrast, a centralised smartphone system – which is the current UK Government proposal – is a greater interference with fundamental rights and would require significantly greater justification to be lawful. That justification has not yet been forthcoming.
Oh yes, and "the UK Government's announcements for sharing health data between the private and public sector appear to be flawed. This means such data sharing is potentially not in compliance with legal requirements."