The joint initiative unveiled earlier this month would use Bluetooth technology to determine when iPhone and Android device users have come in close proximity with someone who has reported a positive COVID-19 test result, allowing public health officials to directly notify those individuals of the potential exposure, the companies say.
Elizabeth Denham, head of the U.K.'s Information Commissioner's Office, said on Friday that the plan "aligned with the principles" of U.K. privacy law, including by mandating by design that only necessary information about specific people is collected. The proposal does not currently call for individuals' specific location histories to be tracked, for example.
"The principles of data protection by design and by default are central to the law, and we were pleased to see Google and Apple making clear how they are aligning with these principles in their joint work on contact tracing technology," the ICO's office said in a blog post.
But the regulator cautioned that the organizations tasked with using the Apple-Google technology to build tracing apps available to the public "need to take a similar approach" to avoid collecting more data than needed, or using already collected data in new, potentially intrusive ways beyond the scope of purely tracking the spread of COVID-19.
"We understand the onus is on organisations to move quickly — but even an initial privacy impact assessment that is then developed is a minimum requirement," Denham said the blog post.
While saying the tech giants' plan "offers a strong start," the ACLU raised similar concerns in its own blog post on Thursday, laying out a list of principles by which it said any contact tracing app should be judged.
Decisions to use COVID-19 tracking apps need to be "voluntary and uncoerced," wrote ACLU surveillance and cybersecurity counsel Jennifer Stisa Granick, arguing that signing up for such an app should not be a requirement for returning to school or work, for example.
Some countries, like China and Israel, have required citizens who have tested positive to use contact tracing technology, according to reports, but such an approach in the U.S. would be misguided, Granick wrote.
"When people feel that their phones are antagonistic rather than helpful, they will just turn location functions off or turn their phones off entirely," Granick wrote in the post. "Others could simply leave their phone at home or acquire and register a second, dummy phone that is not their primary device with which they leave home."
"Good public health measures will leverage people's own incentives to report disease, respond to warnings, and help stop the virus's spread," Granick added.
Contact tracing apps using the Google-Apple technology should only be used for public health purposes, and not for advertising, law enforcement or any sort of "punitive" purpose, according to the ACLU. App developers need to put measures in place to minimize the amount of data collected and destroy that data when it is no longer needed, while governments should be transparent about what data they acquire and how they use that data, Granick said in the blog post.
So far, the Apple/Google proposal "offers a strong start when measured against these technology principles," Granick wrote. But the blog post also raised concerns that the Bluetooth "proximity logs" that app users would generate under the plan would threaten the "promised anonymity" of the system, allowing individual users to be identified.
Representatives for Apple and Google did not immediately respond on Friday to requests for comment. But both companies have stressed that they developed the plan with privacy and security in mind, and that potential users will be allowed to "opt-in" to the contact tracing network.
--Additional reporting by Allison Grande. Editing by Nicole Bleier.
For a reprint of this article, please contact reprints@law360.com.