Transparency – Evidence, Ethics and Impact
This page provides links to a variety of sources that helped inform what we developed, how we developed Protect Scotland – including the approach we took, and what considerations we took into account as to the impact Protect Scotland is likely to have.
Our innovation partners the Digital Health & Care Institute worked with their academic members and published a number of documents that directly contributed to the design of Protect Scotland:
- Rapid Review of Contact Tracing Methods for COVID-19
- Use of Participatory Apps in Contact Tracing – Options and Implications for Public Health, Privacy and Trust
- Global Examples of COVID-19 Surveillance Technologies: Flash Report
We also considered the European Centre for Disease Control’s paper on Contact tracing for COVID-19: current evidence, options for scale-up and an assessment of resources needed.
In addition, there have been a number of academic studies on the potential effectiveness of proximity tracing apps. The most recent of these, which supported the approach Scotland has chosen to take, was from Oxford University and Google.
These studies showed that, when implemented as part of traditional manual contact tracing, proximity tracing apps such as Protect Scotland have the potential to reduce infections, hospitalisations, and deaths at almost any level of adoption – although they all conclude that the higher the rate of adoption, the better the impact.
So please download Protect Scotland today, and use the ‘Share and Protect’ button to spread the word with your friends, family and colleagues.
A key consideration driving how we developed Protect Scotland was our ability to demonstrate adherence to an ethical framework. There are a number of ethical frameworks out there covering digital health developments more generally, and contact tracing technology specifically. For example, see this report on building public trust from the Ada Lovelace Institute which was published after we had started developing Protect Scotland.
However, it was a report from Dr Pagliari entitled The Ethics and Value of Contact Tracing Apps: International Insights and Implications for Scotland that set out the framework that ultimately drove our considerations:
- The technology – Will it work reliably? Is it safe? Is it secure? Is it private-by-design? Is it co-dependent on any other apps, databases or technologies (e.g., AI) that could alter these properties? Is the software code open to scrutiny by others?
- Its data privacy policies – Does it capture or use only the minimum necessary data? Is consent required? How anonymous is it? Is it clear who it will be shared with and for what purposes? Will it be deleted after COVID-19? Are these policies adequately explained and accessible to users?
- Its usefulness – Is it really needed for this purpose? Does it achieve what it claims to? Is the value for citizens worth the privacy trade? Will it divert resources from more useful activities?
- Its optionality – Are citizens free to choose whether or not to use the app, or particular features within it? If so, is this a genuine choice (e.g., not being able to return to work/ school otherwise)? Is it easy to control how data is shared by opting in or out?
- Its fairness – Could be used in inequitable or discriminatory ways? Is it disproportionately intrusive, exploitative or coercive? Are the app and its benefits accessible to all (digital inclusion)? Could it restrict people’s liberty?
- The people driving or developing it – Are they being transparent about the project’s ambitions and scope? Do they have secondary motives or conflicting interests?
- The institutions responsible for delivering it – Is there sufficient oversight and accountability; are there adequate processes and expectations for stakeholder involvement?
- The users – Is it vulnerable to misuse in ways that could harm or inconvenience others?
A number of impact assessments have been completed, either in full or as interim documents. You can download these here:
- Children’s Rights & Wellbeing Impact Assessment – initial screening. The full ‘CRWIA’ will investigate and assess the impact of lowering the age limit below 16 over the next few weeks, and will take a Human Rights Based Approach
- Interim Equality Impact Assessment. A new Digital Health Equalities & Inclusion group will be established to assess the emerging evidence of the impact of Protect Scotland and the EQIA will be updated accordingly
- Data Protection Impact Assessment. This document explores, in a transparent way, how the data protection principles and rights of the population in Scotland are observed within the Protect Scotland app. It should be read in conjunction with the app’s Privacy Notice. It is a very long read, so you may find how we use your data answers any questions you have
Protect Scotland is built on Open Source code, originally developed on behalf of the Government of the Republic of Ireland and further developed on behalf of the Government of Northern Ireland.
Protect Scotland was developed from the ‘Open Green’ resource under the terms of the Apache 2.0 Open Source Licence. You can view the full Protect Scotland code, along with some technical documentation and diagrams, at https://github.com/NES-Digital-Service/protect-scotland. You can copy, inspect and distribute the code for your own use, although Protect Scotland accepts no liability for how the source code is used by others.
The code repository has basic documentation. There may be instructions for running the code but we cannot offer any support to 3rd party developers. We have not included any private API keys. While you may be able to build the app, you will not be able to connect to the backend. A self-built app will not be able to broadcast or receive contact tracing information. You can read more on making a public health proximity tracing app using Google and Apple’s Exposure Notification System at https://www.google.com/covid19/exposurenotifications and https://developer.apple.com/documentation/exposurenotification.