NHS app storing facial verification data via contract with firm linked to Tory donors

6 min read
Exclusive: campaigners raise privacy concerns over government deal with iProov in England
The NHS app is collecting and storing facial verification data from citizens in England in a process which has fuelled concerns about transparency and accountability.

The data collection is taking place under a contract with a company linked to Tory donors called iProov, awarded by NHS Digital in 2019, which has yet to be published on the government website.

Privacy campaigners say the opacity of the relationship between London-based iProov and the government raises questions about how securely the information is held, with one saying they were "deeply concerned" about the secrecy surrounding the use of data.

An NHS spokesperson confirmed law enforcement bodies were able to request data, but that a special panel reviewed such requests, taking into account the health service's duty of confidence.

The number of users reached 10m this year after the app was adapted to act as a Covid-19 passport. It is used to access medical records and book GP appointments, as well as obtain certificates which prove an individual's vaccine status for overseas travel, or for entry to events such as football matches. The number of users has grown by six million since the Covid pass was introduced in mid-May. The app is separate from the official NHS Covid-19 app, which acts as a contact tracer.

The app asks some users for video facial verification by default, although it is possible to opt out of the process.

The process involves new users recording a video of their face. The video is sent to iProov which compares the facial data with anonymised photo IDs already held by the government. Its Flashmark software beams a one-off sequence of colours at the user's face, through their phone, to ensure they are genuinely present during the verification process.

The app also asks users to upload their date of birth, postcode, phone number and a photo of either their passport or driving licence during the sign-up process. Only a photo clipped from the ID document is supplied to…
Rob Davies
Read full article