Skip to content
Virtual event

Exit through the App Store?

A summary of the third panel on the Ethics & Society stage at CogX 2020 - Day 1

Date and time
2:00pm – 2:45pm, 8 June 2020 (BST)

On Monday 8 June, we were delighted to kick off CogX 2020 by curating the first day of the Ethics & Society stage. 25 speakers across six panels joined us to tackle the knotty, real-life trade-offs of benefits and harms that emerging technologies bring to people and society. This is a summary of the third panel of the day – Exit through the App Store? – which you can watch in full below:


  • John Thornhill

    Innovation Editor, Financial Times


  • Husayn Kassai

    Co-Founder and CEO, Onfido
  • Professor Sir Jonathan Montgomery

    Professor of Health Care Law, University College London and member of Ethics Advisory Board, NHSX
  • Claire Craig

    Provost, Queen’s College Oxford


The panel follows the publication of Exit through the App Store? – an Ada Lovelace Institute rapid evidence review of the technical considerations and societal implications of using different types of technologies around the COVID-19 crisis published in April 2020.

This focused on symptom trackers, contact tracing apps and immunity certificates. Lots of the conversation in the intervening period has been around contact tracing apps but we are starting to see different countries consider how to expand the functionality of contact tracing apps to include immunity certificates, or potentially to develop new types of apps that would allow individuals to certify immunity status.  

This panel tackles these issues.  


The WHO has cautioned against the implementation of ‘immunity passports’. There are still outstanding concerns about the accuracy of antibody tests and even for reliable antibody tests. There is still significant uncertainty about what the presence of antibodies means for any potential immunity. Those seem like decisive arguments against immunity passports for now. 

What if the science becomes more reliable and does overcome those problems? 

It is still complex topic. The results of antibody tests are a continuum – they give you an individual’s level of antibodies. Immunity passports convert that continuous value into a pass or fail classification. Going from a continuum to a pass or fail is not a new idea and it does work in some circumstances. An eye test is a matter of degree of vision, but we have a cut-off for what we believe is safe for driving.  

However, currently there is a big difference for an eye test. You can safely correct your status with glasses to make yourself fit, whereas we would need a vaccine for COVID-19 before we could safely correct an individual’s immunity status. 

The ambiguity of the test result can be partly corrected by weighting it against other factors. Apps developed in China have proposed combining many factors, such as travel data, location data, recent contacts, temperature, other health conditions etc. alongside the results of any tests.  

That might make sense when I’m aligning my interests with those of the people advising me, such as in personal health. However, this status might also be used to determine rights to travel or work. We shouldn’t assume it’s always a good thing to be classified as immune. For example, an employer might demand those deemed immune to take risks they don’t want to take, e.g. to work with COVID-19 patients. 

What follows from the status determines how we should view it. History warns us to be concerned about the possibility of stigma or discrimination. In the case of HIV, even just taking a test affected people’s ability to access life insurance, and therefore mortgages, housing etc. 

Immunity status has also not just been used to determine whether you’re safe to work, but whether you can work at all. Health status has also been used to determine your ability to marry the person of your choosing. In the case of Yellow Fever in 19th Century New Orleans, having the right immune status was a mark of divine favour and prerequisite to participation in much of society.  

If we do move towards immunity certification, we need to also think about the policy that goes alongside it, such as anti-discrimination provisions and compensation for those who are not freed from restrictions. We may even need to prohibit their use in inappropriate areas, much like genetic testing in insurance. 

We have a series of challenges around the uncertainty of the science and the creation and meaning of the status. We need to decide if we want to live in a world where COVID-19 status determines how you can access it. If you imagine the sort of experiment John Rawls suggested, that you sit behind a veil of ignorance and you’re designing the society you want to live in, that you don’t know our own current COVID-19 status, it could be allocated to you in a random process, would you choose to live in a world where that status determines your chances of leading the life you hope for?  


If the aim is well founded public decision making, then we need to consider the concerns of a diverse public, that represent the spectrum of experiences in society, alongside the outstanding questions of science and technical implementation. 

If you give groups of people time to talk to experts on an equal footing, then they have very nuanced and contextualised opinions. Their responses to technology aren’t just about technology, they’re always about social, behavioural and governance systems they are embedded in. 

So, the issue of immunity passports is also about who is making decisions? Who holds knowledge? Who holds data? What consequences and systems of accountability there are when there is a failure? People do expect systems to fail somehow. 

There is also for the potential for a ‘lightning rod’ effect because most people don’t have the time to consider all the issues and so will focus in on one debate. For example, centralised versus decentralised became an overwhelming focus in the contact tracing debate. 

We often feel our identities viscerally as a singular thing, but we live with different aspects of ourselves emphasised in different contexts. So, building a robust system requires only surfacing attributes of identity that matter for that context, e.g. only needing to know whether an individual has the attribute of immunity and not sharing anything else beyond that. 


How do we square urgency with trust in any potential system? 


Sometimes there must be a decision taken immediately, and you should use inference from what we know from similar examples. But deliberation doesn’t take that long and given that the science will take some time, there is an opportunity for public deliberation on near-term futures. 


I’m not impartial on this topic. Onfido does identity verification and if these systems do come into being, we’re hoping to be involved in their implementation. 

There is a need to bind individual’s identity to an immunity app to prevent others from using their test results and certification to access a place or service. Further, there is a need to oversimplify the certificate to make it accessible for users. These apps should only give a yes or no answer. It should share the minimal necessary data from individuals. 

These systems are increasingly being called a ‘health passport’ rather than immunity passport because there is no certainty in the results and the World Health Organisation does not encourage the idea of immunity passports. Stigma is important to consider ahead of time and we need to make sure these systems are accessible and inclusive if they are deployed. 

We should consider we are living in a sub-optimal state and need a ‘principle of least restrictive alternative’. We need to aim for a gradual reduction of restrictions rather than waiting for widespread vaccination. Those who are already low risk could help others who are still at risk, e.g. in care homes, or start to reopen the economy, e.g. gyms for those who are classified as immune. This would also improve their resilience to other health conditions. We should consider whether we want these systems and want to take the risk and uncertainty in the context of widespread lockdowns and the other alternatives to unlocking society. 

There is strong evidence that people who have had it in the last four months, don’t seem to be getting it againIt is unclear whether people can get it again in six or 12 months and we will have to wait until then to know. The question is then: should people be able to have time-limited certificatefor example a three-month certificate for travel or relief efforts? 


Exit Through the App Store? recommends a Group of Advisors on Technology in Emergencies (GATE) and primary legislation to govern these systemsWhat do you think? 


We can’t create primary legislation because we don’t know exactly what we’re talking about yet, in terms of the science and technology. Primary legislation is difficult to get and difficult to undo. 

Policy decisions are better made when properly advised but a generic group for all emerging technologies is hard to imagineStem cell technologies and human fertilisation has a quite slow process and different expertise to the use of data-driven technology for COVID-19 

However, a specific continuous mechanism for AI and data in COVID-19 would be useful to inform and help deal with problems when things do go wrong. We need something sustained in the current crisis to ensure trust and trustworthiness. 


Primary legislation can be passed quickly when there’s political will, as we’ve already seen in this crisis. 

The first potential area for legislation is in discrimination. Should we consider the relatively small step of making COVID-19 status a protected characteristic under the Equality Act? It might go a long way to offsetting many concerns. The Human Genetics Commission repeatedly asked Government to make genetic status a protected characteristic and Government resisted that on the grounds it was covered under generic discrimination rules. However, it could be a step towards assuring public confidence by making it clear and explicit. 

The second area is trustworthy data stewardship. This could be done relatively easily with a good legislative framework and would help us focus on what makes a difference rather than getting into debates about privacy. 


Some companies are suggesting immunity passports should be mandatory for their employees. Do these need specific legislation?


We should be worried about the extent to which is there is genuine choice for employees. For example, it seems proper for there to be medical and drug testing for pilots; there is clearly a common interest in safety for pilots and passengers. 

There is the potential to use AI to stratify risk in much more careful way with employers use that stratification to focus on working practices, e.g. in the areas of work that require higher risks, lower risk employees should take on that. If you do that in dialogue with employees, getting their consent, then that would be a very positive direction. 

However, iit is used to keep some people away from workplace or restrict them from making a livelihood entirely, then that is concerning. 


How do we best address the risk of discrimination? 


This is a classic policy problem of trying to use past evidence to make predictions about the future 

We need to think about parallel paths. It’s very easy to jump to just doing somethingThe more you can incorporate discussion of alternatives, the better the decision will be. 

Exploring alternatives can also help with identifying unintended consequences. However, experts don’t always spot unintended consequences. More public engagement can help spot unintended effects, by people drawing on their lived experiences in different settings, people can identify who might be discriminated against and how in particular circumstances. 


Who is doing this well around the world? Where can we learn from? 


We need a pathway out of lockdown that benefits everyoneImmunity certificates could be a first step, building up to widespread community testing and vaccine, so everyone is protected and released eventually. That’s as long as there are good support systems for those in the slow lane. No countries have managed to make that work just yet, in part because we are still learning so much about the virus itself.

Health data and COVID-19 tech

Related content