The Information Commissioner’s Office (ICO) has issued a reprimand to the Scottish Government and NHS National Services Scotland (NSS) over the implementation of the NHS Scotland Covid Status app.

UK Authority reported that the ICO said the Scottish Government and NHS Scotland had failed to provide people with clear information about how their personal information - including sensitive health data – is being used.

The app was rolled out during the Covid pandemic as a means for them to demonstrate their vaccination status to satisfy mandatory Covid status checks that as a condition of entry to, for example, nightclubs.

UK Authority reported that, after a review, "the ICO said it had a number of concerns, particularly with plans for sharing images of passport details with the software company providing the facial recognition technology used in the app. This was intended to help the company improve the software, but would have been unlawful in these circumstances as it was not necessary for the app to function and served no benefit to the user. Also, it had not been previously communicated to the ICO.

"The ICO advised that the app should not be launched until its concerns had been addressed, which prompted the Scottish Government and NSS to halt plans to share personal data with the software company. But the app was launched on 30 September 2021 as planned without fully addressing the ICO’s wider concerns about compliance with data protection law.

"This prompted an investigation that has led to the reprimand over the initial failure to provide adequate privacy information and an ongoing failure to provide concise information to support people’s understanding of how their data is being used.

"The ICO has decided to make this reprimand public because of the significant public interest in the issues raised.

"It said it now expects the Scottish Government and NSS to act swiftly on these findings and apply the wider learning from the roll out of the app to any similar activities in the future.

"If both bodies fail to take action it will consider whether further regulatory action is required."