The NHS contact-tracing app must not be rolled out across the UK until the government has increased privacy and data protections, an influential parliamentary committee has said. This comes as human rights groups warn that the current trial is unlawful under the Data Protection Act 2018.

The joint committee on human rights said on Thursday it was essential that legislation was enacted to ensure the mass surveillance of personal data did not result in a violation before the trial which is being carried out in the Isle of Wight was expanded.

Its report was published following a legal letter from the Open Rights Group warning of “heightened and urgent concerns” that the government had failed to follow laws requiring it to submit an assessment of the risks to the information commissioners office.

The app, which is being trialled on the Isle of Wight, logs users’ movements and can alert people if they have had contact with someone who has developed symptoms.

Ministers have said it is an important tool to study the spread of Covid-19 and to help them ease lockdown restrictions.

But privacy campaign groups have opposed its introduction and a group of UK academics working in cybersecurity, privacy and law recently signed a joint letter saying it could open the door to general surveillance.

MPs and peers on the committee examined evidence submitted by experts in human rights law, surveillance and computer science. 

The committee called for new legislation with guaranteed data and human rights protections, as well as an independent body to oversee the use, effectiveness and privacy protections of the app and any data associated with this contact-tracing, a digital contact-tracing human rights commissioner to deal with complaints from the public and report to parliament, and regular reviews of the scheme by the health secretary.

The prime minister’s spokesman said: “Users can delete the app and its data whenever they want and we will always comply with relevant laws, including the Data Protection Act.”