Neil Parish, MP

Chair, Environment, Food and Rural Affairs Committee

House of Commons

London

SW1A 0AA

28th April 2020

Dear Mr Parish, and Colleagues,

Call for Evidence – COVID-19 and food supply

We are writing to address two of the questions on which the Committee has invited evidence:

  • Are the Government and food industry doing enough to support people to access sufficient healthy food; and are any groups not having their needs met? If not, what further steps should the Government and food industry take?
  • How effectively has the Government worked with businesses and NGOs to share information on disruptions to the supply chain and other problems, and to develop and implement solutions? 

The AVPA represents leading UK technology companies providing secure online age verification. We have been seeking to offer a more strategic solution to prioritising vulnerable people not just for food shopping, but for any online goods or services, and have not yet attracted the attention of Defra, in spite of the proposal being eventually published by the Crown Commercial Services on their website of offers from business last week.  Frankly, we hope your Committee will be able to see the benefits of this technology and persuade the Department to give it consideration.

Digital Proof of Shielded Patients

We have put forward a solution to create a ubiquitous mechanism for people on the NHS Shielded Patients’ List, and others such as key-workers or the elderly, to be identified and prioritised when buying food and other goods or securing services online, while protecting their privacy, and sensitive personal data about medical conditions.  It is ready to go, as it is based on current technology already used to conduct age-checks for online purchases of alcohol, knives, etc.

Background

The Shielded Patients List (“SPL”, formerly known as the vulnerable patient list) means that the NHS can identify and contact a group of patients who need specific advice about their circumstances. 

The NHS has identified around 900,000 patients who should practise social shielding. They should all have received an official letter from the NHS.   Around 75% of these patients had a mobile phone number, and may have also been contacted by text message.

The NHS expected GPs and hospital doctors to add around 600,000 other patients to the list.  The current total number is approximately 1.28 million.

https://digital.nhs.uk/coronavirus/shielded-patient-list

Current tactical solution

Government asked a limited number of supermarkets to match their current online customer list with the SPL to prioritise those customers.

This is a complex technical task, and potentially a one-time exercise, so it may be hard to add new customers to the priority group either when they sign up to a supermarket or get added to the vulnerable list (a new list is issued weekly). 

It is also limited to only major supermarkets who are being entrusted with access to the list, so is not available to other retailers and suppliers of essential services such as plumbers or electricians.  This limits customer choice, particularly if shortages arise of certain goods, as well as competition.  If the current requirement for shielding remains in place for months rather than weeks, then these limitations will be increasingly apparent.

Adopting a solution open to any website which chooses to participate, and to do so with very little technical effort, will transform the effectiveness of Defra’s prioritisation scheme.

Age Verification Providers Association strategic solution

Age Verification (“AV”) providers would be given one-way access to the same list provided to supermarkets[1]. This would allow them to check if details supplied by a customer match a person on the list, but not to simply see the content of the list.

The customer details (name, address and mobile phone number) can be obtained in three ways

  1. From existing customer data records if they already have an online account with a participating website
  2. When a new customer enters their details to set up a new account with a participating website
  3. By going directly to an age verification provider’s website to enter their details

The first two options are unlikely to require any additional input from the customer beyond that which is already required to open or operate an account with a participating website.

The AV Provider will supply those details to the host of the SPL, and receive back a yes/no confirmation as to whether the customer is on the list, and the details match sufficiently to confirm their status.  If the response is no, the customer will have the chance to amend their details and re-apply – but it will always be necessary to prove that the delivery address is the same as the address on the SPL to prevent abuse.  How strictly details must match can be adjusted easily, pragmatically tightening the criteria over time to avoid excessive rejections at the outset.

Once this process has been completed once, it need not be repeated, as ALL participating websites will immediately recognise the customer, and be able to confirm they are still on the list, without any further intervention in the user experience.  Customers will, of course, have to consent to being recognised in this way, otherwise they can simply opt re-apply each time they go to a new participating website.

The SPL can be updated in real-time as GPs and others add people to or remove them from the list.  After a customer has been removed from the list, their records with the AV provider will be updated next time they seek to use any of the participating websites.

Other key workers could be identified using an identical process where suitable databases can be provided for the validation process e.g. the NHS email account records, union membership lists.  Again, these checks would be one-way, not giving AV providers access to view the list, only to check if someone who has supplied details to them has matching details on these databases.

General priority could also be offered to the elderly, or those in receipt of certain benefits or disabled parking permits, for example.

Data Protection

NHS Digital has agreed how the data will be handled in a letter to the Cabinet Office:

Terms of Release of Vulnerable Patient List Contact Details for COVID-19 Vulnerable Patients Online and Telephone Service

Government Digital Service (GDS), acting as part of the Cabinet Office, has been commissioned by the Prime Minister to develop an online and telephone service for extremely vulnerable patients. Information about the service is here: https://www.gov.uk/coronavirus-extremely-vulnerable. The service will provide those individuals with a way to seek help and support whilst they are self-isolating to protect themselves from the COVID-19 virus, including by providing a means to ask for social care support and essential food and supplies (the Service).

The Service will co-ordinate support for patients in the form of essential food and other supermarket supplies, where the patient has requested support for this, by organising, via the Department for the Environment, Food and Rural Affairs (DEFRA), for supermarkets to deliver essential food and other supermarket supplies to patients at their homes. DEFRA will also organise for supermarkets to prioritise these patients for their online delivery services.

Data to be shared for this purpose will include name, address and mobile phone number of the patient which has been obtained from those patients, solely for the purposes of arranging such supermarket shopping deliveries. The NHS number will not be used for this purpose and will not be shared with DEFRA or supermarkets or with any intervening organisation in the supply chain relating to this purpose.

Privacy and technology under the AVPA solution

The technology being re-purposed for this solution was originally designed to support the implementation of the Digital Economy Act 2017, requiring online proof of age for people accessing adult websites.  As such, it was built based on privacy-by-design, with any personal details required at the point of verification not being shared with age-restricted websites.  The sites would only be informed if an anonymous user was over 18 or not.

This solution was subject to a rigorous, independent, technical audit by the government appointed regulator, the British Board of Film Classification.  It was also designed to interface seamlessly with millions of websites around the world, so the integration effort is minimal, and for most websites can be achieved in a day.

Applying this architecture to shielded patients means that participating websites need not be entrusted with access to the SPL itself, so prioritisation can be offered by thousands of websites, not just a handful.  It also means each website does not need to invest in the technical effort of matching customers to the list themselves.

Conclusion

Because this solution is built on existing, tested technology which has been ready to go-live at a moment’s notice for over a year now, it could be implemented in 2-3 weeks and provides a ubiquitous, secure, privacy-by-design strategic solution to replace the current tactical response.

We hope the Committee might consider this as a recommendation to improve the effectiveness of the current system for prioritising food distribution to the most vulnerable in society.

With kind regards,

Iain M. Corby

Iain Corby

Executive Director


[1] Potentially hosted Pay360, a subsidiary of Capita which already has the list as it sent the notification letters for the NHS).