Emergency alert phone test on 23 April will not ‘breach GDPR’

23 March 2023
What was claimed

Mobile phone networks are in breach of GDPR by providing your phone number to another agency to allow emergency alerts.

Our verdict

False. When an alert is triggered, mobile phone masts broadcast it to every compatible phone and tablet within range. The government doesn’t use personal data, like your mobile phone number, to do this.

What was claimed

The emergency alert test on 23 April will involve replying to a text message and until you do the use of your phone will be limited.

Our verdict

The alert will be like a notification that you need to acknowledge before you can use other features. You do not need to “reply”. Notifications will reportedly still appear and phone calls will come through even if you haven’t acknowledged the alert.

What was claimed

The fact that you have to reply allows them to access elements of your phone.

Our verdict

You do need to acknowledge the notification but you do not need to reply. The government says the alert does not access or use personal data.

A video is being shared on Facebook that makes several false claims about the UK Emergency Alerts service and its upcoming test on 23 April.

The man in the video claims the alert is a “text message” you need to reply to, that “the use of your phone is going to be limited [that day]” if you do not reply. He implies that the alert will access data on your phone or install something, and that phone companies are breaching GDPR legislation by “giving your number to another agency outside of your permission”. 

This is not an accurate description of what the national test involves.

Honesty in public debate matters

You can help us take action – and get our regular free email

What is the emergency alert service?

Emergency Alerts is a new government service to warn people via their phones or tablets if there’s a nearby “danger to life”, for example in the case of severe flooding, fire or extreme weather. Only emergency services and government departments, agencies and public bodies dealing with emergencies will be able to send the alerts, with advice about how to stay safe during the emergency.

The system is due to be tested across the UK on Sunday 23 April. The alert will appear on devices that use 4G or 5G networks and will appear as a notification and loud siren-like sound for up to 10 seconds.

Misinformation about what data is being collected may lead to unnecessary alarm. In this case, it may cause people to opt out (as many online have claimed they have) and therefore risk not being warned about nearby dangers in future. 

Is the test in violation of GDPR?

GDPR stands for General Data Protection Regulation, and in the UK was implemented by the Data Protection Act 2018. According to GOV.UK, it means: “Everyone responsible for using personal data has to follow strict rules called ‘data protection principles’.” 

Generally speaking, the legislation dictates how personal data is used by organisations, businesses and the government.

However, the Emergency Alert system does not use personal data to send an emergency alert. The government says: “The system uses the cell tower your phone is connected to. When an alert is triggered, all towers in the area will broadcast the alert. 

“To do this the Government does not need to know the specific location or personal data on your device.”

The Emergency Alerts service’s privacy notice says: “Emergency alerts are broadcast from mobile phone masts to every compatible phone and tablet within range. The sender does not need to know your mobile phone number or any other personal data to send you an alert.

“No one will collect or share data about you, your phone or your location when you receive an emergency alert.”

So your phone network provider has not breached GDPR “by giving your number to another agency outside of your permission”, as the video claims, because the alerts are simply sent to phones that are connected to cell towers, not via a list of numbers that networks have given the government.

Do you need to ‘reply’ to the alert?

The man in the video also claims: “So you're going to receive a text message on your phone. If you don't reply to that text message, basically, the use of your phone is going to be limited so they're going to put your phone off for the day.”

You won’t need to reply to the emergency alert. According to the government: “It will appear on your device's home screen and you must acknowledge it before you can use other features. They appear as a notification and may include telephone numbers or website links containing further information.”

So you won’t need to “reply” as such, but you will need to acknowledge the alert by pressing ‘ok’ before you can use your phone again.

On whether use of your phone will be limited, the Cabinet Office confirmed to Full Fact that phone calls won’t go to voicemail if you haven’t acknowledged the alert. It won’t stop a phone call in progress, and notifications will still come through. In order to answer a call or view notifications, however, you will first have to acknowledge the alert.

Will the alert collect data?

The man in the video claims: “by the nature of the fact that you reply or you open something that then allows them to access elements to your phone.”

The Cabinet Office confirmed to Full Fact that the emergency alert in no way accesses or uses personal data and that no personal data is collected.

Image courtesy of Paul Hanaoka

Full Fact fights bad information

Bad information ruins lives. It promotes hate, damages people’s health, and hurts democracy. You deserve better.