Privacy campaigners say England’s test and trace programme has broken a key data protection law.

The Department of Health has conceded that the initiative to trace contacts of people infected with Covid-19 was launched without carrying out an assessment of its impact on privacy.

The Open Rights Group (ORG) says the admission means the initiative has been unlawful since it began on 28 May.

It involves people being asked to share sensitive personal information.

This can include:

The Department of Health and Social Care says there was no evidence of data being used in an unlawful way.

ORG had threatened to go to court to force the government to conduct a data protection impact assessment (DPIA) – a requirement under the General Data Protection Regulation (GDPR) for projects that process personal data.

A letter from the Department of Health to the group confirmed that a DPIA was a legal requirement and had not been obtained.

ORG’s executive director, Jim Killock, said the government had been “reckless” in ignoring this legally-required safety step and had endangered public health.

“A crucial element in the fight against the pandemic is mutual trust between the public and the government, which is undermined by their operating the programme without basic privacy safeguards,” he added.

Scotland, Wales and Northern Ireland all carry out parallel contact-tracing schemes of their own but have not been accused of the same failing.

The government has told the ORG it is working with the Information Commissioner’s Office to make sure that data is processed in accordance with the requirements of the law.

The ICO confirmed this and told the BBC it was providing guidance as “a critical friend”.

But the regulator added that, while it recognised the urgency in rolling out the programme, if the public were to have confidence in handing over their data and that of their friends, “people need to understand how their data will be safeguarded and how it will be used”.

The watchdog is already investigating the Test and Trace programme after the Sunday Times reported last week that some contact tracers had posted private patient data to WhatsApp and Facebook groups.

A Department of Health spokeswoman said: “NHS Test and Trace is committed to the highest ethical and data governance standards – collecting, using, and retaining data to fight the virus and save lives, while taking full account of all relevant legal obligations.”

The ORG’s complaint stems from work carried out on its behalf by Ravi Naik, a lawyer at the AWO data rights consultancy.

He said the legal requirements for data processing were more than just a tick-box exercise.

“They ensure that risks are mitigated before processing occurs, to preserve the integrity of the system,” he explained.

“Instead, we have a rushed-out system, seemingly compromised by unsafe processing practices.”

Mr Naik added the ORG had already won a concession from the government. It had originally planned to keep data for 20 years but has now cut that to eight years.

Since the Test and Trace programme was launched its 27,000 staff have contacted more than 155,000 people, who may have been infected with the virus, and asked them to go into isolation.

Leave a Reply

Your email address will not be published. Required fields are marked *

You May Also Like

Widower of late Joe Scarborough staffer seeks removal of Trump tweets that promote baseless conspiracy theory

The widower of a former congressional staff member for Joe Scarborough has asked Twitter chief executive officer Jack Dorsey to delete tweets by President Trump furthering a baseless conspiracy theory about his wife’s death. “My request is simple: Please delete…

Governments shouldn’t ‘scare’ Canadians, Liberal MP says as Ottawa threatens penalties for CERB fraud

The Liberal government is proposing legislation that would impose tighter rules for claiming the Canada emergency response benefit (CERB) and is threatening to impose fines and jail time on those who deliberately lie on applications. The move prompted Toronto Liberal MP…

Lineup for July Democratic presidential debates in Detroit revealed

CNN has announced who will be participating in which night of the Democratic presidential debate the network is hosting in Detroit on July 30 and 31. The lineup was announced during a drawing of names Thursday night.  The announcement comes…

DHS seizes 10 million counterfeit 3M N95 masks, some possibly headed to hospitals

The Department of Homeland Security has announced it seized 10 million counterfeit 3M N95 masks, including some possibly headed for hospitals for use by frontline health care workers. New DHS Secretary Ali Mayorkas announced the bust, done in coordination with…