The Open Rights Group [ORG] has said that England’s test and trace programme is unlawful and has been since its initiation on May 28, after the Department of Health admitted that there had been no assessments on the impact that the scheme would have on people’s privacy.
The test and trace system requires individuals to share personal details such as their name, date of birth, postcode, names of people they live with, places they recently visited, and contact details of those they had recently been in close contact with.
The government has defended the system and said that there is no evidence that sensitive data is being used in an unlawful way.
Education secretary Gavin Williamson said: “In no way has [there] been a breach of any of the data that has been stored.”
Speaking to the BBC, Williamson said: “I think your viewers will understand that if we are to defeat this virus, we do need to have a test and trace system and we had to get that up and running at incredible speed…. Are you really advocating that we get rid of a test and trace system? I don’t think you are.”
The Department of Health confirmed in a letter to the ORG that a data protection impact assessment [DPIA], which is legally required under General Data Protection Regulation [GDPR] rules, had not been conducted.
The ORG has threatened to take the matter to the courts in order to force the government to carry out a DPIA into test and trace.
Its executive director, Jim Killock, said: “A crucial element in the fight against the pandemic is mutual trust between the public and the government, which is undermined by their operating of the [test and trace] programme without basic privacy safeguards.”
Scotland, Wales and Northern Ireland all have their own contact-tracing schemes in place but have not faced similar scrutiny.
The government has reassured ORG that it is working with the Information Commissioner’s Office [ICO] to ensure that data is processed lawfully. The ICO has verified this.
However, the data watchdog did add that individuals need to be given a better understanding of how their data will be safeguarded and used if the public is to feel comfortable with handing over personal information.
The ICO is already investigating the test and trace initiative following reports in the Sunday Times that some contact tracers had posted private patient data in social media groups.
A spokesperson for the Department of Health said: “NHS Test and Trace is committed to the highest ethical and data governance standards – collecting, using, and retaining data to fight the virus and save lives, while taking full account of all relevant legal obligations.”
The test and trace programme has seen over 155,000 people contacted since May 28 who may have contracted coronavirus, with all of them asked to go into self-isolation for 14 days.