England's Test and Trace programme 'breaks GDPR data law'
Privacy campaigners say that the Government has broken data protection laws in launching the Test and Trace programme in England.
Under the General Data Protection Regulation (GDPR), organisations have to carry out an assessment to identify and mitigate risks relating to use of personal data before collecting it.
The Department of Health and Social Care (DHSC) acknowledged it had failed to carry out a risk assessment on how the system would affect privacy.
It follows the threat of legal action from the Open Rights Group (ORG), which claims that the programme to trace contacts of those infected with Covid-19 has been operating unlawfully since its launch on May 28.
A spokesman for the DHSC said there is ‘no evidence’ of data being used in an unlawful way.
In response to a pre-action letter from privacy campaigning organisation ORG, the Government confirmed that, while a Data Protection Impact Assessment (DPIA) is a legal requirement, it has not yet been completed.
The letter from DHSC, which is dated July 15, said the legal requirement is being ‘finalised’.
Calling the Government’s behaviour ‘reckless’, Jim Killock, executive director of ORG, said: ‘We have a “world beating” unlawful Test and Trace programme.
‘A crucial element in the fight against the pandemic is mutual trust between the public and the Government, which is undermined by their operating the programme without basic privacy safeguards.’
Ravi Naik, legal director of the data rights agency AWO, instructed to act on behalf of ORG, said that failing to carry out the ‘appropriate assessment’ meant all data collected is ‘tainted’.
‘These legal requirements are more than just a tick-box compliance exercise,’ he said.
‘They ensure that risks are mitigated before processing occurs, to preserve the integrity of the system. Instead, we have a rushed-out system, seemingly compromised by unsafe processing practices.’
ORG is just one group to raise privacy concerns over the scheme, with a former Cabinet minister also previously warning of ‘serious errors’ in its implementation.
Labour’s Lord Hain said last month that the NHS had failed to carry out its legal data protection obligations prior to the launch and had entered into data-sharing relationships ‘on unnecessarily favourable terms to large companies’.
A DHSC spokesman said: ‘There is no evidence of data being used unlawfully.
‘NHS Test and Trace is committed to the highest ethical and data governance standards – collecting, using, and retaining data to fight the virus and save lives, while taking full account of all relevant legal obligations.
‘We have rapidly created a large-scale test and trace system in response to this unprecedented pandemic.
‘The programme is able to offer a test to anyone who needs one and trace the contacts of those who test positive, to stop the spread of the virus.’
The Department of Health and Social Care (DHSC) acknowledged it had failed to carry out a risk assessment on how the system would affect privacy.
It follows the threat of legal action from the Open Rights Group (ORG), which claims that the programme to trace contacts of those infected with Covid-19 has been operating unlawfully since its launch on May 28.
A spokesman for the DHSC said there is ‘no evidence’ of data being used in an unlawful way.
In response to a pre-action letter from privacy campaigning organisation ORG, the Government confirmed that, while a Data Protection Impact Assessment (DPIA) is a legal requirement, it has not yet been completed.
The letter from DHSC, which is dated July 15, said the legal requirement is being ‘finalised’.
Calling the Government’s behaviour ‘reckless’, Jim Killock, executive director of ORG, said: ‘We have a “world beating” unlawful Test and Trace programme.
‘A crucial element in the fight against the pandemic is mutual trust between the public and the Government, which is undermined by their operating the programme without basic privacy safeguards.’
Ravi Naik, legal director of the data rights agency AWO, instructed to act on behalf of ORG, said that failing to carry out the ‘appropriate assessment’ meant all data collected is ‘tainted’.
‘These legal requirements are more than just a tick-box compliance exercise,’ he said.
‘They ensure that risks are mitigated before processing occurs, to preserve the integrity of the system. Instead, we have a rushed-out system, seemingly compromised by unsafe processing practices.’
ORG is just one group to raise privacy concerns over the scheme, with a former Cabinet minister also previously warning of ‘serious errors’ in its implementation.
Labour’s Lord Hain said last month that the NHS had failed to carry out its legal data protection obligations prior to the launch and had entered into data-sharing relationships ‘on unnecessarily favourable terms to large companies’.
A DHSC spokesman said: ‘There is no evidence of data being used unlawfully.
‘NHS Test and Trace is committed to the highest ethical and data governance standards – collecting, using, and retaining data to fight the virus and save lives, while taking full account of all relevant legal obligations.
‘We have rapidly created a large-scale test and trace system in response to this unprecedented pandemic.
‘The programme is able to offer a test to anyone who needs one and trace the contacts of those who test positive, to stop the spread of the virus.’
AI Disclaimer: An advanced artificial intelligence (AI) system generated the content of this page on its own. This innovative technology conducts extensive research from a variety of reliable sources, performs rigorous fact-checking and verification, cleans up and balances biased or manipulated content, and presents a minimal factual summary that is just enough yet essential for you to function as an informed and educated citizen. Please keep in mind, however, that this system is an evolving technology, and as a result, the article may contain accidental inaccuracies or errors. We urge you to help us improve our site by reporting any inaccuracies you find using the "Contact Us" link at the bottom of this page. Your helpful feedback helps us improve our system and deliver more precise content. When you find an article of interest here, please look for the full and extensive coverage of this topic in traditional news sources, as they are written by professional journalists that we try to support, not replace. We appreciate your understanding and assistance.
