It seems that the government's plan to use the NHS Test and Trace program along with the upcoming NHS Contact Tracing app to harvest and store your data long after it's 'needed' isn't sitting well with anyone, because it's shady af. And now the lawyers are wading in.
The Test and Trace program is now live in the UK, despite being an absolute shambles behind the scenes a little over a week ago. The accompanying contact tracing app isn't live yet, and has a massive amount of its own problems, but one of the areas they both completely fail at upholding is data privacy. Both collect identifiable data, which Public Health England plans to keep hold of for 20 years in the instance of Test and Trace. That's your full name, date of birth, sex, NHS number, address, phone number, email address, and everything about your symptoms, being kept on file for at least two decades, for no good reason. Meaning there are only bad ones. And let's not forget the information they want you to hand over on all of your close contacts, so they can go and do the same to them.
Privacy campaigners Open Rights Group (ORG) aren't happy at all, saying that the NHSX's Data Protection Impact Assessment (DPIA) came too late (after the public trial in the Isle of Wight had already kicked off), and "significantly underestimated privacy risks." To that end, ORG is getting data rights lawyer Ravi Naik to draft up a letter to PHE citing what should have been fairly obvious concerns, that PHE has seemingly made a conscious choice to ignore. ORG executive director, Jim Killock, said:
"The government needs to better explain its reasoning; what they have done so far has been rushed. Our concern is people will feel reluctant to participate if they feel their personal data is leaving their control.”
One concern is that the personally identifiable data could be used by immigration officials, or for some other purpose - and nefarious or not, ultimately it's your data that's being kept whether you want it to or not, and that in itself should be a huge red flag. Here's just one example, framed in the context of the protests this weekend.
The transfer of the language of “contact tracing” from public health to policing in the context of the #GeorgeFloydProtests will only reinforce concerns about the repurposing of surveillance infrastructure. This could be incredibly damaging for the effectiveness of #TrackandTrace https://t.co/69yij0Ox3V
— Carly Kind (@carlykind_) May 31, 2020
It's also come to light that the Test and Trace program didn't complete the data protection impact assessment - legally required before it could go live. This has to be completed before data collection begins. Not to worry. They'll get around to it in their own sweet time, because that's how things work now. Officials can ignore laws we all have to abide by with no repercussions whatsoever *cough* Dominic Cummings *cough*. A PHE spokeswoman told POLITICO:
"Public Health England, supported by the NHS Business Services Authority, is preparing a data protection impact assessment for the NHS Test and Trace system, [and] expects to publish this shortly.”
This is the equivalent of driving around on the roads without a legally required license, and telling the police that you'll have one shortly, so they should pipe down and let you carry on about your day. Naik commented on the matter, saying:
"If they have deployed the system without considering those risks, that is a problem and may further undermine efforts to get people to take part in the system. Confidence and trust is key. Missteps like this will only lose public trust."
The fact that Matt Hancock had the gall to threaten to make Test and Trace mandatory (which is bad enough) in light of all of this, is absolutely outrageous. Harriet Harman, chair of the Joint Committee on Human Rights (JCHR) is also concerned about the lack of protection around data, and has called for a new bill, even though Matt Hancock insists that new legislation isn't required "because the Data Protection Act will do the job". Obviously not, if this is what it allows. Harman said:
"It seems to us absolutely evident that the bill is needed. And instead of looking ahead to that fact, they’re going to wait until it’s urgent. Public opinion is very volatile about this sort of thing. One minute everyone can be seeing the absolute good sense, and the next they can have a lot of worries about it.
"Our goal is to make the promises that [Hancock] has already made meaningful. Assurances in a letter don’t protect anyone. What protects people is legislation.
“I’d rather they just did the bill, because I don’t want to be turning around and saying ‘I told you so’ when there’s some sort of scare and confidence collapses and the important test-trace-isolate initiative hits a roadblock.”
Feature image credit: Unsplash