UK’s Covid track-and-trace programme ‘breaks data protection law’

The UK government’s coronavirus track-and-trace scheme breaks data privacy law, according to campaigners.

The accusation comes after the Department of Health and Social Care (DHSC) conceded in a letter to the Open Rights Group (ORG) that the programme was launched without an assessment of its impact on privacy.

The activist organisation say the disclosure means the track-and-trace programme has been “unlawful” since coming into operation at the end of May.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

The admission from the DHSC followed threats from the group “to go to court to force the government to conduct a data protection impact assessment (DPIA) - a requirement under the General Data Protection Regulation (GDPR) for projects that process personal data”, the BBC reports.

But while admitting that no such assessment has been conducted, the “DHSC says there is no evidence data has been used in an unlawful manner”, adds the Daily Mail.

A spokesperson for the department said: “NHS Test and Trace is committed to the highest ethical and data governance standards - collecting, using, and retaining data to fight the virus and save lives, while taking full account of all relevant legal obligations.”

Despite such reassurances, “ORG is just one group to raise privacy concerns over the scheme, with a former cabinet minister also previously warning of ‘serious errors’ in its implementation”, says the newspaper.

Last month, Labour’s Lord Hain alleged that the NHS had failed to carry out legal data protection obligations prior to the launch and had entered into data sharing relationships “on unnecessarily favourable terms to large companies”, The Telegraph reports.

ORG executive director Jim Killock told BBC Radio 4 today that “the government is simply not going through the basic checks to make sure the system is safe to operate”.

“They failed to conduct a data protection impact assessment and that means they haven’t done the basic check to make sure data is handled safely.” Killock added.

Fears that track-and-trace technology could violate privacy laws have caused problems in a number of other countries. Norway deleted its app in June after the system was shown to have breached the Nordic nation’s data privacy laws.

UK Treasury figures show that Downing Street is spending £10bn on Britain’ track-and-trace rollout. An app has been trialled on the Isle of Wight, but the government has suggested it may not be ready to launch across the rest of the UK until winter.