UK government admits Test and Trace programme ‘breaks data protection law’

Support us and go ad-free

The government has admitted that England’s coronavirus (Covid-19) Test and Trace programme has broken a data protection law, according to a letter sent to privacy campaigners.

The Department of Health and Social Care (DHSC) acknowledged it had failed to carry out a risk assessment on how the system would affect privacy.

It follows the threat of legal action from the Open Rights Group (ORG), which claims that the programme to trace contacts of those infected with Covid-19 has been operating unlawfully since its launch on 28 May.

A spokesman for the DHSC said there is “no evidence” of data being used in an unlawful way.

Carrying out a Data Protection Impact Assessment (DPIA) – which helps to identify and mitigate risks relating to use of personal data – is a requirement under General Data Protection Regulation (GDPR) laws.

In response to a pre-action letter from privacy campaigning organisation ORG, the government confirmed that, while a DPIA is a legal requirement, it has not yet been completed.

The letter from DHSC, which is dated 15 July, said the legal requirement is being “finalised”.

Calling the government’s behaviour “reckless”, Jim Killock, executive director of ORG, said: “We have a ‘world beating’ unlawful Test and Trace programme.

“A crucial element in the fight against the pandemic is mutual trust between the public and the government, which is undermined by their operating the programme without basic privacy safeguards.”

Ravi Naik, legal director of the data rights agency AWO, instructed to act on behalf of ORG, said that failing to carry out the “appropriate assessment” meant all data collected is “tainted”.

“These legal requirements are more than just a tick-box compliance exercise,” he said.

“They ensure that risks are mitigated before processing occurs, to preserve the integrity of the system. Instead, we have a rushed-out system, seemingly compromised by unsafe processing practices.”

ORG is just one group to raise privacy concerns over the scheme, with a former cabinet minister also previously warning of “serious errors” in its implementation.

Labour’s Lord Hain said last month that the NHS had failed to carry out its legal data protection obligations prior to the launch and had entered into data-sharing relationships “on unnecessarily favourable terms to large companies”.

A DHSC spokesman said: “There is no evidence of data being used unlawfully.

“NHS Test and Trace is committed to the highest ethical and data governance standards – collecting, using, and retaining data to fight the virus and save lives, while taking full account of all relevant legal obligations.

“We have rapidly created a large-scale test and trace system in response to this unprecedented pandemic.

“The programme is able to offer a test to anyone who needs one and trace the contacts of those who test positive, to stop the spread of the virus.”

Support us and go ad-free

We need your help to keep speaking the truth

Every story that you have come to us with; each injustice you have asked us to investigate; every campaign we have fought; each of your unheard voices we amplified; we do this for you. We are making a difference on your behalf.

Our fight is your fight. You’ve supported our collective struggle every time you gave us a like; and every time you shared our work across social media. Now we need you to support us with a monthly donation.

We have published nearly 2,000 articles and over 50 films in 2021. And we want to do this and more in 2022 but we don’t have enough money to go on at this pace. So, if you value our work and want us to continue then please join us and be part of The Canary family.

In return, you get:

* Advert free reading experience
* Quarterly group video call with the Editor-in-Chief
* Behind the scenes monthly e-newsletter
* 20% discount in our shop

Almost all of our spending goes to the people who make The Canary’s content. So your contribution directly supports our writers and enables us to continue to do what we do: speaking truth, powered by you. We have weathered many attempts to shut us down and silence our vital opposition to an increasingly fascist government and right-wing mainstream media.

With your help we can continue:

* Holding political and state power to account
* Advocating for the people the system marginalises
* Being a media outlet that upholds the highest standards
* Campaigning on the issues others won’t
* Putting your lives central to everything we do

We are a drop of truth in an ocean of deceit. But we can’t do this without your support. So please, can you help us continue the fight?

The Canary Support us
  • Show Comments
    1. I don’t think this is about Contact and Trace over Covid. I think this more a kind of 1984 Snitch and Trace, to build up a national database of informants. Once you’ve snitched for any reason and were not enticed to do it, you’ll be much more easy to entice, even enforce, through persuasion, bribery or threat.

      The government won’t need legality when soon it’ll be the law of the jackboots – he who wears the jackboots decides what’s law.

    Leave a Reply

    Join the conversation

    Please read our comment moderation policy here.