Government admits Test and Trace unlawful
The UK Government has been forced to admit they deployed the COVID-19 Test and Trace programme unlawfully without a Data Protection Impact Assessment (DPIA), following a legal challenge from privacy campaigning organisation, Open Rights Group (ORG).
The Department of Health and Social Care (DHSC) made its admission after ORG threatened to take the Government to court unless it agreed to immediately conduct a DPIA.
The admission that the Test and Trace was deployed without a DPIA and that there is still no DPIA in place now, means that the Government’s entire Test & Trace programme has been operating unlawfully since its launch on 28th May 2020.
Jim Killock, Executive Director of Open Rights Group said:
“The reckless behavior of this Government in ignoring a vital and legally required safety step known as the Data Protection Impact Assessment (DPIA) has endangered public health. We have a ‘world beating’ unlawful Test and Trace programme.
“A crucial element in the fight against the pandemic is mutual trust between the public and the Government, which is undermined by their operating the programme without basic privacy safeguards. The Government bears responsibility for the public health consequences.
“The Test and Trace Programme is central to easing the lockdown and getting the economy growing again. The ICO should have taken action but did not. We were forced to threaten Judicial Review to ensure that people’s privacy is protected.
“The ICO and Parliament must ensure that Test and Trace is operating safely and lawfully. As we have already seen individual contractors sharing patient data on social media platforms, emergency remedial steps will need to be taken.”
Ravi Naik, Legal Director of the new data rights agency AWO, who was instructed to act on behalf of ORG said:
“The Government has made two significant concessions to our clients. Firstly, when asked to justify retaining COVID-19 data for 20 years they couldn’t do so, and agreed to reduce the period to 8 years.
“Secondly, they have now admitted Test and Trace was deployed unlawfully. This is significant. It is a legal requirement to conduct an impact assessment before data processing takes place. No impact assessment has been conducted for Test and Trace. By failing to conduct the appropriate assessment, all the data that has been collected – and continues to be collected – is tainted.
“These legal requirements are more than just a tick-box compliance exercise. They ensure that risks are mitigated before processing occurs, to preserve the integrity of the system. Instead, we have a rushed-out system, seemingly compromised by unsafe processing practices.
The repercussions of the concessions could be widespread.”
Notes to the editor
1. Pre-action letter sent by AWO on behalf of Open Rights Group to Matthew Hancok, Secretary of State for Health and Social Care.
2. Government’s response to the letter admitting Test and Trace operating unlawfully.
3 Coronavirus contact tracers sharing patients’ data on WhatsApp and Facebook, The Times 12 July 2020 https://www.thetimes.co.uk/edition/news/coronavirus-contact-tracers-sharing-patients-data-on-whatsapp-and-facebook-rg3zqn5l6
4 During correspondence with ORG, the Government also conceded that its 20 year retention period for Track and Trace data needed to be reduced to 8 years.