Personal information collected by NHS Test and Trace to be kept for 20 years

[Domh245]

Regarding the point at hand, has any justification been given for the storage of data for 20 years or has it just been plucked out as an arbitary figure? Either way, it is rather concerning

I pulled the relevant section out of their data privacy statement earlier up thread:

The personally identifiable information collected by NHS Test and Trace for people with COVID-19 symptoms is kept by Public Health England for 20 years.

The personally identifiable information collected on the contacts of people with COVID-19 but who do not have any symptoms is kept by Public Health England for 5 years.

This information needs to be kept for this long because COVID-19 is a new disease and it may be necessary to know who has been infected, or been in close contact with someone with symptoms, to help control any future outbreaks or to provide any new treatments.

Whether that is justification enough, you'll have to decide!

 

[43066]

And no absolute right for people to delete their personal data after the pandemic has passed.

We can rest assured that "It is held on PHE’s secure cloud environment, which is kept up-to-date to protect it from viruses and hacking."

All in the privacy notice on the NHS/GOV/Contact Tracing Website.


I'm not comfortable surrendering my data to a cobbled-together cloud system, with minimally trained operators recruited in a rush. Others may have a different opinion.

Absolutely ridiculous!

This is one“app” I will not be downloading in a million years.

 

[HSTEd]

You really think a Government given permission to create a Panopticon is ever going to give it up?

If this system becomes established the Government will never permit it to be abandoned.

 

[SamYeager]

The following sections of how the information is used and how it relates to the law may be of interest:

How the information is used

Working with Public Health England to provide NHS Test and Trace is the Department of Health and Social Care, which is responsible for coordinating the national response to the coronarvirus pandemic.


The number of contact tracers needed for COVID-19 is unprecedented so the Department of Health and Social Care has instructed the following organisations to help:

1. The NHS Business Services Authority, an arm’s-length body of the Department of Health and Social Care, which is managing the contracts with NHS Professionals, Serco UK and SITEL Group
2. NHS Professionals, a limited company owned by the Department of Health and Social Care, which is recruiting and managing registered medical professionals to trace and provide public health advice to the contacts of people with COVID-19
3. Serco UK, a private company, which is providing additional staff to call the contacts of people with COVID-19 and provide advice on self-isolation
4. SITEL Group, a private company, which is also providing additional staff to call the contacts of people with COVID-19 and provide advice on self-isolation
5. Amazon Web Services, a private company, which is providing the secure storage location for the information collected by NHS Test and Trace

These organisations are only permitted to use information collected by NHS Test and Trace to help with the COVID-19 contact tracing. They are data processors acting on the instructions of the Department of Health and Social Care and cannot use the contract tracing information for any other purpose.

NHS Test and Trace and the law

The law on protecting personally identifiable information, known as the General Data Protection Regulation (GDPR), allows Public Health England to use the personal information collected by NHS Test and Trace.


The section of the GDPR that applies is:

1. Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’

As information about health is a special category of personal information, a further section of the GDPR applies:

1. Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare’

Public Health England also has special permission from the Secretary of State for Health and Social Care to use personally identifiable information without people’s consent where this is in the public interest. This is known as ‘Section 251’ approval and includes the use of the information collected by NHS Test and Trace to help protect the public from coronavirus. The part of the law that applies here is Section 251 of the National Health Service Act 2006 and the associated Health Service (Control of Patient Information) Regulations 2002.

 

[IanXC]

Yeah, I was already thinking that I would be giving the app a miss due to the seeming dogs breakfast of an implementation but I think this is the final nail in the coffin in terms of whether I'll be downloading it!

Quite. I came to the conclusion a while back that if it were the Apple-Google standard app then I would take part, but any deviation from that would make it a no from me.

Test and Trace is more problematic individually though, as whilst you are in control of giving other peoples data to this data collection project, you have no control over others giving your data to it.

 

[Skymonster]

Test and Trace is more problematic individually though, as whilst you are in control of giving other peoples data to this data collection project, you have no control over others giving your data to it.

Indeed...

Public Health England also has special permission from the Secretary of State for Health and Social Care to use personally identifiable information without people’s consent where this is in the public interest.

This bit is extremely concerning. Basically, if someone tests positive for COVID-19 and they say they have been in close contact with YOU (maybe supplying your name, address, telephone number, email address etc), then YOUR data will be held on the system without your permission - and if for any reason attempts to contact you fail, your data will be held on the system without even your awareness.

 

[Roast Veg]

I'm definitely not registering with this then. The prospect of my data being stored without consent for 5 years is bad enough - do we know if others can register us as having had symptoms?

 

[PauloDavesi]

People who test positive will be asked to supply details of their contacts, who will then be contacted by the PHE test and trace team, and be given advice, which is all avail;able on the Gov.uk website on the actions they should take to help prevent the spread of the virus.

there is no compulsion, at this stage, to co-operate, but following the advice given, is in the best interests of protecting the population.

 

[Roast Veg]

You may consider my priorities misaligned, but I very seriously value my privacy above my compulsion to act in the best interest of the population.

 

[SteveM70]

This is the thin end of the wedge. If c19 persists, the next step will be to respond to someone developing symptoms and informing them they went to Tesco at 3pm on Sunday by getting the card details of anyone who made a transaction in that shop around that time

 

[PauloDavesi]

I believe that the tracing process in South Korea, as well as using bluetooth location data, does make use of CCTV footage and card transactions.

On a more serious point, your personal data is more at risk when calling an offshore customer service department.

 

[MikeWM]

This is the thin end of the wedge. If c19 persists, the next step will be to respond to someone developing symptoms and informing them they went to Tesco at 3pm on Sunday by getting the card details of anyone who made a transaction in that shop around that time

One - of many reasons - to resist the 'cashless society' agenda.

 

[DelW]

BBC news is reporting that Norway has had to suspend its centralised-server app, and delete all the data that has been collected, at the behest of the country's data-protection authority:

Coronavirus: Contact-tracing apps face further hitches

Norway has to halt use of its app and researchers report a major flaw in Australia's tool.

www.bbc.co.uk

Norway's health authority has had to delete all data gathered via its Covid-19 contact-tracing app and suspend further use of the tool.

The Norwegian Data Protection Authority ruled the Smittestopp app represented a disproportionate intrusion into users' privacy.

I suspect this might be one more nail in the coffin of the NHS's data-hoovering attempt.

 

[Skymonster]

BBC news is reporting that Norway has had to suspend its centralised-server app, and delete all the data that has been collected, at the behest of the country's data-protection authority:

Coronavirus: Contact-tracing apps face further hitches

Norway has to halt use of its app and researchers report a major flaw in Australia's tool.

www.bbc.co.uk

I suspect this might be one more nail in the coffin of the NHS's data-hoovering attempt.

That’s great for Norway and I sincerely hope the same process happens in the UK too. I am concerned however that the UK Information Commission / Commissioner might not have sufficient powers to force the Government’s hand, especially as I do not trust the Government to the extent I fear it might try to use emergency health legislation to ignore any such move here.

 

[Skymonster]

What a shambles...

UK virus-tracing app switches to Apple-Google model

Government now intends to launch an app in the autumn but it may still lack contact-tracing tech.

www.bbc.co.uk

In a major U-turn, the UK is abandoning the underpinnings of its existing coronavirus-tracing app and switching to a model based on technology provided by Apple and Google.

The Apple-Google design has been promoted as being more privacy-centric.

However, it means epidemiologists will have access to less data.

 

[Bantamzen]

What a shambles...

UK virus-tracing app switches to Apple-Google model

Government now intends to launch an app in the autumn but it may still lack contact-tracing tech.

www.bbc.co.uk

I called this weeks ago, it was so obvious from the dithering following the beta on the Isle of Wight that the app would end up being rebuilt around the Google/Apple API.

 

[ainsworth74]

Well there's now a chance I might actually install the app if/when it appears seeing as they're no longer basically trying to hack my phones OS to make it work in the way they want just so they can hoover up all the data they like and then keep it for decades. But I'm going to wait and see what it actually looks like if/when it appears.

 

[Domh245]

A welcome development - now to see if by switching to the google/apple API there's half a chance of it being deployed fully sooner! (the previous app would not be ready until the winter according to a health minister yesterday)

Britain’s delayed contact-tracing app will not be ready until winter and “isn’t the priority at the moment”, a government health minister has said.

Lord Bethell, the Junior Health Minister, told MPs of the Science and Technology Select Committee the contact-tracing app was not the focus of Test and Trace’s efforts.

When asked for an exact date, he added he was “managing expectations” by saying winter, although said the government had not scrapped the app and still planned to launch it.

He told MPs: “We are seeking to get something going for the winter, but it isn’t the priority at the moment.”

 

[Bantamzen]

A welcome development - now to see if by switching to the google/apple API there's half a chance of it being deployed fully sooner! (the previous app would not be ready until the winter according to a health minister yesterday)

That statement by Lord Bethell is laughable in the extreme. Luckily it seems that a former Apple Executive is going to be grabbing this by the short or curlies now. "Not ready until winter", "Not a priority", what an utter joke!

 

[Domh245]

That statement by Lord Bethell is laughable in the extreme. Luckily it seems that a former Apple Executive is going to be grabbing this by the short or curlies now. "Not ready until winter", "Not a priority", what an utter joke!

Agreed. As @Bletchleyite has said in other threads, the key part of track and trace is the people you don't realise you've passed it on to which is where the app comes into it's own. The 'human contact' variant that is apparently preferred is absolutely useless for effective tracing!

 

[Bletchleyite]

Agreed. As @Bletchleyite has said in other threads, the key part of track and trace is the people you don't realise you've passed it on to which is where the app comes into it's own. The 'human contact' variant that is apparently preferred is absolutely useless for effective tracing!

Exactly. The version we are doing is basically just prompting to do what you'd do anyway, i.e. tell people you know that you've got it! If I tested positive, I'd probably put it in a FB status to warn people I know (I have no in-person work contact at all at the moment, it's all online, but if I did I'd also tell my boss), which would probably do a more effective job than any of this sham contact tracing.

The manual version has to be properly invasive to have any purpose (e.g. person reports going to Tesco on Sunday at about 3pm, so you watch the CCTV and see who he came close to and who purchased the items he touched, and track them to the till to get card details to contact them).