England’s test and trace system breaks GDPR data law, according to privacy group

pharmafile | July 20, 2020 | News story | Sales and Marketing Contact tracing, GDPR, coronavirus, covid19 

England’s test and trace programme broke General Data Protection Regulation (GDPR) data law according to the Open Rights Group (ORG).

This comes after the Department of Health conceded that the tracing of contacts of people infected with COVID-19 was launched without carrying an assessment on the impact to people’s privacy.

But the government has said there is no evidence of the data being used unlawfully, with Gavin Williamson, the Education Secretary, telling BBC Breakfast: “In no way has there been a breach of any of the data that has been stored. I think your viewers will understand that if we are to defeat this virus, we do need to have a test and trace system and we had to get that up and running at incredible speed.”

A Department of Health spokesperson also commented on the ORG’s recent statements, saying: “”NHS Test and Trace is committed to the highest ethical and data governance standards – collecting, using, and retaining data to fight the virus and save lives, while taking full account of all relevant legal obligations.”

The ORG has threatened to take the government to court to force them to conduct a data protection impact assessment, which is a requirement under the GDPR. Jim Killock, the ORG’s Executive Director, said: “A crucial element in the fight against the pandemic is mutual trust between the public and the government, which is undermined by their operating the programme without basic privacy safeguards.”

The government have responded to the group, and confirmed that a DPIA was a legal requirement that had not been obtained. They also told the ORG that it is working with the Information Commissioner’s Office (ICO) to make sure the data is processed in a way that complies with the law.

The ICO is already investigating the government’s test and trace system after it was revealed that some contact tracers had posted patient data on both WhatsApp and Facebook.

Conor Kavanagh

Related Content


Valneva COVID-19 vaccine deal pulled by UK government

Boris Johnson and the UK government have terminated its deal with specialist vaccine company Valneva …


Pharmafile.com’s weekly COVID-19 news round-up

The past week has continued to see positive COVID-19 news; CytoDyn’s treatment for patients with …

GSK building

GSK’s Phase II otilimab study on COVID-19 patients promising for over-70s

GlaxoSmithKline’s (GSK) Phase II OSCAR study of their otilimab antibody’s effect on COVID-19 patients has …

Latest content