The NHS Test and Trace programme has been accused of breaching data protection laws after the Government admitted it had failed to carry out a mandatory check.

The news has prompted warnings that the public has no guarantee that medical records and personal details will be kept secure.

Whitehall solicitors have conceded that the NHS has still not completed a Data Protection Impact Assessment (DPIA), which is required under General Data Protection Regulation (GDPR), outlining how it is collecting and protecting sensitive data as part of the scheme to trace people who have had contact with Covid-19 sufferers.

The admission came in letters responding to the threat of a legal challenge from privacy organisation the Open Rights Group (ORG). 

The NHS has said that it has carried out data protection assessments for various parts of the test and trace programme and is still developing an overall DPIA.

The test and trace system, which sees health workers and volunteers collect details such as names, addresses and contact information from members of the public, has already contacted around 100,000 people, NHS figures have revealed.

Ravi Naik, the legal director of AWO, an agency working to shape and enforce data rights which is acting on behalf of ORG, said the DPIA was needed to show the public how the Government was keeping sensitive data safe.

He added: “This is not a technical breach of the law – they have breached the law. The law requires an impact assessment before [data] processing is undertaken. They did not conduct the impact assessment, that seems pretty clear cut to me.”

In a letter responding to ORG’s legal threat, dated July 15, Government lawyers argued that the “extremely serious risk to life” posed by Covid-19 meant it had needed to take “unprecendented, vital steps at high speed” to protect the public.

The Prime Minister’s official spokesman said: “We have completed a variety of data protection impact assessments. However, as the programme has evolved at an exceptional pace we are doing further work to make sure that these comprehensively cover all aspects of the programme.”

Source Article