Personally identifiable information collected by NHS Test and Trace for people with Covid-19 symptoms will be kept by Public Health England for 20 years.
This is according to a privacy notice published by Public Health England, which launched its Test and Trace service today.
Go deeper with GlobalData
People who have Covid-19 symptoms can now request a test, and the Test and Trace service will text, email or call those who have tested positive for Covid-19 and ask for the details of those who they have been in contact with, who will be told to self-isolate.
Personally identifiable information includes full name, date of birth, sex, NHS Number, home postcode and house number, telephone number and email address and Covid-19 symptoms.
For individuals who have been in contact with people with Covid-19 but do not have symptoms, their data will be kept for five years.
Privacy concerns raised over Test and Trace data storage
According to Public Health England, this information is being kept in order to “help control any future outbreaks or to provide any new treatments” and that the organisations involved “are only permitted to use information collected by NHS Test and Trace to help with the COVID-19 contact tracing.”
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataPublic Health England also said that the computer systems the information is stored on have been tested “to make sure they are safe from viruses and hacking”.
However, concerns have been raised about how initiatives such as the Test and Trace service and the NHSX contact tracing app could impact individuals’ privacy.
Although individuals can request for information held on them to be deleted, Public Health England said that this is “not an absolute right” and Public Health England “may need to continue to use your information”.
Darren Wray, CTO at data privacy firm Guardum believes that the storage of data for 20 years is “excessive”.
“20 years to keep Personal Information would seem excessive and unnecessary. I appreciate that the information being collected and processed is being used to help prevent/reduce the instances of Covid-19, but do you really need to keep the person’s full name, date of birth, home postcode and house number, telephone number and email address for 20 years to do that? I would certainly argue that after 5 years (for example) that the data should be de-personalised such as the name removed along with the house number, telephone number and email address. I would also reduce the date of birth to year of birth,” he said.
“Obviously the GDPR says that data should only be kept as long as is required for the purpose, but it is unclear whether Public Health England will truly audit their data in this way having set an expectation for keeping it for 20 years.
Many organisations, including governments agencies, have a hoarder mentality, keeping as much personal data as possible and keeping it far beyond its useful life, which is evidenced by this privacy notice. In an ideal “world, the data collected and processed should automatically anonymise after a certain period of time.”
He said that the possibility of the NHSX contact tracing app following suit could be “invasive”.
“I wonder if PHE is going to have a separate privacy notice for the information collected by the NHS app if/when that finally goes into widespread use. The concern being that this automated data collection will be far more invasive, detailing not only the personal information listed in the current policy, but also details of everyone you met with, the location that you met them, how long you were with them, etc.,” sad Wray.
“I can see the prospect of lots of people making Data Subject Access Requests against PHE in the future as they start to release just how much of their personal data was harvested in the name of Covid-19.”
Read more: With the contact tracing app delayed, could mobility tracing come to the rescue?
