Privacy Expert On Open Rights Group Reporting ‘Test & Trace’ To ICO

Following the news around The Open Rights group reporting the NHS Test and Trace app to the ICO for the lack of safeguards around the data it collects,  CTO at UK-based data privacy firm offers the following comment.

Subscribe
Notify of
guest

1 Expert Comment
Most Voted
Newest Oldest
Inline Feedbacks
View all comments
Darren Wray
Darren Wray , CTO & Co-founder
InfoSec Expert
June 4, 2020 2:55 pm

I appreciate that the information being collected and processed is being used to help prevent/reduce the instances of COVID-19, but do you really need to keep the person\’s full name, date of birth, home postcode and house number, telephone number and email address for 20 years to do that? I would certainly argue that after 5 years that the data should be de-personalised such as the name removed along with the house number, telephone number and email address.

Obviously the GDPR says that data should only be kept as long as is required for the purpose, but it is unclear whether the NHS will truly audit their data in this way having set an expectation for keeping it for 20 years.

Many organisations, including governments agencies, have a hoarder mentality, keeping as much personal data as possible and keeping it far beyond its useful life. In an ideal world, the data collected and processed should automatically anonymise after a certain period of time.

The question still remains whether the NHS is going to have a separate privacy notice for the information collected by the NHS when the project finally goes into widespread use. The concern being that this automated data collection will be far more invasive, detailing not only the personal information listed in the current policy, but also details of everyone you met with, the location that you met them, how long you were with them, etc

Last edited 2 years ago by Darren Wray
Information Security Buzz
1
0
Would love your thoughts, please comment.x
()
x