The Government has admitted that England’s Covid-19 Test and Trace programme has broken a data protection law, according to a letter sent to privacy campaigners.
The Department of Health and Social Care acknowledged it had failed to carry out a risk assessment on how the system would affect privacy.
It follows the threat of legal action from the Open Rights Group, which claims that the programme to trace contacts of those infected with Covid-19 has been operating unlawfully since its launch on May 28.
A spokesman for the DHSC said there is “no evidence” of data being used in an unlawful way.
Carrying out a Data Protection Impact Assessment — which helps to identify and mitigate risks relating to use of personal data — is a requirement under General Data Protection Regulation laws.
In response to a pre-action letter from privacy campaigning organisation ORG, the Government confirmed that, while a DPIA is a legal requirement, it has not yet been completed.
The letter from DHSC, which is dated July 15, said the legal requirement is being “finalised”.
Calling the Government’s behaviour “reckless”, Jim Killock, executive director of ORG, said: “We have a ‘world-beating’ unlawful Test and Trace programme.
“A crucial element in the fight against the pandemic is mutual trust between the public and the Government, which is undermined by their operating the programme without basic privacy safeguards.”
A DHSC spokesman said: “There is no evidence of data being used unlawfully. NHS Test and Trace is committed to the highest ethical and data governance standards — collecting, using, and retaining data to fight the virus and save lives, while taking full account of all relevant legal obligations.”
