The coronavirus test and trace programme implemented in England broke a key data protection law, according to privacy campaigners.
The Government introduced the service in May in a bid to help return life to normal, "in a way that is safe and protects our NHS and social care".
The service aimed to allow the Government to trace the spread of the virus and isolate new infections with the hope it would provide early warning if the virus were beginning to increase again.
But the Department of Health and Social Care (DHSC) wrote to the Open Rights Group (ORG) to concede the scheme was launched without an assessment of its impact on privacy, the group told the BBC.
ORG said the concession meant the programme has been unlawful since it started on May 28, but DHSC says there is no evidence data has been used in an unlawful manner.
PA reports the ORG is just one group to raise privacy concerns over the scheme, with a former Cabinet minister also previously warning of "serious errors" in its implementation.
Labour's Lord Hain said last month the NHS had failed to carry out its legal data protection obligations prior to the launch and had entered into data sharing relationships "on unnecessarily favourable terms to large companies".
The track and trace app has been trialled on the Isle of Wight, but the Government has suggested it may not be ready to roll out across the UK until the winter.
There have been privacy concerns around the world over the use of tracing apps, with Norway last month halting its programme.
On Sunday, The Observer reported Health Secretary Matt Hancock is set to announce local authorities will be able to access the named data of coronavirus cases as long as they abide by strict rules on data protection.
