Privacy activists prep legal challenge against UK plan to keep coronavirus contact-tracing data for two decades
- Reference: 1591024619
- News link: https://www.theregister.co.uk/2020/06/01/uk_store_covid_19_trace_data/
- Source link:
The Open Rights Group (ORG) asked data privacy lawyer Ravi Naik to draft a letter outlining its concerns following the policy of keeping the personal details of those who test positive for the novel coronavirus for up to 20 years.
Jim Killock, the ORG's executive director, [1]told The Guardian : "The government needs to better explain its reasoning; what they have done so far has been rushed. Our concern is people will feel reluctant to participate if they feel their personal data is leaving their control."
The [2]contact-tracing website for Public Health England says that personally identifiable information collected by NHS Test and Trace for people with COVID-19 symptoms will be held by Public Health England.
Contacts of those testing positive who do not show symptoms will have their data kept for five years.
Cori Crider, director of digital rights campaign group Foxglove, told The Reg :
"The question is whether the retention period is too long, and it just obviously is. It seems to me that if you step back and you look at the wider context here; we have had several times when something is done on the hoof that then gets revisited and changed. And I think the 20-year retention period will immediately be resisted as well."
Open letter from digital rights groups to UK health secretary questions big tech's role in NHS COVID-19 data store [3]READ MORE
Concerns have also been raised that the test and trace programme has not completed a data protection impact assessment.
Public Health England [4]told Politico it expected to publish to publish the impact assessment "shortly".
Crider said in response: "They should have done it in the first place."
She told The Reg the bigger picture was the lack of transparency over how the test-and-trace programme, the app which is still under development, and the government's proposed NHSX COVID-19 data store would be allowed to share information.
The government's COVID-19 data store project is working with Amazon, Google, Microsoft, Palantir Technologies UK, a subsidy of Peter Thiel's controversial analytics firm, and the London AI company Faculty.
It has prompted [5]an open letter from digital rights groups, which argue for greater transparency over who can access what data and for how long.
"The test-and-trace system, and the app: is all of that going to feed into the data store? Nobody has said. So, we don't know about the size and the scope of the data lake, and frankly, which corporate partners have got their mitts in it," Crider said.
Meanwhile, a separate group has created a model for accessing medical data without moving it from data owners, led by Ben Goldacre, science campaigner and director of the DataLab at Nuffield Department of Primary Care Health Sciences.
Crider said the project, dubbed [6]OpenSAFELY , raised questions about whether the government's data store was in fact a white elephant. "When Ben Goldacre and his team does something like this, you think, could this be done this without recourse to the private data store? I think that's a question that we at least need to ask."
OpenSAFELY project shows promise, but leader discourages comparisons with government COVID-19 data store
OpenSAFELY won praise after [7]creating a COVID-19 analytics platform that can draw from 17 million NHS records .
The model of the project avoids extracting sensitive patient records and instead runs analytics with the data in place within its original data store. Analysis is carried out by a select group of data scientists and the only data leaving the group is summaries of specific queries. All queries of the data are logged.
The approach has won praise from data rights groups. Sam Smith, coordinator at independent lobby group medConfidential, said: "The thing about OpenSAFELY is there is no data copy made – the queries are taken to the place where the data already is, and then the publishable statistics are produced there and exported.
"The NHSX data store requires at least one data copy of the data. It is the data copying that is risky, and creates another information governance point where those in control of the data can make new decisions."
But Goldacre played down comparisons with the NHSX data store project.
"The NHS data store and OpenSAFELY are built to manage completely different kinds of data, and user needs," he told The Register . "We developed OpenSAFELY as a way to handle the specific privacy risks – and computational challenges – when running research analyses across large volumes of extremely detailed primary care data covering a huge proportion of the population.
"I don't think the NHS data store contains anything like this scale of raw, event-level, primary care patient data; in fact, I don't think it contains any primary care data at all. I don't know everything that's in the NHS data store, but it's built to address a very different set of challenges and user needs to OpenSAFELY."
Goldacre praised the health service's digital arm and the data store team for their help in the OpenSAFELY project. ®
[1] https://www.theguardian.com/world/2020/may/31/privacy-campaigners-prepare-legal-challenge-to-uks-test-and-trace-scheme
[2] https://www.gov.uk/government/news/government-launches-nhs-test-and-trace-service
[3] https://www.theregister.com/2020/05/19/covid19_nhs_data_store_open_letter/
[4] https://www.politico.eu/article/uk-test-trace-privacy-data-impact-assessement/
[5] https://www.theregister.com/2020/05/19/covid19_nhs_data_store_open_letter/
[6] https://opensafely.org/
[7] https://spectrum.ieee.org/tech-talk/telecom/security/covid19-study-privacy-mining-millions-patient-records
Optimists
They think they'll actually have any data?
I'm not getting the app.
I'm assuming all texts and calls are frauds. (Statistically it's almost a slam dunk that people will get far more fake texts and calls than real ones).
And the people they really need, tend to be elderly, no mobiles and landlines that reject calls from unknown numbers.
Re: Optimists
"They think they'll actually have any data?"
If somebody who's tested positive names you as a contact then they'll have data on you. You didn't give it to them but they'll have it. A bit like Facebook and the rest rifling through subscribers' devices' contacts and grabbing data about 3rd parties.
It drives a coach and horses through data protection legislation. About the one hope is that the EU turns round and denies equivalence to GDPR unless it's changed. Just about every aspect of this has a red flag flying over it. It would help if someone in charge had a really solid reputation for safeguarding PII. What we have instead is Dido Harding.
Palantir??
Peter Thiel has a higher place on my [1]little list than any member of the UK government.
[1] https://en.wikisource.org/wiki/The_Mikado/Act_I/Part_Va
Dido Harding, ex bungle-in-chief of TalkTalk, runs the shop, doesn't she? There isn't a bargepole long enough.
Not suffering fools gladly
I am a septuagenarian. I have absolutely no intention of participating in contact tracing or antigen testing.
My understanding of infectious disease epidemiology far surpasses that of any member of government and that of most of the so-called experts it has called upon for (sometimes self-serving) advice. Whilst some of those consulted have sound credentials in 'science' (at least by present day standards) the impression is of them ploughing narrow furrows.
What sorely is lacking is advice, this either not sought or not heeded, on risk assessment, weighing one risk against another, and balancing consequences of not taking an action against anticipated deleterious results of that action.
What appears on offer is a patchwork of understanding but with nobody capable of sewing the patches into a tapestry and thereby grasping the big picture. The whole sorry process being overlain by tacky political considerations. It is no consolation to be aware that clowns drawn from any other party at Westminster would have been unlikely to fare better though perhaps their leader might have displayed less hubris than Johnson.
We now have a spooked population with many fearful to emerge from their homes. There are cretinous individuals, sadly including some police officers, who worry over outdoor separation, almost to the inch, whilst not understanding the extreme unlikelihood of contracting infection in that setting. Technological solutions to contact tracing and testing for infection are an utter waste of resources and give false reassurance to the nervous.
Meanwhile, the general public, now very confused, is distracted from deploying the one measure which above all slows spread of the virus: hand hygiene. Somehow all the 'experts' failed to consider the relatively low-cost expedient of issuing, free of charge, hand cleansing gel for people to carry on their persons; its mass manufacture is simple and quickly organised by refocusing breweries and distilleries.
-----
Released under the Creative Commons Attribution 4.0 international license.
Contributions to the author's wine and general comfort fund to the Bitcoin address below please.
1Kz9AteVKnt3xb4wfDtAZH2DhnU3dy1Wkt
Palantir involvement. What could possibly go wrong?
Way to go to persuade an already sceptical public.
PHE?
As PHE is the body supposed to plan for public health in England, up to and including pandemics, I wouldn't trust them to organise a pissup in a brewery.
Dont forget the military getting their hands o it as recently reported here.
What on earth is going on?
Democracy in action!
The 20 year retention period is so ostentatiously excessive that it might be deliberately provocative. For one thing it is a dead cat that most people are focusing on at the expense of all the other stuff in there - which will consequently get waved through without comment.
And perhaps the Government actually wanted five years. After that time the data is probably too stale to be useful for identifying the friends of people deemed troublemakers. It's still vastly excessive for the infection control purposes stated, so there would still be the firestorm of criticism if they demanded that up front. So they stick 20 years in and then will eventually begrudgingly compromise on ten years. The Government gets everything they want and more, and at the same time fool the plebs into feeling that the Government has listened to criticism, bowed to public opinion etc. It will look like democracy in action.
Optional?
It's increasingly clear that the the test-and-trace system will be mandated pretty soon.
There is no F in weigh
I've been locked down with two vulnerable octogenarian parents for five months now, would love a tech balm to this - just can't trust Westminster/Cheltenham an inch.
The very fact they are insisting on keeping the data for beyond the pandemic is just expletively untrustworthy and self-defeating.