News: 1595248388

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

UK.gov admits it has not performed legally required data protection checks for COVID-19 tracing system

(2020/07/20)


The UK government has admitted it deployed the COVID-19 Test and Trace programme without a Data Protection Impact Assessment (DPIA) required by law, according to privacy campaigners the Open Rights Group (ORG).

The ORG said the Department of Health and Social Care (DHSC) had confirmed in writing that the impact assessment had not been carried out following [1]its legal complaint to data protection watchdog the Information Commissioner's Office (ICO) .

The failure to meet the legal requirement means the government's "entire test and trace programme has been operating unlawfully since its launch on 28th May 2020," the ORG said.

On 1 June, Public Health England, which runs the programme, issued a statement saying it was "currently working to complete the DPAI for NHS Test and Trace and has committed to provide this document to the ICO next week".

Legal complaint lodged with UK data watchdog over claims coronavirus Test and Trace programme flouts GDPR [2]READ MORE

It was unable to explain to The Register why, after more than a month, the impact assessment had not been completed, and instead deferred to the Department for Health and Social Care.

A DHSC spokesperson said: "There is no evidence of data being used unlawfully. NHS Test and Trace is committed to the highest ethical and data governance standards – collecting, using, and retaining data to fight the virus and save lives, while taking full account of all relevant legal obligations.

"We have rapidly created a large scale test and trace system in response to this unprecedented pandemic. The programme is able to offer a test to anyone who needs one and trace the contacts of those who test positive, to stop the spread of the virus."

Guidance and advice

An ICO spokesperson said: "It is an organisation's responsibility to complete a data protection impact assessment as a way of identifying and addressing key privacy questions. There is not always a requirement for that DPIA to be shared with us.

"In this case, we have been working with government as a critical friend to provide guidance and advice for some elements of the scheme and to seek assurances that people's personal data is protected.

"We recognise the urgency in rolling out the test and trace service during a health emergency, but for the public to have trust and confidence to hand over their data and that of their friends and families, there is also work needed to ensure the risks to that personal data are properly and transparently mitigated. People need to understand how their data will be safeguarded and how it will be used."

Education secretary Gavin Williamson [3]told BBC Breakfast : "In no way has [there] been a breach of any of the data that has been stored.

"I think your viewers will understand that if we are to defeat this virus, we do need to have a test and trace system and we had to get that up and running at incredible speed... Are you really advocating that we get rid of a test and trace system? I don't think you are."

But Neil Brown, director of tech law firm decoded.legal, told The Reg the idea that the government complies with the law or acts at speed in creating the system was a false dichotomy.

"I don't see why they couldn't have assessed the impact of what they're proposing on the fundamental rights of people here, while they were going through the process," he said. "It's something that other organisations do all the time."

He added that any organisation assessing the data protection risks and working to mitigate them as they design and roll out the system would not find the process too onerous. "If what you've done is designed your entire system and you're ready to go, and suddenly think, 'I haven't done my data protection impact assessment', and then you're trying to write it in a way that shows but the solution you found is completely compliant with the law: that could take longer," Brown said.

He also commented that the ICO appeared to be working with the government rather than regulating. "Nowhere in the Data Protection Act can I find where it says that one of tasks of the ICO is to be a 'critical friend': it's a regulator." ®

Get our [4]Tech Resources



[1] https://www.theregister.com/2020/06/04/test_and_trace_ico_gdpr_complaint/

[2] https://www.theregister.com/2020/06/04/test_and_trace_ico_gdpr_complaint/

[3] https://www.bbc.co.uk/news/technology-53466471

[4] https://whitepapers.theregister.com/

There we go again

John Jennings

'Critical Friend'....

The term also used at the select committee hearing in May about the looney toons version of the app and its developer division

Thats not the role of the ICO. Lady Denham is confusing what the ICO is meant to do in a power grab.

The DOH could have slapped an initial DPIA together. The initial screening parts only takes an afternoon FFS. I believe that they dont want to do it, because they know that they will be repurposing the data for later analytics other than the purpose for which its collected - ie test and trace. If they (DOH) dont define a limit, they could easily sell it or use it for other purposes. They dont have to consider what they propose how people could exercise their rights, and dont need to describe any limitations on access.

Re: There we go again

Doctor Syntax

The ICO is in a difficult position here. It can exact a monetary penalty but how do you do that when the offender is a public body?

For a private offender a fine results in a loss of profits. A public body only has money in the form of a budget given to it to do its job. What would be the consequences for the ICO being seen to be taking away from PHE the budget given to them to deal with a national public health crisis?

About the only option it has would be to use its powers against an officer of the body responsible. Perhaps it ought to do that. AFAIK it's not been done against an individual in the private sector so it would be by way of being a test case and probably lead to the ICO still being pilloried for distracting management attention at such a critical time etc etc.

Re: There we go again

jason_derp

"What would be the consequences for the ICO being seen to be taking away from PHE the budget given to them to deal with a national public health crisis?"

I would hope that it would be seen taking away money away from the PHE budget. Doing a job isn't always going to be easy, but if you only do the job when it is easy, it might be a sign that the job was never all that necessary to begin with. If they can't enforce rules then the message is that there's no need for enforcers or rules. The alternative is that the rules are necessary, and so somebody who will actually do their job needs to step in.

Re: There we go again

Doctor Syntax

"I would hope that it would be seen taking away money away from the PHE budget."

It would be seen as that. And political suicide for the ICO.

Perhaps a compromise would be for the ICO to appoint a consultant of their own choice to do the impact statement for them and fine them the cost of that. It wouldn't be effectively taking away the budget if it was used to do what should have been done out of the budget in the first place.

In an ideal world failure to fulfil such an obligation by a public servant would be dealt with as a disciplinary matter. It doesn't seem likely that somebody low down would have been told to produce an impact statement and failed to do so; more likely that somebody higher up failed - inadvertently or otherwise - to instruct anybody to do so. It's a very long time since anyone in that position was disciplined.

On the whole, however, I'd prefer them to take a punish the official approach. It would send a message to both public and private sectors, especially to the latter that if you fold the company we'll just come after you.

"No evidence of data being used unlawfully"

Pascal Monett

Because if we do it like Trump says and we don't look for evidence, then we can't find any, now can we ?

Re: "No evidence of data being used unlawfully"

eldakka

Absence of evidence is not evidence of absence.

Just because they haven't found evidence, even if they are actively looking for it , doesn't mean it hasn't happened. It just means they don't know it has happened.

Re: "No evidence of data being used unlawfully"

Warm Braw

There is no DPIA. The government are collecting the data anyway. That's ample evidence of unlawful use.

I'm not sure that "but no-one else is behaving unlawfully like we are" is relevant to the matter at hand.

Re: "No evidence of data being used unlawfully"

bombastic bob

I thought there was GDPR, except it's gummint collecting the data.

"One law for ME, another law for THEE"

and a quote (as I remember it) from George Orwell's "Animal Farm"

"All animals are created equal, but some are more equal than others"

But of course

Pen-y-gors

If we had a competent UK government, who had done all in their power, successfully, to keep the death toll down to a few thousand, then people would say, well, OK it's an emergency, we won't worry too much about GDPR if it saves lives.

But of course, we haven't. Their 'app' wasted millions, weeks and cost lives. And still they breach GDPR.

The sooner Johnson and the rest of the Tories start their whole-life sentences breaking rocks on Dartmoor the better. No need to waste time on a trial...

Re: But of course

codejunky

@Pen-y-gors

"The sooner Johnson and the rest of the Tories start their whole-life sentences breaking rocks on Dartmoor the better. No need to waste time on a trial..."

I do wonder how much of this is the tories. Public health england has so far been found so badly wanting I would be interested to know if any heads will roll there. What is the point of these organisations if they cant do their job when they are needed?

As you say this wouldnt be such an issue with a competent government but the government is more than just the party in charge. How they react to the failure of PHE is how I will judge them.

Re: But of course

Jason Bloomberg

I do wonder how much of this is the tories. Public health england has so far been found so badly wanting I would be interested to know if any heads will roll there.

The staff on the front line at PHE were doing an absolutely wonderful job when it came to tracking and tracing. It's the paid-for government shills at the top who are giving it a bad name. Of course their heads won't roll.

If the government let competent people do the jobs they are good at we wouldn't see such incompetence. But that doesn't suit an incompetent government preparing scapegoats for their incompetence and failings.

Re: But of course

Jemma

Who the bloody hell do you think it was who've been doing their best to screw the NHS since it was dragged into the world like the forceps delivery of the spawn of Katie Price and a stoned Dingo?

The People's Front of Judea perhaps? Or maybe the Campaign for Free Galilee?

Oh silly me it was the fucking Conservatives - Stalinism with a Human Face - England for the Inbred - aka The Lavrenti Beria Appreciation Society.

The ones who clapped the nurses while taking their salaries down into the basement, throwing a grenade in there and quickly shutting the plate armor door..

Or maybe the ones who've lied through their teeth worse than the Chinese government and make the Stainless Steel Twat look like frigging Einstein.

The whole lot of parliament should be taken to the tower and publicly executed for treason and you're wondering whose fault it was that the Dieppe Raid would be considered a roaring success compared to the UK CV19 response (ditto Gallipoli, Arnhem and the Defence of Singapore).

I knew Brexit was a fucking stupid idea but Christ Almighty if after 6 bloody MONTHS of this you can't figure out who to blame - then God help us - it's like everyone under the age of 30 has suddenly contracted retrospective Zika Microcephaly and been reduced to dribbling retards.. Flat Cap Disease has evolved* into Flat Skull Disease.

Or maybe its a new CV19 symptom - a sudden IQ drop of about 70 points and an unshakeable belief in the "Kinnwenigerprincip".

*Except North of the Ipswich Line.

Re: But of course

Anonymous Coward

Ooooh look, Rebecca Long-Bailey has an El Reg account!

Re: But of course

Anonymous Coward

>>>Public health england has so far been found so badly wanting

It's ALWAYS someone else's fault with this crowd, isn't it.

Re: But of course

Kabukiwookie

Who do you think was reaponsible for defunding the NHS to breaking point?

It's the same in The Netherlands; there's a public health system that works fine, then the neo-liberals come in and defund the public service until it almost breaks. They then point out that the public system is not working and that healthcare privatisation is the way forward.

Re: But of course

Steve Davies 3

When did any of the major political parties suggest abolishing the right to a trail by jury? What you are suggesting is just that.

We aren't the USSR, GDR or China you know.

What possibly 'trumped' (sic) up charges would you give them 'whole life' sentences for?

Re: But of course

anothercynic

Unfortunately that *has* been a suggestion of action by the Tories to 'speed things up' and reduce backlog (1) (even pre-COVID). Legal eagles have naturally pushed back knowing that there are *so* many things that can (and do) go wrong in non-jury trials. You may want to read the book(s) by the Secret Barrister. You'll be surprised how badly broken the law is in this country and how much it favours those who can afford expensive legal representation and don't need recourse to Legal Aid.

(1) [1]Legislation to abolish some jury trials could be passed within weeks

[1] https://www.lawgazette.co.uk/news/legislation-to-abolish-some-jury-trials-could-be-passed-within-weeks/5104739.article

Re: what charges...

Jemma

The 65000 extra deaths this year might be a good bloody start don't you think?

Or the criminal and systematic neglect of the NHS the Tory party have been guilty of?

Or the £60000 a loved one payoff for NHS families that might just buy you a nice 4x4 to make up for your wife's/daughters/parents etc death in service? Because "PPE, what's that?" And just you try claiming for an unborn child who died as a result - life will begin "at birth" so fast the afterbirth will leave skid marks. Funny how that changed isn't it...

An unfunny joke for you...

"What's the difference between Jimmy Saville and Boris Johnson (and Co)?

Boris fucked more kids". Both through destroyed families and Interleukin Kawasakis.

I'm glad for you all, you voted and you got exactly what you deserved - and you still can't see what's happened and understand what's happening now - first we had the Wehraboo - now we've got the Borisboo - he's not really a sociopathic incompetent cockwomble, he's just misunderstood. Maybe we should get David Irving to write his biography... He's used to people who "follow the science" after all..

Re: what charges...

Anonymous Coward

The 65000 extra deaths this year might be a good bloody start don't you think?

We won't have any true picture of the excess death rate until the figures for the whole year are available, since we don't know how many of those were related to the restrictions of lockdown, and/or were deaths that would have happened anyway over the next 6 months.

What we do know is that the figure isn't 65,000. It's 46,000 of which about 11,000 were not caused by COVID-19.

What's the difference between Jimmy Saville and Boris Johnson (and Co)?

Boris fucked more kids". Both through destroyed families and Interleukin Kawasakis

That is tasteless, and nonsense. You really need to stop reading the far left propaganda and get out into the real world.

I'm glad for you all, you voted and you got exactly what you deserved

And I, for one, am so glad that we didn't have to go through this under Corbyn's labour party. he might seem like a nice, paternal, grandfather figure but his inability to take any decisions would have left us with more dead, and a real economic catastrophe to follow.

Re: what charges...

Adrian 4

Dear Coward,

The very last thing this government can be held up as a shining example of is decision-making.

About the only valid thing Corbyn can be accused of is not pandering to the media.

Re: what charges...

DavCrav

"Because "PPE, what's that?""

If you have read the news today you would find out that the NHS missed out on deliveries of masks because the French company that was contracted to supply them were visited by the Chinese government, who convinced them to renege on the contract and supply them instead.

Re: what charges...

Anonymous Coward

>>NHS missed out on deliveries of masks because the French company that was contracted to supply them were visited by the Chinese government, who convinced them to renege on the contract and supply them instead.

Interesting. Link please! (Where is my popcorn ... ?)

Re: what charges...

Anonymous Coward

I read that story - it's hardly hard to find, and wasn't that hard to find when it was first published in March. It wouldn't really have taken a genius level intellect to have guessed that ordering PPE to deal with epidemics 'just in time' might not have been an ultra bright decision. Bit like saying 'This ship doesn't need lifeboats, but if we do hit an iceberg we can always get some delivered by Amazon tomorrow'

Re: what charges...

John Jennings

not only 'just in time' - more about globalization .

Re: But of course

Cynic_999

Google "Diplock trials"

Re: But of course

anothercynic

Ideally banishing them to Tristan da Cunha or Ascension Island would be better... St Helena now has an airport so it's easier to get off than the aforementioned (Ascension has an airfield but it's a joint RAF/USAF one and it's out of action until 2022).

Re: But of course

Jemma

Ideally I'd suggest tying all of them down over the muzzles of 6pdr field guns loaded with practice (or maybe grapeshot) rounds and doing an "Indian Mutiny" tribute would be the best idea.

Nice and cheap for the government, a fun day out for the family, and you could make a fortune selling footage of Priti Patel being blasted to a pair of smoking heels to Tory voters.. Oh sorry, I mean darknet sickos.. Oh, they're the same thing?

Everybody wins..

Re: But of course

Cynic_999

St. Helena does indeed now have an airport, although so far has had very few flights taking place due to a variety of problems. One being wind-shear that limited the type of aircraft that can use the airport, and another being money problems of the airport's operator. Its inhabitants are British citizens with British passports - but have no right to reside in Britain, a fact that is a very sore bone of contention for the islanders. With a population of less than 5000 people, it would not pose a significant issue even if the entire population were to suddenly decide to go to live in the UK - though that is of course highly unlikely. Due to the fact that there is very little work on the island, much of the population is already living on UK "dole" anyway. Either that or are employed in the Public Works Department doing unnecessary work for the sake of appearances (the white line down the hight street of Jamestown was repainted every 2 weeks while I was there - despite the fact that there were only about 10 cars on the island at the time.

I had the pleasure of visiting the island by yacht in the 1970's. In many ways it is like travelling back in time to 18th century England, and while English is the official language and is easily understandable, it is old-fashioned English. For example, I was looking out to sea using a pair of binoculars when a child approached me and very asked, "Might I p'raps take a look through your spyglass, sir?"

Re: But of course

Anonymous Coward

"If we had a competent UK government"

But that is clearly not what The People voted for, so no point dreaming. We voted for a bunch of incompetent one-trick pony amateurs (just look at that cabinet) who already spent the last 10 years in headless-chicken mode.

Just buckle up and grit your teeth for the next 10-15 years. Because this is all there is now. ENJOY.

Re: But of course

Anonymous Coward

The sooner Johnson and the rest of the Tories start their whole-life sentences breaking rocks on Dartmoor the better.

Do you seriously think it would have been any different under the Corbynistas?

This isn't a party-political issue, everybody (worldwide) was making it up as they went along, as the science tried to keep up with the developing situation. Other countries' apps were just as big a fiasco, none seems to have been of any major use, and you hardly see them mentioned now.

Re: But of course

Commswonk

Do you seriously think it would have been any different under the Corbynistas?

I came on to say the same thing but found that you had beaten me to it. However, the point is so relevant that I feel that repeating it here is worthwhile.

IMHO a Corbynist government would have been an even bigger disaster.

Re: But of course

Anonymous Coward

Roll out the Corbyn/Labour bogeyman to justify the last 10 years incompetence, the current fiascos and whatever other future catastrophucs President Dominic has planned. Brilliant.

"The Covid response was bad, but just imagine if Lord Buckethead had been in charge !!!!!!!!!!!!!!"

With that attitude we definitly deserve everything these ****s have got coming down the pipe for us. Everything.

Re: But of course

iron

> Do you seriously think it would have been any different under the Corbynistas?

Maybe not but COVID-19 has shown that here in Scotland, over the water in Northern Ireland and doon a bit in Wales we all have more competant governments than the UK. If only the UK could have as competant a PM as the First Ministers of the devolved Parliaments.

Re: But of course

Adrian 4

Given that Boris & Dom's (or Doris', given the liking for portmanteau couple names) idea seems to have been to do a Trump and deny there's any sort of problem (for fear of hurting the economy) until forced to do otherwise by events, then yes, I think someone without a banker's hand up their arse might well have done better.

They could, after all, have hardly done worse.

https://www.statista.com/statistics/1104709/coronavirus-deaths-worldwide-per-million-inhabitants/

Re: But of course

Anonymous Coward

Upvote for "Doris".

Re: But of course

Teiwaz

Maybe not but COVID-19 has shown that here in Scotland, over the water in Northern Ireland and doon a bit in Wales we all have more competant governments than the UK.

Very scary, having lived in N.I, I find the thought that the N.I. Assembly could be considered competent extremely hard to imagine. It wasn't that long ago they spent an awful long time not doing anything.

Re: But of course

Doctor Syntax

"the N.I. Assembly"

Or any of its predecessors.

Re: But of course

Cynic_999

Have the measures adopted in Wales or Scotland proven to be either necessary or more effective than those in England?

Re: But of course

Cynic_999

Whatever measure had been taken is unlikely to have saved many lives in the long run. The whole quarantine notion was stated from the outset to be a *delaying* measure, not a preventative measure.

The only situation in which it would save lives is if it prevented hospitals from being overwhelmed and unable to treat people who would otherwise have been saved. But AFAIAA the hospitals in the UK were not overwhelmed to any significant degree, so the measures we adopted in the UK have apparently worked.

And the more Draconian measures adopted by some countries (e.g. some Asian countries) have resulted in MORE deaths, as people die from poverty-related issues and the result of not being able to travel. Even in the UK there have been deaths as a direct result of the lockdown.

We either need to wait for an effective vaccine or will have to suffer until we get herd immunity naturally. Assuming that that is possible and Covid does not end up being a fact of life we have to live with the same as the common cold.

Re: But of course

Gordon 10

What utter crapulence.

You mendacious apologist.

Every day's delay is lives saved.

A week earlier lock down would have led to approx 50% reductions in the current death rate due to the way an exponential progression works. (google it)

The viral density goes down, those who catch it get it milder and later.

The PPE gets spread about more evenly and with less peak demand - less NHS staff die.

Less CV-19 riven patients get discharged to nursing homes to infect their new friends.

etc etc.

Doctor Syntax

"In no way has [there] been a breach of any of the data that has been stored."

At least, none that we know about.

Doctor Syntax

But - but - but .... We used all the bast practices we'd adopted at Talk-Talk.

I'm just so surprised

Will Godfrey

That was a lie - I'm practicing being in denial, as I think we're all going to need it.

No evidence of data breaches

Jemma

...

"But we'll let you know when we find out which park bench we left it on... (the trains weren't running don'tchaknow).

Thank you, no more questions"

...

AKA

The Sir Humphrey Appleby School of Data Security.

I would consider accepting the "Doing it next week"... if....

John Robson

The T&T had been rolled out in the week following the Google/Apple API, and we were still in that week - and it had a kill switch (to reduce the risks associated with an adverse report)

But it's *so* late to the party that there is no excuse for not having done the assessment in full.

Anonymous Coward

So it appears that the Socialist approach is to make sure that all the paperwork and documentation is correct, actually saving lives is a secondary matter.

Anonymous Coward

Criticizing an organisation for failing to follow legislation on data protection isn't 'socialist'. And not following legislation on data protection isn't beneficial, or even 'harmless', if it reduces consumer confidence in a process which by it's very nature is dependent on the public's trust. And as has been pointed out complying with the legislation would probably have taken a few hours work by someone who, and I apologise at the implied slight,probably wasn't actually contributing cutting edge assembly code to a clever bluetooth stack - like maybe NHS England's DPO, or one of her team.

History Repeats Itself...

Commswonk

IIRC Matt Hancock came up with an App for something some time ago and was roundly ridiculed for his efforts because of some glaring security blunder. He, of all people, ought to have known better than to play fast and loose with personal data collected in the name of Covid - 19.

On a not entirely unrelated point it would be interesting to see the results of some decent research carried out by qualified psycologists into why those who rise to the top of the dungheap that is politics are such complete fuckwits. It seems to be an inescapable truth.

Re: History Repeats Itself...

Rich 11

I can't say that I've done any decent research, but my initial thought would be that a person who demonstrates that they are capable of backstabbing or brown-tonguing their way to the top of a greasy pole hasn't necessarily demonstrated an ability to lead or to manage any form of organisation, to assess any set of complex issues even with expert help, or to implement any form of solution which would meet broad public approval.

Re: History Repeats Itself...

Doctor Syntax

"He, of all people, ought to have known better"

Only if he had a capacity to learn from his mistakes - or recognise that he made any.

Astrology is the sheerest hokum. This pseudoscience has been around since
the day of the Chaldeans and Babylonians. It is as phony as numerology,
phrenology, palmistry, alchemy, the reading of tea leaves, and the practice
of divination by the entrails of a goat. No serious person will buy the
notion that our lives are influenced individually by the movement of
distant planets. This is the sawdust blarney of the carnival midway.
-- James J. Kilpatrick, Universal Press Syndicate