Experts working inside Cabinet Office to sift through data that can inform policy-making
GCHQ has embedded a team in a Downing Street cell to provide Boris Johnson with real-time intelligence to combat the “emerging and changing threat” posed by Covid-19, The Telegraph can disclose.
GCHQ analysts have been given access to mobile phone data to track the public’s movements during the national lockdown. The up-to-the-minute reports on compliance are passed to the Prime Minister.
The government skipped essential data privacy impact assessments in its rush to get the system up and running
The Department of Health has conceded the initiative to trace contacts of people infected with Covid-19 was launched without carrying out an assessment of its impact on privacy.
The Open Rights Group (ORG) says the admission means the initiative has been unlawful since it began on 28 May.
The Open Rights Group has reported the Test and Trace system to the Information Commissioner’s Office watchdog (ICO), sparking a fresh headache for ministers as they seek to prevent a second peak of Covid-19.
The group claims that the programme does not have strong enough safeguards for the sensitive health data that will be collected on potentially millions of people. It is also concerned about who will have access to the data, which is to be held for 20 years, and how it will be used in the decades ahead
The so-called “test and trace” rollout will see thousands of people handing over their personal data to U.K. authorities via contact tracers as part of efforts to inform others if they have been in contact with people infected with the virus. The personal information, including names, zip codes, phone numbers and email addresses, will be held by government bodies for up to 20 years.
But Public Health England, the agency overseeing the system in England, confirmed to POLITICO that it had yet to complete a so-called data protection impact assessment — a mandatory requirement under U.K. law — before the system started on Thursday.
Under U.K law, such an assessment, detailing the potential privacy concerns of collecting reams of people’s sensitive data, is obligatory and must be completed before data collection begins. It has to be submitted to the country’s privacy watchdog for review.