Comment from Guardum: NHS ’Test And Trace’ data being kept for 20 years
May 2020 by Darren Wray, CTO Guardum
Following the release of the Public Health England privacy notice stating that PII collected by the new NHS Test and Trace initiative will be kept for 20 years, Darren Wray, CTO at data privacy firm Guardum offers the following comment:
“20 years to keep Personal Information would seem excessive and unnecessary. I appreciate that the information being collected and processed is being used to help prevent/reduce the instances of COVID-19, but do you really need to keep the person’s full name, date of birth, home postcode and house number, telephone number and email address for 20 years to do that? I would certainly argue that after 5 years (for example) that the data should be de-personalised such as the name removed along with the house number, telephone number and email address. I would also reduce the date of birth to year of birth.
Obviously the GDPR says that data should only be kept as long as is required for the purpose, but it is unclear whether Public Health England will truly audit their data in this way having set an expectation for keeping it for 20 years. Many organisations, including governments agencies, have a hoarder mentality, keeping as much personal data as possible and keeping it far beyond its useful life, which is evidenced by this privacy notice. In an ideal world, the data collected and processed should automatically anonymise after a certain period of time.
I wonder if PHE is going to have a separate privacy notice for the information collected by the NHS app if/when that finally goes into widespread use. The concern being that this automated data collection will be far more invasive, detailing not only the personal information listed in the current policy, but also details of everyone you met with, the location that you met them, how long you were with them, etc.
I can see the prospect of lots of people making Data Subject Access Requests against PHE in the future as they start to release just how much of their personal data was harvested in the name of COVID-19.”