Dr Subhajit Basu quoted in 'Digital Privacy News' discussing the health data to be collected during current COVID-19 pandemic
Subhajit Basu, Associate Professor of Information Technology Law, expresses concerns about the length of time health data collected from the NHS "Test and Trace" app is planned to be stored.
“The explanation is given by Public Health England that it is required to store the data to prevent future pandemic raises uncomfortable questions around “legitimacy and trust” and also raises questions around “what is strictly necessary” says Dr Basu.
Dr Basu proceeds to explain “Too much information about an individual’s health issues creates a sense of vulnerability. It is excessive and unjustified. In my view, the longer time data that is stored, higher is the risk of re-identification and there will always remain a security threat”.
“It is unfair to characterise a choice as deliberate (the argument that “the system is voluntary, so people will only use it if the amount of data being collected feels acceptable”) when the alternative is not viable. While people will be able to request that their information be deleted, Public Health England has argued that “this is not an absolute right” and that it might “need to continue to use your information” which means the individual loses real control over the data.” expresses Dr Basu.
He argues that “The explanation around “prevention of future pandemic” feels like an engineered argument rather than being genuine” and goes onto explain that “it is not only the breadth of information that is of concern but also those with access – which includes anyone with “specific and legitimate role”.
Dr Basu concludes “Public Health England did not complete data protection impact assessment prior to launching the COVID-19 “test and trace” programme on 28 May 2020. It is clear that the 20 years, Public Health England is recommending is arbitrary; it is very much opposite of empowering people during this unprecedented time of crisis”.
