Advertisement

NHS will keep personal data of people with coronavirus for 20 years

<span>Photograph: Department of Health & Social Care/PA</span>
Photograph: Department of Health & Social Care/PA

The NHS will keep personal data about people with coronavirus for 20 years as part of the test-and-trace programme, according to a privacy notice posted by Public Health England.

Information including full name and date of birth, as well as phone numbers and home and email addresses, will be collected and stored for people with coronavirus, or symptoms of Covid-19, alongside data about those symptoms.

Those who have been identified as contacts of people with coronavirus will have all but their date of birth collected and stored for five years.

Public Health England said: “The information needs to be kept for this long as may [sic] be needed to help control the spread of coronavirus, both currently and possibly in the future.

“It is held on PHE’s secure cloud environment, which is kept up to date to protect it from viruses and hacking. It can only be seen by those who have a specific and legitimate role in the response and who are working on the NHS Test and Trace. All these staff have been trained to protect people’s confidentiality.”

default

Individuals will be able to “ask” for their information to be deleted, but the body warns that “this is not an absolute right”.

David Grout of the information security company FireEye said: “The length of time the data is being stored for, and the lack of personal control on how the data is being used and kept are bound to cause privacy concerns.

“This might not be too much of a headache for the government while manual tracking is the norm, but it will become more of an issue when NHSX’s contact-tracing app is launched, as this will rely on the public opting in for the project to work.”

“Concerns surrounding the usage of the data in the app and how long the data is stored could well affect the number of downloads of a full national rollout.”

This month, the influential joint committee on human rights called on the government to guarantee the right to delete data gathered by the test-and-trace project. Harriet Harman, the chair of the parliamentary committee, said at the time: “Big powers demand big safeguards. The government should not resist their assurances being put into law. Parliament completed emergency legislation for new powers. It can do it now for new protections.”

Public Health England has been approached for comment.