Given the importance of terms of self-isolation for people with suspected COVID-19, measures like the track and trace system, either by app or a semi-manual process using people employed as contact tracers, play an important role. Here the objective is to track down people who will be told to self-isolate.
The focus is with either people you spend 15 minutes or more with at a distance of less than 2 metres or those you have direct contact with like household members at a distance of less than 1 meter.
Through this process, those hired to act as tracers will text, email or call people who test positive with coronavirus and ask who they have had contact with. It is important that any contacts deemed at risk of infection should isolate for 14 days, even if they are not sick or showing any symptoms of COVID-19.
However, what are the data privacy issues? Taking the U.K. context as an example, Public Health England’s (PHE) privacy notice on data usage in the fight against COVID-19 mentions that personal identifiable information collected by the NHS Test and Trace team will be kept for 20 years.
According to David Grout, CTO for EMEA at FireEye, who contacted Digital Journal: “The National Health Service (NHS) Test and Trace initiative has now been officially launched and with it we got more details of how the system will work, for example what data will be collected and how it will be used. It will be able to keep tested persons’ information – full name, date of birth, home postcode and house number, telephone number and email address – for 20 years and keep contacts of people who contracted the symptoms for 5 years.”
According to Grout: “The length of time the data is being stored for, and the lack of personal control on how the data is being used and kept are bound to cause privacy concerns, and it is hard for the public to “opt out” of that, but it will become more of an issue when NHS’s contact tracing app is launched.”
Grout expresses further data privacy concerns, stating: “Concerns surrounding the usage of the data in the app and how long the data is stored could well affect the number of downloads of a full national roll-out.” He argues that trusting the NHS with this data is not the same as ensuring that users’ privacy is protected.
The analyst also adds: “Moreover, any reservations around how long data is stored are legitimate – the longer sensitive data is held for, the more risk there is for the data to be accessed and exploited. To date, the greatest issue around privacy of the UK app is the decision to store the data centrally.”
