Disclosure comes after ministers rejected plea to pass an emergency law to ease privacy concerns
- Rob MerrickDeputy Political Editor
Data provided by people through the new test-and-trace programme to defeat coronavirus will be kept for 20 years, it has been revealed.
The disclosure – coming after ministers rejected a plea from MPs and peers to pass an emergency law to set out clear rules – will heighten privacy fears, on the day the scheme finally got underway.
Information including name, address, date of birth, phone numbers and email addresses, will be collected and stored by the NHS for people with Covid-19, or with symptoms.
Individuals will be able to “ask” for their information to be deleted, but Public Health England has warned “this is not an absolute right” and that it might “need to continue to use your information”.
A new privacy notice states that a private firm, Amazon Web Services, “is providing the secure storage location for the information collected by NHS test-and-trace”.
And it adds: “This information needs to be kept for this long because Covid-19 is a new disease and it may be necessary to know who has been infected, or been in close contact with someone with symptoms, to help control any future outbreaks or to provide any new treatments.”
Data from people with symptoms will be retained “for 20 years”, while information from those without symptoms will be kept “for 5 years”.
The notice reassures people that the data will be “held on PHE’s secure cloud environment, which is kept up-to-date to protect it from viruses and hacking”.
“It can only be seen by those who have a specific and legitimate role in the response and who are working on the NHS test-and-trace. All these staff have been trained to protect people’s confidentiality.”
