Track and Trace Privacy Law

By Nitya Kapadia, Year 12 North London Collegiate

Covid-19 has affected 2020 in unprecedented ways. The rush for the vaccine, the need to social distance, rules for wearing masks; last year, these terms would have made no sense to the general population. This year, these are the topics that swarm our everyday lives. In the midst of this, in finding a way to battle the virus and its effects, the UK government adopted the Track and Trace programme, in order to minimise the spread of the virus. However, in a technologically advanced world, where data is the newest and most precious commodity, there is an argument that the Track and Trace system will be an infringement upon our privacy, begging the question, can Track and Trace co-exist with the laws that protect our privacy?

Privacy Law, by definition, refers to the laws that deal with the regulation, storing and use of personally identifiable information, such as an individuals healthcare information or financial information. In 2018, the EU established the General Data Protection Regulation, otherwise known as the GDPR. Every time you open a new website, it will ask for your confirmation for cookies or if they can store your data; this is a direct consequence of the GDPR. To implement this in the UK, the Data Protection Act was passed. This ensures that all information will be used fairly, lawfully and transparently.

The Track and Trace system, developed by the NHS, requires a person to input the locations they have visited, and people they have met. With this information, when someone has tested positive for the virus, it allows authorities to contact people who have been exposed to the virus, mitigating its effects.

One of the main purposes of the Data Protection Act is to protect sensitive information such as race, ethnic background, political opinions, biometrics and religion. The Track and Trace system does not infringe upon any of these. In fact, in the EU, geo-location data is not considered to be sensitive data. Whilst it may be deemed as intrusive, and so it requires an individual’s consent, in the context of a crisis, there are less obstacles to overcome.

Furthermore, there is the argument that all the information that is collected by the system is already shared in our increasingly connected world. Social Media accounts know our close friends and our relationships, online shopping history records our addresses

and services such as Uber remember our frequently visited locations.

However, there are legitimate concerns that it will infringe upon our privacy. A group consisting of more than 20 MPs from four different parties have expressed concerns over Track and Trace, and are urging Elizabeth Denham, the information minister, to change the programme after the government admitted to not conducting the legally required assessment of its privacy concerns. These worries have been substantiated by the fact that the programme has led to three data breaches, including email mishaps and unreacted personal information being shared.

Combatting Covid-19 relies on one crucial component; trust between the public and the government. A failure to keep this level of trust can have disastrous consequences upon how we carry on this battle against the virus. While the answer to the question of whether the Track and Trace system does infringe upon our rights or not is a 43