Personal data about people with coronavirus, collected by the NHS as part of the test-and-trace programme, will be kept for 20 years according to a privacy notice posted by Public Health England.
Information including full name and date of birth, as well as phone numbers and home and email addresses, will be collected and stored for people with coronavirus, or symptoms of Covid-19, alongside data about those symptoms.
Those who have been identified as contacts of people with coronavirus will have all but their date of birth collected and stored for five years.
In a statement, PHE said: “Covid-19 is a new disease and it is not yet clear what its longer term impacts on public health will be, either on people who have been diagnosed with the disease or their close contacts. It is important that Public Health England is able to retain information about these cases and their contacts to help control any future outbreaks or to provide any new treatments. This information will be held securely by Public Health England and only used for purposes that help protect the public’s health from Covid-19.”
The privacy notice says: “The information needs to be kept for this long as may [sic] be needed to help control the spread of coronavirus, both currently and possibly in the future.
“It is held on PHE’s secure cloud environment, which is kept up to date to protect it from viruses and hacking. It can only be seen by those who have a specific and legitimate role in the response and who are working on the NHS Test and Trace. All these staff have been trained to protect people’s confidentiality.”
Individuals will be able to ask for their information to be deleted, but the body warns that “this is not an absolute right”.
David Grout of the information security company FireEye said: “The length of time the data is being stored for, and the lack of personal control on how the data is being used and kept are bound to cause privacy concerns.
“This might not be too much of a headache for the government while manual tracking is the norm, but it will become more of an issue when NHSX’s contact-tracing app is launched, as this will rely on the public opting in for the project to work.
“Concerns surrounding the usage of the data in the app and how long the data is stored could well affect the number of downloads of a full national rollout.”
This month, the influential joint committee on human rights called on the government to guarantee the right to delete data gathered by the test-and-trace project. Harriet Harman, the chair of the parliamentary committee, said at the time: “Big powers demand big safeguards. The government should not resist their assurances being put into law. Parliament completed emergency legislation for new powers. It can do it now for new protections.”