England 'Test and Trace' Program Violates GDPR Privacy Law
The UK government confirms the program launched in May without a Data Protection Impact Assessment, as required under GDPR.
The UK government has come under fire for launching a countrywide "test and trace" program without completing a Data Protection Impact Assessment (DPIA), a mandate required under the EU's General Data Protection Regulation (GDPR).
Test and Trace, also known as "Track and Trace," is a National Health Service initiative designed to track contacts of people who test positive for COVID-19. It requires people to share sensitive information, including names, birthdates, postal codes, people they live with, places they have recently traveled, and names and contact details of people with whom they've been in close contact.
Officials confirmed this program, which launched in May, has been running without a complete DPIA to assess how all of this personal data could be compromised. A privacy organization called the Open Rights Group (ORG) had written a letter to the Department of Health and Social Care, demanding publication of the DPIA for the Test and Trace program and threatening legal action.
The government has said none of the information has been breached to date; however, the implications of neglecting a DPIA for months have not been determined. Failure to assess the use of individuals' personal information could result in noncompliance under the GDPR. The UK's Information Commissioner's Office says the DPIA is a legal requirement for any type of data processing, including specific types of processing likely to be a high risk to peoples' rights.
Read more details here.
Register now for this year's fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.
About the Author
You May Also Like
Harnessing the Power of Automation to Boost Enterprise Cybersecurity
Oct 3, 2024DevSecOps/AWS
Oct 17, 2024Social Engineering: New Tricks, New Threats, New Defenses
Oct 23, 202410 Emerging Vulnerabilities Every Enterprise Should Know
Oct 30, 2024Simplify Data Security with Automation
Oct 31, 2024