I & fantastic @HumanRightsCtte counsel team drafted a bill

The Digital Contact Tracing (Data Protection) Bill

Does what it says on tin:
1 Enshrines in law privacy guarantees made by govt
2 Creates criminal offences for misuse of our data
3 Ensures transparency + regulation /1 https://twitter.com/HarrietHarman/status/1258477294152228864

The contact tracing app is a huge opportunity for reducing spread of COVID-19. Also a huge risk for privacy.

Govt using brand new tech and chosen to upload all data to central server

Privacy and effectiveness intrinsically linked as millions of people need to trust the app /2

Here are the key things the bill does.

1. Sets two clear purposes for use of our data (avoid mission creep)
2. Requires Secretary of State to specify exactly who will have access
3. Makes it criminal offence to process data for any other purposes AND by anyone not authorised /3

4. Makes it an offence to 're-identify' de-identified data.

This addresses the concern that even if parts of our data are anonymised a devious individual could combine with other data to identify us.

5. Establishes a new regulator - the Digital Contact Tracing Human Rights Commissioner.

- Has same powers of inspection and entry as Information Commissioner
- Will run a complaints system for people who feel their data has been misused

6. The Secretary of State must arrange for security reviews of the digital contact tracing system every 21 days

7. Contact tracing data may not be collected from a mobile device unless each person who owns or operates the device has given consent - simple but important to make clear.

8. There are strict rules for deletion and anonymisation of data.

Basically the data has to be anonymised (i.e. impossible to be identified with individual) or deleted as soon as possible and deleted as soon as there is no longer a Covid-19 related purpose for retaining it

9. Review - The Secretary of State must review the need for using digital contact tracing every 21 days including potentially discriminatory impacts. Those reviews must be published and presented to Parliament

10. Finally, transparency is essential to retaining trust.

So Secretary of State has to published data protection impact assessments (key requirement of data protection law), design and security information and minutes of meetings of its ethics advisory boar.d

The government through @MattHancock has just rejected @HumanRightsCtte’s call for a new law to enshrine privacy protections for digital contact tracing. Says (1) we already have protections and (2) don’t worry you can trust us https://committees.parliament.uk/publications/1223/documents/10345/default/

Here is a simple explanation of the advantages of a bill https://twitter.com/humanrightsctte/status/1263425409145765889