We don't know whether the most recent response to this request contains information or not – if you are Jennifer Cobbe please sign in and let everyone know.

Data Protection Impact Assessment for the coronavirus contact tracing app

We're waiting for Jennifer Cobbe to read recent responses and update the status.

Jennifer Cobbe

Dear Department of Health and Social Care,

Michael Gove today announced (https://www.bbc.co.uk/news/health-52521526) that the Government would be trialling a new contact tracing app in the Isle of White ('the contact tracing app').

Article 35 of the General Data Protection Regulation ('GDPR'), incorporated into UK law by the section 3 of the European Union (Withdrawal Act) 2018, requires that a Data Protection Impact Assessment ('DPIA') is carried out in advance of any processing of personal data that is likely to result in a high risk to the rights and freedoms of natural persons. This includes the "processing on a large scale of special categories of data". Article 9 of GDPR defines special category data to include data concerning health (such as would be processed for contact tracing). According to recital 75 of GDPR, a DPIA is also required in a number of other circumstances relevant to the contact tracing app.

Article 36 of GDPR requires that data controllers consult with the supervisory authority (the Information Commissioner's Office ('ICO')) in advance of any processing where a DPIA indicates that it would result in a high risk in the absence of measures taken by the controller to mitigate the risk.

Information requested:

1. If a DPIA has been undertaken in advance of trialling the contact tracing app under Article 35 GDPR, please provide a copy of the DPIA.

2. If no DPIA has been undertaken, please provide any information relating to any discussion or determination of: (a) whether the processing of personal data for contact tracing is likely to result in a high risk to the rights and freedoms of natural persons, and (b) whether a DPIA was required.

3. If a consultation was undertaken under Article 36 GDPR, please provide any information submitted by the Department to the ICO in connection with that consultation. Please also provide any information - include any advice - provided by the ICO to the Department in connection with that consultation, the DPIA, or the contact tracing app.

4. Please also provide information on the legal basis (as set out in either Article 6 or Article 9 of GDPR) relied upon for the processing undertaken for the contact tracing app.

Yours faithfully,

Jennifer Cobbe

Department of Health and Social Care

This is an acknowledgement - please do not reply to this email.

Thank you for contacting the Department of Health and Social Care. 

We are currently experiencing high volumes of enquiries and we are
focusing our resources on the Coronavirus (COVID-19) response.

The answers to many questions, including the latest information on
COVID-19, can be found on [1]GOV.UK, the [2]Department of Health and
Social Care website or by visiting the [3]NHS website. We may not respond
to you if the answer to your enquiry can be found on either of these
websites. Where a reply is appropriate, we aim to send a response within
18 working days, or 20 working days if your query is a Freedom of
Information request or complaint.

If you are experiencing symptoms related to COVID-19, please
visit [4]111.nhs.uk or telephone your GP surgery immediately for further
advice. Do not go to a GP surgery, pharmacy or hospital directly.

If your organisation can offer support to help with the response to
coronavirus, including the supply of personal protective equipment, the
Government has set up an online
hubhttps://www.gov.uk/coronavirus-support-f... to compile and
respond to all offers. 

The Department of Health and Social Care does not process complaints about
the NHS or social services. If you wish to make a complaint about a
healthcare professional, an NHS organisation or a social care provider,
please visit the [5]Complaints Procedure page on GOV.UK.

You can find out more about the Department’s commitments from our Personal
Information
Charterhttps://www.gov.uk/government/organisati....

This e-mail and any attachments is intended only for the attention of the
addressee(s). Its unauthorised use, disclosure, storage or copying is not
permitted. If you are not the intended recipient, please destroy all
copies and inform the sender by return e-mail. Any views expressed in this
message are not necessarily those of the Department of Health and Social
Care. Please note: Incoming and outgoing email messages are routinely
monitored for compliance with our policy on the use of electronic
communications.

References

Visible links
1. https://www.gov.uk/
2. https://www.gov.uk/government/organisati...
3. https://www.nhs.uk/
4. https://111.nhs.uk/covid-19/
5. https://www.gov.uk/government/organisati...

Department of Health and Social Care

1 Attachment

Dear Ms Cobbe,

Please find attached the Department of Health and Social Care's response
to your recent FOI request (our ref: FOI-1222090) 

Yours sincerely,

 Le-anne Frankson 

Freedom of Information team
Department of Health and Social Care

show quoted sections

We don't know whether the most recent response to this request contains information or not – if you are Jennifer Cobbe please sign in and let everyone know.