Understanding Data Privacy and Track & Trace Apps in the Post-COVID Era

In this episode of *GDPR Now*, Karen Heaton, owner of Data Protection for Business, delves into data privacy concerns in the wake of COVID-19 with Phil Brown, a data privacy expert from Norfolk, UK. The discussion tackles timely issues, including data ownership, personal data rights, and the privacy implications of Track and Trace apps, which have become integral to managing the pandemic.

The Value of Personal Data: What’s at Stake?

Personal data is any information that can identify an individual, such as a name, email address, or vehicle registration number. While legislation like the General Data Protection Regulation (GDPR) establishes rules around data handling, Brown emphasizes that data doesn’t belong to individuals in a tangible sense. Personal data may feel like “ours,” but it’s often used by organizations—like government agencies and tech companies—for administrative purposes without explicit ownership rights on our part ([ICO on GDPR].

Data Controllers and Your Rights

Data controllers, organizations that determine the purpose and means of processing personal data, must have lawful grounds to collect and use data. GDPR enforces transparency and accountability, allowing individuals to request access, correction, or even deletion of their data under certain circumstances. Despite these rights, fulfilling requests isn’t always obligatory, but GDPR has raised awareness, empowering individuals to understand and act on their data rights.

Track & Trace Apps: Transparency and Trust

Track and Trace apps have become pivotal in managing COVID-19, but their implementation has stirred privacy concerns globally. In countries like Australia, transparency measures included releasing privacy impact assessments alongside the app’s launch, allowing the public to review data protection measures and understand how their information would be handled. Similarly, the UK’s Track and Trace app release involved publishing the app’s code on GitHub for tech experts to evaluate.

Transparency is essential, not just in the app’s purpose but in how collected data will be stored, anonymized, or deleted after its use. These apps rely on a voluntary participation model in countries like the UK and Australia, which contrasts sharply with the mandatory approach taken by South Korea, where mobile data was used extensively to monitor compliance with quarantine measures.

Challenges to Trust: Scams and Privacy Risks

Brown notes a concerning rise in scams related to Track and Trace. Fraudulent calls and texts exploit public fear, tricking individuals into providing personal information or clicking on malicious links. This exploitation not only threatens individuals but also undermines trust in legitimate Track and Trace systems, reducing their effectiveness. Individuals can protect themselves by ensuring that communications come from official government channels and avoiding unsolicited links or sharing sensitive information.

Moving Forward: Balancing Safety and Privacy

The COVID-19 crisis has forced nations to adopt unprecedented measures to protect public health, but it has also raised vital questions about privacy and personal data security. Public trust hinges on transparency, accountability, and a clear balance between safeguarding public health and respecting individual privacy. As the UK continues its Track and Trace efforts, observing and adapting to these challenges is crucial to building a system that upholds both safety and data rights.

For a deeper look into these issues, listen to *GDPR Now*’s podcast episode with Phil Brown for more insights on data protection practices and how governments can balance public health and personal privacy in a digital age.