Docs seen by @mattburgess1 @WIRED indicate the Science Board of NHSX explicitly stated that self reporting in the app was a "high risk", could cause public panic, lack of confidence. Yet the DPIA risk register states it would only have a 'medium' impact wired.co.uk/article/nhs-co… 🧵 
The mitigation in the risk log simply says risk is "Adderssed [sic] in terms of use". No more. I am doubtful that anomaly detection could make false reports go away, but either way, it doesn't impact the fact the impact, not the likelihood, remains high. faq.covid19.nhs.uk/20200505a%20DP…
Why does this matter? Because by engineering this to a 'medium' risk, NHSX *avoids* having to consult the regulator (ICO) before acting under Article 36, GDPR — marking their homework extra safe. legislation.gov.uk/eur/2016/679/a…
More on the risk register:
