Thread by @EinsteinsAttic

So, @DHSCgovuk, when will you publish the #DPIAs for the "parts of" the #TestandTrace programme that your lawyers say are "in place"? And also all the #contracts & #SchemesOfWork?

#Transparency matters.

news.sky.com/story/coronavi…

Noting they aren't linked from even the most obvious place, i.e. @PHE_uk's 'Privacy Information' page: contact-tracing.phe.gov.uk/help/privacy-n…

The letter from @dhsc's lawyers to @OpenRightGroup is worth a read:

https://twitter.com/OpenRightsGroup/status/1285151747653107713?s=19

They claim 'alternate remedy' would be appropriate - a joke, given @ICOnews' evident unwillingness to act. (JRing ICO could have merits though.) And that to JR DHSC would be "academic"...

...on the basis that @DHSCgovuk(?) is working to 'finalise' the DPIA for #TestandTrace.

Well it's certainly not "academic" until the DPIA, contracts, schedules of work, etc. are all published.

#Transparency must mean what it says!

Timeline from @A__W______O, with links to Pre-action letter, Government’s response & AWO legal opinion:

https://twitter.com/A__W______O/status/1285165252364185602?s=19

And hey presto! @PHE_uk publishes (20 July) *another* generic #COVID19 'privacy information' page, this time under a GOV.UK banner - but still without links to any of the DPIAs:

gov.uk/government/pub…

So how many 'privacy notices' is that now? Let's see...

There's @PHE_uk's #TestandTrace privacy information page, masquerading under an NHS banner, though PHE is an Executive Agency of @DHSCgovuk, i.e. Government:

contact-tracing.phe.gov.uk/help/privacy-n…

Noting PHE claims to be data controller under Article 6(1)(e) of GDPR.

(First published 9 June)

Then there's @DHSCgovuk's own "Testing for coronavirus" privacy page - on which it claims to be the overarching data controller (acknowledging @NHSEngland, @NHSDigital & @PHE_uk may be too):

gov.uk/government/pub…

Note bullshit about "anonymous" data...

(Last updated 8 July)

And @NHSEngland's minimalist #COVID19 privacy notice: england.nhs.uk/contact-us/pri… points to info on the #DataStore: england.nhs.uk/contact-us/pri… but doesn't mention #TestandTrace - except maybe Pillar 1 lab tests, in passing?

(No date, but the Data Store DPIA wasn't published until June)

Then there's @NHSDigital's "transparency notice", which is pretty generic:
digital.nhs.uk/coronavirus/co… with no explicit mention of #TestandTrace - though it was last edited on 21 April, before T&T launched, and it does link to far more actual legal documentation than the others...

Finally, GOV.UK guidance on how #TestandTrace works: gov.uk/guidance/nhs-t… was last updated on 17 July, but *still* refers to trialling of the NHS coronavirus app on the IoW.

It links to a bunch of other information - inc. @PHE_uk's T&T site, i.e. full circle!

How regular members of the public are supposed to make sense of all this, I don't know!

Maybe doing an overarching DPIA, publishing and communicating it properly might've been a useful discipline?

#JustSaying