Trust, trash and privacy notices.
Some time last week – and it may have been up for longer, but I haven’t checked – several people on Twitter started commenting on NHS England’s privacy notice for the Test and Trace programme. And oh sweet Jesus, it’s a fail.
What’s worse, in the current environment, that fail may have deadly consequences.
I don’t want to take too long over the details. Suffice it to say that a programme which fails properly to address questions of whom personal data might be shared with, refers to it as “personally identifiable information” which is a concept wholly absent from UK data protection and privacy law, says it will hang onto everything for 20 years, demands the provision of huge amounts of information about other people – OK, only for 5 years, but still – and entrusts it to several private enterprises with (at best) dubious records with other people’s data (including inadvertently leaking the email addresses of 300 of its trainee tracers), is a programme for which the phrase “privacy by design” really doesn’t seem appropriate.
Add in the stories which suggest that the training of those to be working on the Test and Trace programme is appalling in its inadequacy, and the government’s refusal to undertake a data protection impact assessment first, and this is carelessness, bordering on (gross) negligence.
I’m trying to be polite here. You may have noticed.
Because this is deadly serious. Literally so.
Lockdown lifts, partially, tomorrow. Looking at foot traffic on the street, and at pix of a crowded Clapham Common, and hearing from school-age kids of how their friends are already acting as if it’s all over by visiting each other’s houses just as they were in February, it’s over.
I can’t say how much of that is a reaction to the insouciant arrogance of the Cummings/BoJo double-act re Cummings’ wilful breach of regulations, and his wholly implausible explanation for it. (I describe it as such because, if the other side’s witness gave that kind of explanation in the box, I would happily shut up and let them keep talking, providing gold dust for my closing submissions.)
But this I’m sure of. The trust, which undoubtedly existed in late March and early April, is now gone, “trashed” as one behavioural expert put it – even among many of BoJo’s natural supporters. And without trust, Test and Trace won’t work. The privacy policy might have been acceptable if we trusted the powers that be not to be cavalier with things that matter to us.
But I don’t, not any more, not after they’ve shown us just how little respect they have for those they govern. And I’m certain I’m not alone. Matt Hancock’s “just trust me” approach wasn’t good enough for Harriet Harman, and it isn’t for the rest of us.
This, by the way, shows that Apple and Google were right to take the decentralised, privacy-first approach they did to building exposure notification into their mobile OSes. I don’t hold a brief for either. Both have immense faults (on privacy, Google in particular). But this was the wise approach. Give people control, and put trust in them, have faith in them, to listen to their better angels.
This is something our government never did. Lockdown was slow because we couldn’t be trusted to obey. Yet we did, overwhelmingly. Until the rules were muddied and it became clear they only applied to the little people.
So where does that leave us? An under-trained Test and Trace workforce, run by private contractors proven to be untrustworthy, collecting data precious to us with minimal genuine controls, ignoring if not deliberately sidelining local authorities who both know their areas and know how to do this, properly, personally and professionally, in favour of a classic mass-outsourcing impersonal “pile it high” approach. Contrary, it won’t surprise you, to contact tracing best practice which has actually worked elsewhere.
On the basis of this, people are to be asked to self-isolate for 14 days with no guarantee of ongoing job or wage protection, by people who clearly don’t think this applies to them. And with lockdown being lifted just now, when our infection and death rates remain far, far higher than other countries who have lifted lockdown, but without masking in any material numbers? You don’t have to be a conspiracy theory-loving leftie to wonder whether the speed is, at least in part, a distraction from the Cummings fiasco.
I didn’t mean to sound angry. But I can’t help it. Like I said: this is deadly serious.I just can’t understand why those running the show don’t seem to be treating it that way. I really, really wish they did.