https://tech.newstatesman.com/coronavirus/nhs-test-and-trace-privacy-doc-throws-doubt-on-apps-anonymity-claims

The NHS privacy notice for the Covid-19 test and trace programme says that data it gathers – including names, addresses, dates of birth and symptoms of individuals and those they have been in contact with – will be stored for 20 years, available to anyone with a role in the Covid-19 response, and not necessarily subject to requests for deletion.

Legal experts have raised concerns over the loosely defined part of the notice referring to who may process the data, which will apparently be “seen by those who have a specific and legitimate role in the response”. “That vaguery over ‘the specific and legitimate role’ is a real concern, because the NHS has made clear they’re working with third party companies like Google and Palantir on their data store – so do those companies have a specific and legitimate role?” asks Ravi Naik, human rights lawyer and co-founder of the data rights agency AWO.