Fears criminals will pose as contact tracers
Police warn of scammers targeting vulnerable, as questions raised about protecting personal data
FRAUDSTERS could seek to exploit the test and trace programme in order to target vulnerable individuals by posing as contact tracers, police warned yesterday. One force attempted to get ahead of potential scam attempts by telling people how they could recognise a genuine call from NHS Test and Trace.
It came as the information watchdog said it would examine the new system to ensure people’s sensitive health information was protected, despite the programme struggling to get up and running, with volunteers complaining about a lack of cases.
West Mercia Police issued a detailed list of requests a contract tracer would never make, but a fraudster might, such as asking for payment or telling you to download software.
Addressing the potential security concerns, Dr Isabel Oliver, of Public Health England, told the BBC: “Of course we are concerned, but we are working with the National Cyber Security Centre and others to make sure the programme is as robust as possible and those issues are monitored.”
In a separate development yesterday, the Information Commissioner’s Office said it had got “in contact” with the NHS for launching the contact tracing system before meeting its obligation to outline the privacy protections in place. The discovery that the system had gone live before a mandatory Data Protection Impact Assessment prompted warnings from legal experts that the NHS could be vulnerable to court challenges.
The privacy issue emerged as the system was again beset by technical problems. Downing Street was unable to confirm how many people were selfisolating as a result of getting calls.
Under the scheme, health workers call people who have tested positive to collect the details of those they have had close contact with. Volunteers then call the contacts to ask them to self-isolate for 14 days.
One contact tracer told The Daily Telegraph they had failed for a second day to log into the programme, after the online system crashed.
Another volunteer was reported to have logged on but did not receive any numbers to call.
Under the General Data Protection Regulation, any organisation handling personal sensitive information has to complete an assessment beforehand, to outline how they intend to protect the data. Yesterday, PHE said it was still “preparing” the assessment and expected to publish it “shortly”.
An ICO spokesman said: “We appreciate that organisations need to move at pace to respond to the Covid-19 crisis and this will affect some of their usual processes. The most important thing is that suitable measures are in place to protect people’s personal data and manage any risks to their privacy.”
Ravi Naik, director of AWO, a data rights agency, said there were questions over what the information could be used for and added: “They could open themselves up to a legal challenge.”