An ICO spokesperson said:
“We are reviewing the Data Protection Impact Assessment for NHSX’s pilot of its contact tracing app in the Isle of Wight. We’ll feedback our comments as quickly as possible so that they can be usefully included in the learnings from the trial.”
Notes for editors:
DPIAs are used by organisations to help them identify and minimise the data protection risks of a project.
The law only requires organisations to consult the ICO if, through their DPIA, they identify a high risk which they can’t mitigate. We can then provide advice, but it is not an approval process.
Even though there is no legal requirement for them to do so, NHSX has asked us to informally review its DPIAs for the IoW trial and for a national roll out.
As part of our ongoing support of NHSX and its fight against the pandemic, we are happy to do so.
More detailed information about DPIAs can be found here.
