Asked by: Damian Collins (Conservative - Folkestone and Hythe)
Question to the Department of Health and Social Care:
To ask the Secretary of State for Health and Social Care, which companies or organisations will process the analytics of the (a) inferred and (b) other data gathered by the NHS covid-19 contact tracing app; and whether that data will be held and processed in the UK under UK legislation.
Answered by Nadine Dorries
Amazon Web Services, the engineering firm VMWare Tanzu, Google and Microsoft are all providing services necessary for the proper functioning of the app. Data may also be shared with NHS England and NHS Improvement. Where data is held outside of the United Kingdom it will be held within the European Economic Area. The contracts governing the arrangements with data processors contain standard clauses requiring compliance with the General Data Protection Regulation.
The data that app users have chosen to share with the National Health Service may be retained for research in the public interest, or by the NHS for planning and delivering services, in line with the law and on the basis of the necessary approvals required by law.
Data will be stored securely and processed in the UK. Information that does not, and cannot, identify you may be stored and processed outside of the UK (for example, information purely about the number of proximity alerts issued, or the number of outcomes from tests).
Asked by: Damian Collins (Conservative - Folkestone and Hythe)
Question to the Department of Health and Social Care:
To ask the Secretary of State for Health and Social Care, with reference to the NHS covid-19 tracing app and in addition to the code for the app that has already been published, if he will publish (a) the code for the backend processing of data, (b) the third party data services to be used and (c) the administrative roles involving that data.
Answered by Nadine Dorries
Alongside the source code for the app, we have already published documentation which sets out the full application and system architecture. The data protection impact assessment lists the data processors and their roles.