Forum Topic

COVID-19 metric

I hope we're all doing our bit  and contributing to the data? Meant to post this a while ago ...https://covid.joinzoe.com/

Michael Ixer ● 2398d7 Comments

Sorry I'm a bit confused about their privacy notice:Sometimes, when we share data with researchers we export it to countries such as the USA, which have very different kinds of rules on data protection that may not protect your data in the same way as, or as well as, under GDPR. We are permitted to do this, because you consent to our doing it.

Ed Robinson ● 2397d

Ed. The full paragraph reads "When we share data with researchers at partner institutions, such as Harvard University and Stanford University, it will be anonymised but as the USA has different rules on data protection they may not protect your data in the same way as, or as well as, under GDPR. We are permitted to do this, because you consent to our doing it." It states that data is anonymised before being passed to research partners so individuals shouldn't be identifiable. The GDPR means they need your explicit consent to process and share personal data. Incidentally, California where Stanford is located now has the California Consumer Privacy Act which is provides robust data protection. Personally, in the interest of science I'm happy to give them my data which in my case is fairly inconsequential. I'd be more concerned with the data Amazon or my ISP has. Its up to you, if you're concerned then don't use it. I think they've said more in their privacy policy than they need for anonymised data. There is always the possibility anonymised data can be analysed against other dataset sets to identify individuals but only with small data volumes or poor anonymisation. Under the GDPR the fact yoiuve consented doesn't prejudice your rights if your data is compromised and remember nothings 100% secure. What specifically is confusing you?

Michael Ixer ● 2397d

Different web page - I'm looking at:https://covid.joinzoe.com/privacy-notice

Ed Robinson ● 2397d

Interesting, I now can't find the version I clipped that paragraph version from yesterday! I'm not sure they're materially different, although the one from your link looks more comprehensive. The bit about consent is oddly phrased but I think its written in the context that consent is likely being given for other reasons but in any case consent can be withdrawn. Ultimately privacy rights are determined by the GDPR in the UK. In any case if it's truly anonymised data then the GDPR doesn't apply (Recital 26). I'm not too sure what they mean by an "anonymous code". That could mean it's really pseudonymised data but provided the link from the anonymous code to the PII stays in the UK, which it will as it states only anonymised data is exported to the US, I personally wouldn't be worried about it. It's also possible the US HIPAA legislation would apply and protect the data as it's medical research, but I'm not familiar with that at all.I may also have been wrong about the CCPA covering Stanford. If the data's processed in the context of a not for profit educational research establishment it probably is out of scope, if it's processed by a for profit  business owned by Stanford it probably would be subject to CCPA. Guidance is not entirely clear, possible one point to be tested by lawyers in the Californian courts?I'm impressed you read and queried it. I mean that seriously, a lot of business people, for example, use "free software" in a business environment without reading T&Cs or PPs and don't realise the risks.

Michael Ixer ● 2396d

FFS people are dying and the rest of us are locked in our homes! Who really cares whether some big database company knows wether we're feeling unwell - when all this is over we can opt out again.Just sign up for the app and stop being such a pussy.

Michael Winstanley ● 2396d

Michael. Ed asked a reasonable question about the privacy policy, for all I - we -know he's signed up anyway. It was useful for me to do a quick refresh on the GDPR and take a quick look at the new CCPA, I wasn't doing much else 🙂 Interestingly, I was on a call with a privacy organisation discussing the new NHS contact tracing app last week. What they're doing is perfectly reasonable under the circumstances but the concern is once the data is collected and the mechanism is there will it be deleted and rescinded once everything is over? Nothing like some vigilance and governance? In spite of the language used we're not actually at war, theres no option of a ceasefire, truce and surrender. ... it needs thought, research, science, technology and calm cooperation as well as lots of testing and tracing to overcome a problem humans probably caused themselves because of poor animal welfare and a slow response ... and some money helps!

Michael Ixer ● 2396d

"when all this is over we can opt out again."That what we are trying to verify."FFS people are dying and the rest of us are locked in our homes! "An app is just a minor part of what is needed, assuming it is still possible to stop the spread given the current extent of the virus in the population. An app would play a part after testing and followed up contact tracing.I do not think the UK will go down this route - we have a less regulated society in the UK than the continent or other SE asian countries.I think it more likely that health/care workers will get regular routine testing as will other key workers.The rest of us may have to wear low quality material mask to stop us giving it to other people - until the health service can cope with the cases.

Ed Robinson ● 2396d