National Databases in Election Pledges Need Robust Safeguards, Says Expert

A computer keyboard lit by a displayed cyber code is seen in this illustration picture taken on March 1, 2017. (Kacper Pempel/Reuters)

The national databases promised by both main parties come with risks of significant privacy breaches unless robust safeguards are in place, an expert has warned.

In their manifestos, the Conservative Party has pledged to push ahead with its “Federated Data Platform” for the NHS, and Labour said it would build a “National Data Library” of research and public services.

Subhajit Basu, professor of law and technology at the University of Leeds, said while the proposals can bring substantial benefit, they will also make it easier for the public’s data to be exposed or misused.

Federated Data Platform

The Tories have promised to replace outdated computers across the NHS in a bid to slash “13 million hours” lost to IT issues every year, and to digitise NHS processes through the Federated Data Platform, which is being trialled at pilot sites. 

In emails to The Epoch Times, Mr. Basu welcomed the plan, saying it’s “crucial and timely,” but warned that the system must be well designed because any flaws “might lead to errors in medical records or disruptions in healthcare services”

He also warned such a system could also be a target of cyber attacks.

The warning came after NHS England declared a critical incident last month following a ransomware attack that affected a number of hospitals in London. In May, a large volume of stolen data was published on the dark web following an attack on NHS Dumfries and Galloway in Scotland in March.

National Data Library

Under Labour’s plan, a National Data Library will “bring together existing research programmes and help deliver data-driven public services, whilst maintaining strong safeguards and ensuring all of the public benefit.”

The party said it plans to improve data sharing across services with a “single unique identifier” to prevent families from “falling through the cracks of public services.”

Earlier this year, Labour leader Sir Keir Starmer said he would introduce NHS “patient passports” if his party wins the general election. Labour didn’t respond to The Epoch Times’ question about what data would be collected for the National Data Library.

Commenting on Labours plans, Mr. Basu said the plan to use  a unique identifier to improve data sharing is “ambitious” but also “poses significant privacy risks if not managed with the utmost care.”

“Without robust safeguards, the extensive collection and use of data, especially with a unique identifier for each individual, could lead to significant privacy breaches where sensitive personal information might be exposed or misused,” he added.

Besides the risk of patient data exposure in the NHS, Mr. Basu also warned that if data are “mismanaged or used for purposes other than originally intended, such as profiling or targeted advertising,” public distrust would be damaged.

A Step Closer to Data Sales

The parties’ pledges came after former Prime Minister Sir Tony Blair and and former Tory leader Lord William Hague jointly called on the government to sell anonymised medical records to boost research and remain competitive amid a global race of artificial intelligence.

Neither Labour nor the Toris have said they intend to sell data collected from the public, although their current plans would make it easier for the future government to do so.

And that raises “significant security and privacy concerns,” Mr. Basu said.

While selling data can generate revenue, “the more widely data is circulated, the higher the risk of it falling into the wrong hands, including individual hackers or hostile states, misused by insurance companies,” the professor said.

Mr. Basu said allowing people to opt out of these systems could help address privacy concerns and enhance trust in the system, noting that the NHS system allows patients to opt out of having their health data used for research and planning.

Asked how opting-out systems work in other countries, Mr. Basu cited Estonia as an example, saying citizens of the country can access and control their health records online, including choosing who can view their data, checking logs of who accessed their data, and restricting access except in emergencies.

Data Protection and Digital Information Bill

Before Parliament was dissolved on June 30, the Data Protection and Digital Information Bill, which would have changed the UK’s data protection regulatory landscape, was expected to become law before summer recess, but it has fallen with the dissolution of Parliament and can’t be carried over to the next Parliament.

The bill, if it became law, would have broadened the definition of “scientific research” to include commercial research.

It would also remove the requirement for organisations to have independent data protection officers, replacing it with any “senior responsible individual.”

The next government, even if it’s still a Conservative government, will have to reintroduce the bill if it wishes to do so. It remains unclear what Labour intends to do.

Other Pledges

The Conservative Party has also said it will legislate for comparable data across the UK so the performance of public services can be accurately compared.

Labour said it will introduce AI regulations and ban the creation of sexually explicit deepfakes.

Smaller parties have made more pledges to protect privacy, particularly the Liberal Democrats.