Over 5.1m records on HSE's contact tracing database

HSE clinical lead for testing Niamh O'Beirne, with HSE CEO Paul Reid. Ms O'Beirne said that contact tracing data is being held due to the 'ongoing urgency of the response to Covid-19'. Picture: Leon Farrell/Photocall Ireland/PA Wire

Ireland’s contact tracing database of people who either have contracted Covid-19 or have been close contacts has over 5.1m records.

The information on the database, known as the Covid Care Tracker, is expected to be held until at least the end of the pandemic, according to tracing lead Niamh O’Beirne.

In response to a series of parliamentary questions by Social Democrats co-leader Catherine Murphy, Ms O’Beirne said that the data is being held due to the “ongoing urgency of the response to Covid-19”.

It is unclear for what purpose the more historic of the data is being held, given the relatively short period of infection of coronavirus.

Ms O’Beirne said that the data collected via the contact management programme is “being used to provide information and insights to support the work of the National Public Health Emergency Team, the Health Protection Surveillance Centre, the Department of Health, and other key decision-making forums”.

The comprehensive data held varies slightly for those who have contracted the virus and those who are close contacts.

Details held for all contacts include name, phone number, address and eircode, and mother’s maiden name, while data for positive cases includes occupation, ethnic background, underlying conditions, pregnancy, and international travel history.

Access to database

The database can be accessed via a web portal and can be browsed by all HSE public health departments, all acute hospitals, Covid community assessment hub operators, HSE Live operators, and all people employed either directly or indirectly in the provision of contact tracing services, said Ms O’Beirne.

In terms of the database’s vulnerability to malign influence, she said that contact tracing staff are “made aware of all relevant policies and procedures in this regard”.

She said that no specific complaints have been received to date.

However, the Data Protection Commission (DPC) has confirmed that it held a meeting with the HSE last week specifically in relation to the integrity of the contact tracing database.

'Performing adequately'

“On the basis of questions raised by the DPC, the HSE is looking at the access to data by contact tracing personnel to assess whether the technical and organisational measures to ensure integrity, confidentiality, and data minimisation are sufficient and are performing adequately,” said Graham Doyle, DPC deputy commissioner.

Simon McGarr, a privacy solicitor, said the most relevant question is what is the useful age of the records, as they are not allowed to be kept beyond the time which is necessary.

“If they’re going to keep them beyond the end of the pandemic, then we would need to know if that is right. There is a huge amount of data in that database, and most of them are dead records, so what is the point of that?”

He said the HSE “has behaved pretty well” regarding data collation and retention in the pandemic.

“Where they haven’t done well, those actions have tended more towards the accidental or the incompetent rather than wilful negligence.”