Privacy campaigners are preparing a legal challenge to the NHS’s coronavirus test-and-trace programme as concerns grow about the amount of contact data that will be collected and retained by government. The Open Rights Group (ORG) has instructed the data rights lawyer Ravi Naik to draft a letter outlining its concerns after Public Heath England said it would retain “personally identifiable” data of those who test positive for 20 years. Jim Killock, the ORG’s executive director, said: “The government needs to better explain its reasoning; what they have done so far has been rushed. Our concern is people will feel reluctant to participate if they feel their personal data is leaving their control.” Newly employed contact tracers have been tasked with interviewing people who test positive for coronavirus – currently a little over 2,000 a day – and asking them who they came into close contact with in the two weeks before becoming infected. The tracers will then call those people and ask them to self-isolate – and if they do not become sick their personal data will be retained by the NHS in England for a shorter period of five years. Concerns raised by the ORG include whether the personally identifiable data retained could be subsequently obtained by the Home Office or other government departments for immigration or other purposes. The privacy group is also unhappy that the government has failed to complete a legally mandated data protection impact assessment, which is supposed to be filed with the Information Commissioner’s Office before any “high-risk” activity is carried out. The health secretary, Matt Hancock, has argued that existing data protection law is sufficient, while last week Lady Dido Harding, the chair of NHS test-and-trace programme, said any data collected wold be part of “an NHS conversation, entirely confidential”. However, senior politicians have called for ministers to introduce legislation to safeguard data privacy, arguing that oral reassurances are insufficient. In a letter seen by the Guardian, Harriet Harman, the chair of the influential joint committee on human rights (JCHR), wrote to Hancock, arguing that “these new powers require new protections”. “It seems to us absolutely evident that the bill is needed,” Harman told the Guardian. “And instead of looking ahead to that fact, they’re going to wait until it’s urgent. Public opinion is very volatile about this sort of thing. One minute everyone can be seeing the absolute good sense, and the next they can have a lot of worries about it.” Harman said the 20-year limit risked losing the trust of the public, and giving authorities too much leeway. “Our goal is to make the promises that [Hancock] has already made meaningful. Assurances in a letter don’t protect anyone. What protects people is legislation,” she said. “I’d rather they just did the bill, because I don’t want to be turning around and saying ‘I told you so’ when there’s some sort of scare and confidence collapses and the important test-trace-isolate initiative hits a roadblock.” The JCHR, a cross-party committee that includes members from both houses of parliament, took the unusual step of drafting its own bill enshrining in law the requirement to delete gathered information after the end of the outbreak. “This is what Boris Johnson would describe as oven-ready,” said Harman. “I just think they’re being irrational about it, and unwise, and are going to make things more difficult.” In the letter to Hancock, Harman lays out 10 areas where existing law does not match the promises the government has made, from security to anonymisation. PHE said it was standard practice across the NHS to securely retain data for the benefit of both patients and wider public health, and that all data collection and storage is fully compliant with General Data Protection Regulation (GDPR) and the Data Protection Act 1998. Separately, a rightwing thinktank has said an independent reviewer would bee needed to review coronavirus emergency powers and surveillance measures if they look like becoming permanent. A report from the Henry Jackson Society concluded that “continued scrutiny” of the powers under the Coronavirus Act was vital and should reflect the system of oversight used for terrorism legislation. Existing rules provide for an independent reviewer of terrorism legislation – Jonathan Hall QC – who scrutinises and reports on security bills and has access to sensitive and secret information to carry out their job. Nikita Malik, the author of the Leaving Lockdown report, said that the government’s response to Covid-19 had involved “navigating the balance between civil liberties and national security” and that “what was needed now was greater transparency, oversight, and accountability. Malik also highlighted attempts to consolidate NHS databases in work being conducted to help ministers respond to the pandemic by the data mining firms Palantir and Faculty, the second of which worked on the Vote Leave campaign in 2016. The report said there were “concerns around ‘surveillance creep’ where intrusive powers are expanded or data is used to prosecute for a range of crimes”.