NHS APP seeing someone else's data!

[Wishiwasrunning2]

A few weeks ago I was preparing to go to a work event and I downloaded my covid pass into the wallet app on my iPhone.

I was quite surprised when, someone else's data appeared! A strangers name, their birthday and covid status. Not even a similar name to me.

I contacted NHS app through their email address, and have been trying to get an answer and it fixed so that I can have the right info to prove my vaccinations. I'm also concerned that someone else will see my data in their app!

So just automated replies from NHS, it's been two weeks and all they have done is disable my access so I have to do regular lfts as I can't show the app. They no longer reply to my emails, I can't find any other contact details.

Does anyone know who I could report this to? Is everyone also concerned this could be happening on the app?

£37 billion that cost! Over £5550 per UK citizen (inc. all the people who don’t have it) and they can’t even get the basics right I’d skip any NHS emails since they haven’t even got the common courtesy to reply and go straight to the ICO (Information Commissioners Office). This is a serious data breach potentially affecting more people than just you and they have a legal obligation to inform everyone who may have been affected.

@SweetBabyCheeses99

£37 billion that cost! Over £5550 per UK citizen (inc. all the people who don’t have it) and they can’t even get the basics right I’d skip any NHS emails since they haven’t even got the common courtesy to reply and go straight to the ICO (Information Commissioners Office). This is a serious data breach potentially affecting more people than just you and they have a legal obligation to inform everyone who may have been affected.

No it didn't. At least get your facts straight.

The entire COVID-19 Test and Trace service cost all the billions - that all the test kits, people, additional test capacity etc needed for the pandemic.

The NHS app existed long before the pandemic and has been extended to support the vaccine status requirement. It's not even part of NHS Test & Trace, it's run by NHS Digital, a completely separate function.

OP it sounds like there is a problem with your records being linked incorrectly somewhere which is really bad and need sorting.

I assume you have already found this form for reporting the problem? There a button on here to report seeing someone else's data:

[[https://www.nhs.uk/contact-us/nhs-app-contact-us/]{

Did the app ever show your data before someone else’s appeared? What info do you have to enter when you first download it?

@ChequerBoard yes that's the form that I completed, I just get automated emails back or 'we're looking into your query'

Report it to ICO as a data breach.

@ATieLikeRichardGere

Did the app ever show your data before someone else’s appeared? What info do you have to enter when you first download it?

It showed all the right data in the beginning, then I added to wallet and the wrong data showed, then I tried to access the app to check my info was still there but they've disabled my access.

Thanks you to those suggesting ICO that's exactly what I needed. I will report and hopefully it will get sorted. I'm not even sure if I want the NHS to handle my data after this episode!

On the ICO site it says that they have one month to get back to me.

That's one month where I don't know where my data is, and where the person who's data I've seen can't be informed.

Escalate a complaint to the NHS. That will help your IOC complaint too.

@GhoulWithADragonTattoo

Escalate a complaint to the NHS. That will help your IOC complaint too.

Sounds like a good idea, how would I do that? Do you have a contact email or similar please?

All I can find it where I can complain about care or treatment, not data issues.

I was meaning using the contact page ChequerBoard mentioned but adding specifically that you are making a complaint about a serious data breach that you’ve notified the IOC

You need to keep some evidence of what you were seeing.

Yes escalate I possible, every organisation legally needs a data controller, and process for raising data breaches.

Named contact info is given on this page:
www.gov.uk/government/publications/nhs-covid-19-app-privacy-information/nhs-covid-19-app-privacy-notice

The DHSC Data Protection Officer for DHSC is Lee Cramp, who can be contacted by sending an email to [email protected].

Or is it the NHS app? www.nhs.uk/nhs-app/nhs-app-legal-and-cookies/nhs-app-privacy-policy/privacy-policy/

You can contact our Data Protection Office to make a complaint:

By email

[email protected]

By post

Privacy Transparency and Ethics team
7 and 8 Wellington Place
Leeds
West Yorkshire
LS1 4AP

Also ring 119 to get a paper version to use in the meantime to save you doing tests, hopefully that will be correct but if it isn't that will be more evidence

Just logged into the app and its saying there are no covid records for me now under the covid pass for travel. They were there before as I used it to travel in August 😕

I have got evidence as I took a screen shot of the other users details.

I have also raised a complaint with the IOC. many thanks to you all for your advice and help