Covid: PHW data breach 'could affect public confidence'

A data breach by Public Health Wales (PHW) could have an impact on public confidence in the coronavirus testing system, opposition parties have said.

Details of more than 18,000 people who tested positive for Covid-19 were mistakenly published online by PHW.

An investigation has been launched into the incident, which was the result of "individual human error".

Eluned Morgan, a member of the Senedd, said the Welsh Government was "very unhappy" with the breach.

Speaking on the BBC Politics Wales programme, the international relations minister said: "Let's be clear, this breach was serious, we've learnt lessons, I think Public Health Wales has learnt lessons, and what we need to do is make sure that we support them at this critical time as well.

"What we're not going to do is what they've done in England, which is to eliminate the whole structure in the middle of a pandemic.

• Where might the next Welsh Covid-19 lockdown be?

• UK seeing second wave of Covid, says Johnson

"We need to stand by this organisation... at a really critical time," she said.

It was revealed on Monday that the initials, date of birth, geographical area and sex of all 18,105 Welsh residents who had tested positive for Covid-19 between 27 February and 30 August had been uploaded by mistake to PHW's website.

The 1,928 people living in communal settings, such as nursing homes or supported housing, also had the name of their place of residence published.

The data was uploaded at 14:00 on 30 August and a member of staff was alerted to the breach that night.

But the data was not removed until 09:55 the next morning.

The information was online for hours before being taken down

PHW said the information had been viewed 56 times before it was removed but there was no evidence so far that the data had been misused.

A Welsh Government spokesperson said after the story was made public: "This is a matter for Public Health Wales."

Speaking on Friday, First Minister Mark Drakeford MS said PHW had "done everything they need to do and I don't think there's anything more to be said about that matter."

Asked if the Welsh Government was trying to distance itself from the NHS body, Ms Morgan said: "Public Health Wales is an independent body, it is arms-length of the government and it has to take its own responsibility.

'Very unhappy'

"I think Public Health Wales has been very clear that they accept and they apologise for what is a very significant breach.

"We are very unhappy with that data breach and, of course, we'll be putting pressure on Public Health Wales to make sure that they have learnt those lessons because it's in all of our interests to make sure that that data is secure."

The first minister found out about the data breach when PHW disclosed what happened on Monday - 11 days after Health Minister Vaughan Gething was told on 3 September.

Welsh Conservative health spokesman Andrew RT Davies MS told BBC Politics Wales that the data breach and other "debacles" meant the Welsh Government "have had a pretty appalling week of maintaining that confidence with the people of Wales."

Plaid Cymru's Helen Mary Jones MS said: "I think the Public Health Wales issue does matter because not only was that data published accidentally but it took almost a day to take it down - that's not acceptable.

"And if we want people to share their details with the test and trace system, they've got to know that data is secure.

"So we need to know how that breach happened and we need the Welsh Government to give us reassurance that it's not going to happen again."