5. To ask the Scottish Government whether it will publish details of organisations with whom test and protect data can be shared, and for what purposes. (S5T-02472)

Privacy and data security are very important to the Scottish Government and NHS Scotland.

As test and protect is made up of a number of different strands, such as testing, contact tracing and the Protect Scotland app, a number of data protection impact assessments have been undertaken. They set out what data is collected, how it is shared, with whom and for what purpose. Where appropriate, they are accompanied by relevant privacy notices.

The Scottish Government already publishes details of organisations with which test and protect data is shared—and for what purposes—on the main NHS Scotland information governance website—[

Interruption

.

] Excuse my coughing. Data is shared only when that is needed for public health purposes. Although the information is available in many documents, if the member would find it helpful, I am happy to commit to bringing all of it together in one document.

Thank you. I am grateful to the health secretary for persevering through that response.

Of course, how such data is shared is a matter of public interest. The test and protect system relies on public confidence. If people stop freely sharing information, for whatever reason, the system cannot work.

Professor Stephen Reicher, who is advising the Government, said that sharing contact tracing information with the police is

“the perfect way to stop people getting tested and providing their contacts.”

The fear of reprisals cannot outweigh the public health priority of finding out where people have been and the contacts they have had. If people stretch the rules, is it not better to know that?

I am grateful to the member for his supplementary question. I assure everyone that it is not a persistent cough and that I have not lost my sense of taste or smell.

The member is absolutely right, and I agree with Professor Reicher. We and NHS Scotland do not share personal information from test and protect exercises with the police. In fact, personal information is not shared with the Government; it is shared only with health boards, so that they can follow up index cases, and with local authorities, so that they can follow up in offering inreach support for those who have been asked to self-isolate.

However, as I said, I am very happy to bring together and make available to all members, in one single document to be lodged in the Scottish Parliament information centre, information about all the organisations with which data, including personal data, is shared and for what purpose, so that everyone can be assured—and therefore be able to reassure their constituents—about the seriousness with which we treat privacy and the collection of data, in order to ensure that people have confidence in the test and protect app and process.

I thank the Cabinet Secretary for Health and Sport for that reassurance, and I seek further reassurance. Last Thursday, the Scottish Government’s statistics reported a 72 per cent increase in fraud. We know already that test and protect has been mimicked by fraudsters. If the system is to work, people need to know that they can trust test and protect callers. Will the cabinet secretary therefore set out what people should be looking for, so that they can know that the real test and protect is on the line?

I am very happy to do that. I do not have the detail of that with me, and I would not want to get any part of it wrong, because it is really important. Therefore, this afternoon, my office will send that information in a note to Mr McArthur and all members, so that they are clear that there is a very particular process that test and protect contact tracers go through in order to assure the person they are contacting that they are from the NHS test and protect programme and to assist in avoiding anyone attempting to scam that exercise.

Can data that is gathered by the essential test and trace system, such as personal phone numbers, be used to enforce isolation on those who have been contacted after their contact with an infected individual?

We cannot enforce isolation on any individual, just as we cannot make people follow the public health guidance. We have to convince people of the benefits of doing that—including self-isolation, hard though that is—in order to protect themselves, their families and, in that collective exercise, each other.

This virus is different, as is how we must deal with it. It is genuinely a public health response. That means that the decisions that I make—as an individual, not as the Cabinet secretary—have an impact on everyone in the chamber. If I choose not to wear a mask when walking around the building, nor to wash my hands or keep to a 2m distance, and so on, that puts at risk everyone with whom I come into contact. I do those things not just to protect myself and those whom I love, but to protect everybody else. That is what we require.

We cannot force people to do those things, and we recognise that self-isolation is quite a big ask of individuals in different circumstances. Fourteen days is a long time, and their personal circumstances may make it difficult. A member talked about the financial difficulties that self-isolation can bring to people. That is why we have—as much as we can—taken steps to offer financial support to some individuals in those circumstances and, through our local authority colleagues, to offer any other support that might be needed—for example, in getting food, walking the dog or whatever it might be—so that people can self-isolate, which is what we really need.

The Presiding Officer:

Thank you. That concludes topical Question Time. We will shortly move on to the next item of business.