Data watchdog looks into private antibody testing facility

Thursday 14 May 2020

Jersey’s data watchdog has approached the new private antibody testing facility to review its medical information handling processes, Express has learned.

Information Commissioner Paul Vane said that his office had not been contacted by Orchid Care Services in advance of it setting up a drive-through centre at Tamba Park, but that they would be approaching the organisation to ensure appropriate measures have been taken to comply with legal requirements.

The pinprick blood test service launched this week at a cost of £74.95 to adults and £50 for frontline workers.

According to the facility’s website According to to the facility's website - covidtesting.je - the tests come from manufacturer CTK Biotech, which has received approval for use in Australia, but not the UK. 

Pictured: A screenshot of the website.

Mr Vane told Express that any organisation that handles “special category data” - which includes sensitive medical information - has a very specific set of obligations under the law.

These include appointing “an appropriately skilled and experienced data protection officer to oversee the development, implementation and running of the project”, as well as conducting a ‘Data Protection Impact Assessment’ in advance of launching. 

“If this assessment concludes that the risk to the rights and freedoms of individuals under the Law is high, then the organisation must seek approval for the processing from the JOIC in advance of the commencement of such,” Mr Vane explained. 

He added: “The organisation would also need to ensure compliance with the data protection principles which underpin the Law, particularly in relation to having the appropriate technical and organisational security measures in place, but also to ensure all processing is lawful and meets the required conditions for processing set out in the Law.

“If any information collected is to be shared with third parties, again the organisation will need to ensure to apply the correct lawful basis for such disclosure and have the appropriate sharing arrangements in place.

“Finally, the organisation should have a robust and easily accessible privacy policy covering all of the processing activity, including any further disclosure. This is a key document and is needed to ensure the transparency and accountability of the organisation to those whose information is being collected.”

Pictured: Paul Vane, Information Commissioner.

Questioned about the handling of the sensitive data resulting from the tests by Express, Orchid Care’s Managing Director James Ahier said clients' privacy is being taken "very seriously", and that Orchid has "taken a number of measures to keep data flowing through our website safe and secure, including a firewalls and authentication processes".

"Data will not be used for anything else other than collating results," he confirmed.

Although the facility did not make contact with the Information Commissioner in advance of opening, Mr Ahier said they did have “a conversation” with the Government of Jersey.

However, a spokesperson said that the government did not endorse it in a strongly-worded statement issued yesterday morning - less than 24 hours after the facility’s launch.

“This is not in collaboration with the Government. We urge Islanders to be extremely cautious before giving their blood in a setting that we cannot verify meets clinical standards for care," they said.

“We are also currently investigating the claims of the organisers in offering these private antibody tests in Jersey.

“Any testing needs to be undertaken in the right setting, with the right laboratories behind them, in order to give the right results. Without these controls and without the right scientists leading a testing programme, this will only increase fear and confusion among Islanders.”

Pictured: Government officials issued strong words of concern less than 24 hours after the facility's launch.

While the Information Commissioner acts as personal information handling regulator, it is unclear which organisation will take the lead on reviewing staff and client care.

When asked what legal authority the care group has to conduct serology testing, Mr Ahier responded: "We are providing this service for the public on a consensual. We are not performing a laboratory test, our test is know as a POC (point of care) test which can be performed in a variety of locations including outside and is a similar process to simply testing your blood sugar.”

Orchid Care, which is normally a home care provider, also maintains that all staff will be adequately kitted out with PPE while they carry out the tests.

While the Care Commission regulates the company’s home care activities, they said that reviewing whether the antibody tests were conducted in an appropriate way was outside of their remit. 

Regulation Officer Dave Luscombe told Express that the Commission had therefore “not made enquiries into the safety and efficacy of any testing undertaken by the company and can provide no assurances to the public in this regard”.

Express has asked the government for clarification on whether it has the ability to regulate the facility’s activities and is awaiting a response.