How should organisations manage privacy risk when public health data from multiple sources is combined for contact tracing or similar uses?

Why combined public health data creates a different privacy problem

Combining public health data changes the risk profile because linkage increases what can be inferred, not just what can be seen. A dataset that seems low sensitivity on its own may become highly revealing when paired with location, testing, encounter, or registration records. The privacy question is therefore not only about the source data, but about the combined product and its downstream uses.

For contact tracing and similar public health work, the main issue is proportionality. Teams should define exactly what purpose the linked dataset serves, who needs it, and how long the combination remains necessary. The same fields that are acceptable in a narrow response can become excessive once the data is reused for analytics, case management, enforcement, or planning.

Collection source also matters. Public health data often arrives with different legal bases, retention periods, consent expectations, and quality levels. When those datasets are merged, the organisation inherits the strictest obligations across the set, plus the practical need to avoid false confidence in accuracy, completeness, or identity matching.

Controls that matter most when data is linked across sources

Good privacy control starts with purpose limitation, but it has to be enforced operationally. That means explicit access boundaries, role-based access, logging, segregation between response and analytics uses, and retention rules tied to the shortest justified lifecycle. If the linked dataset is shared with partners, the same controls need to follow the data rather than stop at the first system boundary.

Data minimisation is especially important in linked public health workflows because the privacy impact often comes from joinability. Organisations should ask whether the tracing objective can be met with a reduced dataset, tokenised identifiers, pseudonymised analysis, or a staged model where the most identifying fields are separated from the working copy. GDPR is a strong reference point here because its principles, DPIA expectations, and data protection by design requirements closely match this kind of combined-data risk.

Governance should also cover secondary use before it happens. A linked public health dataset can later become attractive for service improvement, fraud detection, compliance review, or research, but each of those uses changes the privacy analysis. NIST Privacy Framework is useful because it frames privacy risk as a managed lifecycle, not a one-time collection decision, and NIST Cybersecurity Framework 2.0 reinforces the need to govern, protect, and monitor data flows across systems and partners.

How to judge whether the privacy risk is acceptable

Organisations should judge acceptability by the combined effect, not by the least sensitive source. If the linked output can re-identify people, reveal health status, expose movements, or create a durable record that outlives the public health need, the risk is materially higher than the original purpose may suggest. In that situation, the question becomes whether the same outcome can be achieved with less linkage, less retention, or tighter access conditions.

One common mistake is treating the project as temporary and therefore low risk. Temporary systems often accumulate broad access, copied extracts, and undocumented handoffs, then persist long after the emergency or campaign phase ends. The privacy burden rises when the data is reused outside the original context, because users no longer have the same expectation, justification, or oversight that existed at collection time.

Where the combination involves health-related or other sensitive personal information, teams should assume that transparency and accountability need to be stronger than for ordinary administrative data. That usually means a documented rationale for linkage, a reviewable access model, and a clear decision on whether the combined dataset is for operational use only or can ever support longer-term analysis.

Practitioner Guidance

What to prioritise: Treat the linkage itself as the privacy event, not just the collection of the original sources. The first control question is whether the combined dataset is strictly necessary for the stated public health purpose, because that determines how far minimisation, segregation, and retention limits need to go.

What to verify: Verify that the linked dataset has a documented purpose, a named owner, a defined retention period, and access restrictions that reflect the sensitivity of the combined profile. If those four items are missing, the organisation is relying on intent rather than control.

Decision rule: If the combined data can expose more than each source independently, require a privacy impact assessment before reuse, sharing, or expansion of scope. If the use case has already drifted from contact tracing into analytics or enforcement, treat it as a new privacy decision, not an operational continuation.

Practitioner takeaway: The safest approach is to govern the linked dataset as a new, higher-sensitivity asset with its own purpose, access model, and expiry, because combination is what transforms routine public health data into a privacy risk.

Related resources from NHI Mgmt Group

• Why does RBAC reduce risk when organisations manage access to multiple systems and data sets?
• Why do public AI tools create privacy and data sovereignty risk for regulated organisations?
• How should organisations handle data privacy risk when apps collect large amounts of personal data across multiple jurisdictions?
• Why does combining multiple data sources increase privacy and compliance risk?