How to balance the easy access to personal data which effective track-and-trace systems, and public health schemes more generally, require, with the panoply of bureaucratic controls on such data which the European Union’s General Data Protection Regulation imposed on the UK.