You're holding and processing the data without having completed a PIA as required by law. By *definition* that data is being used unlawfully. https://twitter.com/DHSCgovuk/status/1285148041117405184