Privacy Notice for Covid-19 Test and Trace

What do we use the information for?

The UK is currently experiencing a public health emergency as a result of the coronavirus (COVID-19) pandemic. It is therefore critical that organisations take a range of measures to keep everyone safe. There are three elements to this information:

1. Test and Trace – to support the national service the Council will keep a temporary record of our visitors for 21 days.  In the event of a local outbreak of the virus this data may be used to assist NHS Test and Trace as needed.  This could help contain clusters or outbreaks.

2. Uncontactable cases – we receive this data from PHE and it is specifically information relating to the people who have tested positive for COVID-19 but who have failed to be reached by the National Test and Trace Service (approximately 15% of all cases).  These people will be followed up locally as part of an enhanced contract tracing service to increase the total index case contact.

3. Test data - we receive this data from Public Health England (PHE) to enable us to manage outbreaks across the East Riding of Yorkshire region.  This data relates to the positive cases identified by PHE and is refreshed every 24 hours.  With this we are better equip to obtain the bigger picture of the effects of COVID-19 within the region.
   

What information do we hold and use?

The Test and Trace service requests designated venues (such as hospitality, tourism and leisure industry, close contact services and local authority facilities) to have a system in place to request and record contact details of their customers, visitors and staff to help break the chains of transmission of COVID-19.

Customers and visitors:

• The name of the customer or visitor. If there is more than one person, then we can record the name of the ‘lead member’ of the group and the number of people in the group
• A contact phone number for each customer or visitor, or for the lead member of a group of people
• The date of visit, arrival time and, where possible, departure time
• If a customer will interact with only one member of staff, the name of the assigned staff member will be recorded alongside the name of the customer.

Staff:

• The names of staff who work at the premises
• A contact phone number for each member of staff
• The dates and times that staff are at work.

Where possible, we will collect this information in advance, where this is not practical it will be collected at the point that visitors enter the premises, or at the point of service if impractical to do so at the entrance

Recording both arrival and departure times (or estimated departure times) will help reduce the number of customers or staff needing to be contacted by NHS Test and Trace. We recognise, however, that recording departure times will not always be practicable.

The accuracy of the information provided will be the responsibility of the individual who provides it. The council will not verify any visitor’s identity for NHS Test and Trace purposes. 

The local contact tracing will use record level personal data of people who have contracted COVID-19 including:

• Personal identifiers (such as name, address, postcode, date of birth, contact details, NHS number)

• Characteristics (such as ethnicity)

• Details of COVID-19 symptoms

• Vulnerability group

• Shielded status
  

On what grounds do we use the information?

For both the Test and Trace and the local contact tracing, we process personal data for the following reason:

• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

For both the Test and Trace and the local contact tracing, we process special categories data for the following reasons:

• processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

• processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare.

How do we collect this information?

For the Test and Trace data, we collect this from people entering Council premises or booked to attend a function, event or meeting at our premises. From our existing employee records and on entering Council premises.

For the local contact tracing data, information is provided to the Council by a Public Health England website from which identifiable information on East Riding residents who have tested positive can be downloaded. 

Who do we share your information with?

For the Test and Trace data, in the event of a local outbreak of COVID-19 names and contact details of visitors to our sites may be provided to the NHS to support Test and Trace work.  NHS Test and Trace will ask for these records only where it is necessary, either because someone who has tested positive for COVID-19 has listed Council premises as a place they visited recently, or because our premises have been identified as the location of a potential local outbreak of COVID-19.

NHS Test and Trace will work with you, if contacted, to ensure that information is shared in a safe and secure way. 

You can find further information on how NHS Test and Trace works here:

Maintaining records of staff customers and visitors to support NHS Test and Trace (external website)

If you are contacted by NHS Test and Trace Contact tracers will:

• call you from 0300 013 5000
• send you text messages from ‘NHStracing’
• ask you to sign in to the NHS Test and Trace contact-tracing website:
  
  NHS Test and Trace contact-tracing (external website).

For the local contact tracing data, case details will then be sent to City Health Care Partnership (CHCP) who have been commissioned to conduct the local contact tracing.  CHCP is an independent 'for better profit' and co-owned Community Interest Company responsible for providing local health and care services. 

If you are contacted by CHCP, the contact tracers will call from a local 01482 number.

How long do we store it and is it secure?

Information that is collected and stored solely for NHS Test and Trace will be retained for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, this information will be securely disposed of or deleted. 

Information which is collected and stored solely for local contact tracing will be retained by the Council for a maximum of 5 years after the COVID-19 pandemic has been deemed to be satisfactorily contained.  However, CHCP will only retain this for a maximum of 21 days.

The Council’s IT security and confidentiality policies ensure that your information is protected, and available only to staff directly involved in your care.  NHS Test and Trace will handle all data according to the highest ethical and security standards and ensure it is used only for the purposes of protecting public health, including minimising the transmission of COVID-19.

What rights do you have?

The rights that you have depend upon the grounds upon which we collected your information. All of the rights you could have are outlined on the data protection rights page. In most cases information processed in relation to Covid-19 will be covered by the following rights:

• The right of access - You are entitled to see the information we hold about you and can request a copy by emailing data.protection@eastriding.gov.uk.

• The right to rectification - If you believe any information we hold about you to be incorrect, please email data.protection@eastriding.gov.uk and we will amend the information accordingly.

• The right to restrict processing - Should you wish to limit how we use your data please email data.protection@eastriding.gov.uk with the reason for your request.
  

Where can I find out more?

If you want to know more about how the council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. 

Contact details are available on the general privacy information page. 

Alternatively, you can contact the Information Commissioner’s Office.