COVID-19 (Coronavirus) Maintaining Records to Support NHS Test and Trace Privacy Notice
Last update: 18 September 2020
This privacy notice explains how the Council will use your data when we collect and maintain records to support NHS Test and Trace.
The UK is currently experiencing a public health emergency as a result of the coronavirus (COVID-19) pandemic. The Government has asked local authorities to collect and maintain records of staff, service users, and other visitors on their premises at Council facilities including town halls and civic centres for events, libraries, youth and community centres, and children’s centres. At some venues local authorities are legally required to ask for this information.
We will share these records with NHS Test and Trace where requested to help the government identify people who may have been exposed to the virus.
NHS Test and Trace includes dedicated contact-tracing staff working at national level under the supervision of Public Health England (PHE) and local public health experts who manage more complex cases. Local public health experts include both PHE health protection teams and local authority public health staff.
Who will be using your data?
Nottinghamshire County Council will be the data controller for the data you provide to us.
We may also contract third party organisations to process your data on our behalf where, for instance, our buildings are not run directly by us.
What personal data do we use?
- A contact telephone number, or an email address if a phone number cannot be provided, or a postal address if neither can be provided
- Date of visit, arrival time and, where possible, departure time
If you visit our premises as the member of a group, we might only record the name and contact details for one member of the group, along with the number of people in the group.
If you interact with a particular member of staff we may also record their name alongside yours.
We will not collect this data if we have already received the same data for another purpose – for example, if you have registered for an appointment or to attend an event, or if you are a member of staff who works regular hours on the premises.
Why do we use your data?
If we collect your data specifically for the purpose of helping NHS Test and Trace to help the government identify people who may have been exposed to the virus, we will only use the data for that purpose.
What legal reasons allow us to use your data in this way?
We are processing your personal data because it is necessary for the performance of a task carried out in the public interest in accordance with Article 6(1)(e) of the General Data Protection Regulation (GDPR).
Data collected at some locations will also be processed because it is necessary to comply with a legal obligationin accordance with Article 6(3) of GDPR.
We will not process any special category (sensitive) data for this purpose.
Who may we share your data with or receive it from?
We will share records containing your data with NHS Test and Trace where it is necessary – for example, if our premises has been identified as the location of a potential COVID-19 outbreak, or because someone who has tested positive for COVID-19 may have visited our premises recently.
We may share your data with NHS Test and Trace if we have collected the data for that purpose, or if we have received the same data for another purpose. We will only share the minimum data necessary to support NHS Test and Trace.
May personal data be transferred overseas?
The Council will not transfer personal data collected for this purpose outside the UK.
How long is your data kept for?
The Council will keep any data we collect for the purpose of supporting NHS Test and Trace for 21 days after your visit to our premises. After 21 days we will securely delete or destroy the records containing the data.
If we have also received your data for another purpose, we may keep the data for a longer period. Please refer to the Council’s other privacy notices for information on how we process your data for other purposes.
What will happen if you do not provide or we cannot obtain the data needed?
You do not have to provide your data for the purpose of supporting NHS Test and Trace. However if you do not provide the data it will be more difficult for NHS Test and Trace to contact you if they think that someone who has tested positive for COVID-19 has visited our premises recently or if our premises is identified as the location of a potential local outbreak of COVID-19.
At some locations the Council may be legally required to refuse entry to persons who do not provide contact information.
Does the service make decisions using fully automated processes?
What rights do you have over this use of your data?
- To be informed about how we use your data
- To access a copy of your data that we process
- To have us rectify or correct your data that we process
- To restrict our processing of your personal data
- To object to the use of your data
- To have your personal data erased
- To request that we transfer your information to you or another organisation
- To object to fully automated decision making
- To withdraw your consent (if it the legal reason why we use your data).
Some of these rights are subject to exceptions. Please refer to Part 10 of the County Council’s main privacy statement for further details.
Contact the Data Protection Officer
If you have any concerns about how the Council is using your data, you can contact the Council’s Data Protection Officer by writing to:
Data Protection Officer
Nottinghamshire County Council
Please see the County Council’s main privacy statement for further information.
Contact details of the Information Commissioner’s Office
If you are unhappy with how your data has been processed by the Council or you feel your data protection rights have been breached, you have the right to complain to the Information Commissioner’s Office at: