Who is collecting and using your personal data?

Devon County Council (DCC) is processing your personal data as a Data Controller under Data Protection Legislation and our ICO registration number is Z6475582.

This privacy notice concerns the processing of personal data that takes place by DCC for the purposes of delivering a local test and trace service. For more information about the national test and trace service please visit https://www.gov.uk/guidance/nhs-test-and-trace-how-it-works.

This notice explains what information DCC will obtain as part of the test and trace programme, why we collect it and how we keep it secure. It also explains your rights and our legal obligation. Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

We will notify you of any changes to this privacy notice

This privacy notice was last updated 18/01/2021. If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current data protection legislation. Any queries relating to this please contact our Data Protection Officer.

What information will we collect?

If you have tested positive for COVID-19

As part of the local Test and Trace Programme, DCC receive information from Public Health England (PHE) regarding people who have tested positive for COVID-19 (not all information fields will be relevant to, or collected, for all people who test positive).

Information collected will include:

name
address
postcode
ethnicity
contact number
date of birth
NHS number
email address
phone number
gender
occupation
GP name
date of sample
date of result
result
date of onset
informed of result or not
symptomatic or not
date of death
proxy name1
proxy telephone number
proxy relationship
place of work

If you’ve had contact with someone who has tested positive for COVID-19

If you are the contact of a person who has tested positive we will collect:

your name
your phone number
your work address
your contact address
your date of contact
your type of contact (2metres for 15 mins or more)
details of any places you have been, for example, shops
details of whether you work in healthcare
details of whether you have been unwell?
your email address
your proxy Name
your proxy telephone number
your proxy relationship
your occupation
your place of work
your symptoms

Please note that contact tracers will never:

disclose any of your personal or health / medical information to your contacts (although it may be possible for the person you have been in contact with to deduce your identity, from circumstantial information)
ask you to dial a premium rate number (for example, those starting 09 or 087) to speak to us
ask you to make any form of payment or purchase a product of any kind
ask for any details about your bank account
ask for your social media identities or log in details or those of your contacts
ask for any passwords or PINs, or ask you to set up any passwords or PINs over the phone
ask you to download any software to your PC or ask you to hand over control of your PC, smartphone or tablet to anyone else
ask you to access any website or smartphone application that does not belong to the Government, NHS or HSC

Why are we collecting your data?

DCC is the data controller, for the personal data that we obtain from PHE as part of the local Contact Tracing Programme, under the Data Protection Act 2018. We will use this personal data for the following purposes:

To contact you if you have tested positive for COVID-19, to provide public health advice if appropriate and to seek information on others that you have been in contact with.
To contact you, if you have been in contact with someone who has tested positive, to give you appropriate public health advice to self-isolate and seek a test if you are symptomatic, in order to prevent further transmission of the virus.
Sharing personal information with the responsible public health bodies in Wales/Scotland/England/Republic of Ireland (or other country where relevant) (if you live in that country, or visited it during the period you may have been infectious) to inform their local planning and public health responses to COVID-19.
Public health surveillance – to identify and manage clusters of disease, identify trends in the COVID-19 disease outbreak and to prevent/control spread.
Analysis – for reports and the production of official statistics (anonymised).
Planning of services/actions in response to COVID-19 (anonymised).
Research into coronavirus – including potentially being invited to be part of clinical trials.

Information provided by you, and collected about you, for the purposes of contact tracing for COVID-19 will not be used for any purpose that is not linked to COVID-19.

The legal basis for us collecting your personal data

DCC relies on the following lawful grounds to process personal data as part of the local test and trace programme:

General Data Protection Regulation, Article 6(1)(e) – the processing is necessary for the performance of the Public Health Agency’s official tasks carried out in the public interest (The official functions of the Public Health Agency are set out in the Health and Social Care (Reform) Act (Northern Ireland) 2009.)

General Data Protection Regulation, Article 9(2) (g) – the processing is necessary on the grounds of substantial public interest

General Data Protection Regulation, Article 9(2)(h) and (i) – the processing is necessary for the provision of health and social care and the management of health and social care systems (h) and for reasons of public interest in the area of public health (i)

Data Protection Act 2018 – Schedule 1, Part 2, 5 & 6(1) (2)

Data Protection Act 2018 – Schedule 1, Part 1, (2)(2)(f) – Health or social care purposes (h) and Schedule 1, Part 1 (3) – reasons of public interest in the area of public health (i)

Personal data that is used for any of the purposes outlined in this notice is never used for direct marketing purposes and is not sold on to any other third parties.

Who will we share your information with?

To help us provide the best service for you, we may need to share your information with other healthcare bodies and professionals, including GPs and hospitals, for the purposes of public health protection.

Sometimes, we may share some information with external organisations such as District Councils. This will only take place if a call handler identifies that this may be beneficial to you and will only occur with your explicit agreement.

DCC reserves the right to share limited amounts of personal data with organisations that may require your personal data in order to manage the risks associated with the coronavirus or which are engaged with trying to stop the spread of the virus.

International transfers

We will only transfer your personal data to countries outside of the scope of UK data protection laws in exceptional circumstances. For example, where you live or have visited another country, for the purposes of disease surveillance and to protect the health of individuals and others potentially affected by an outbreak.

Any transfers will be made in full compliance with GDPR and only when we have a legitimate and lawful basis for doing so, and it is proportionate and necessary to achieve these legitimate and lawful purposes.

How long will we hold your personal data?

Devon County Council will retain your personal data for 6 years after which, it will be securely disposed of.

Your data protection rights

Under Data Protection Legislation, you have the right to obtain a copy of their personal records held by us, this is called a Subject Access Request (SAR).

Details of how to make a request can be found here.

Further details on your rights under data protection legislation and how to exercise them, are available here.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer.

Alternatively, if you are not happy with the way that DCC is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees the data protection laws in the UK.

Their contact details are below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Online: ico.org.uk/make-a-complaint
Email: casework@ico.org.uk

Automated decisions

No personal data that is processed for any of the purposes listed within this privacy notice will be the subject of automated decisions.