You are here

COVID-19 Test and Trace

To support NHS Test and Trace in England, ECL will collect the details, and maintain records, of staff, customers and visitors on their premises.

This privacy information is concerned with the processing of this personal data by the Department of Health and Social Care (DHSC) from the point that it is shared by ECL.

The purpose of processing is to facilitate NHS Test and Trace in conducting contact tracing. This may be necessary in the event that an individual, who is present in a place at the same time as you, tests positive for coronavirus. NHS Test and Trace may then contact you to provide appropriate advice.

NHS Test and Trace is a key part of the country’s ongoing COVID-19 response and is run by DHSC. It includes dedicated contact-tracing staff working at national level under the supervision of Public Health England (PHE) and local public health experts who manage more complex cases. Local public health experts include both PHE health protection teams and local authority public health staff.

By maintaining records of staff, customers and visitors (and sharing these with NHS Test and Trace where requested) this can help to identify people who may have been exposed to the virus.

The more rapidly and accurately we can identify people who may have been exposed to the virus and, if necessary, ask them to self-isolate, the more effectively we can break the chains of COVID-19 transmission.

Data controller

ECL is data controller for the data obtained at the point the information is collected from the individual. ECL’s legal basis for collecting this information is covered by GDPR Article 6(1)(c): a legal obligation.

What personal data we collect

ECL will collect your Name, contact telephone number, the date and times you attend the site. If contacted by DHSC ECL will provide your details to them to enable you to be contacted.

Data retention

Your data that is collected for NHS Test and Trace will be retained locally by the ECL for 21 days after your visit to site, once this time has passed the record will be destroyed.

Where your data is passed to NHS Test and Trace in the case of a suspected outbreak, your information will be kept for up to 8 years, as part of the standard contact-tracing retention period set out by PHE.

Data storage

Information collected as part of this contact-tracing initiative will be stored securely by ECL, and by NHS Test and Trace (if passed to them), in line with the requirements of the GDPR and Data Protection Act 2018.

Legal basis under GDPR and DPA 2018

DHSC’s legal basis for processing your personal data is:

  • GDPR Article 6(1)(e): the processing is necessary for the performance of its official tasks carried out in the public interest in providing and managing a health service
  • GDPR Article 9(2)(h): the processing is necessary for the management of health or social care systems and services
  • GDPR Article 9(2)(i): the processing is necessary for reasons of public interest in the area of public health
  • DPA 2018 – Schedule 1, Part 1, s.3: Public Health
  • DPA 2018 – Schedule 1, Part 1, (2)(2)(f): Health or social care purposes

Your rights as a data subject

By law, you have a number of rights as a data subject and this collection of your information does not take away or reduce these rights.

You have a right to:

  • get copies of your information: you have the right to ask for a copy of any information about you that is used
  • get your information corrected: you have the right to ask for any information held about you that you think is inaccurate, to be corrected
  • limit how your information is used: you have the right to ask for any of the information held about you to be restricted, for example, if you think inaccurate information is being used
  • object to your information being used: you can ask for any information held about you to not be used. However, this is not an absolute right, and we may need to continue using your information, and we will tell you if this is the case
  • get information deleted: this is not an absolute right, and we may need to continue to use your information, and we will tell you if this is the case

If you’re unhappy or wish to complain about how your personal data is used as part of this programme, you should contact DHSC in the first instance to resolve your issue. DHSC may have to work with partner organisations to resolve your complaint.

If this is unsuccessful, you can also raise a complaint with the Information Commissioner’s Office.