Contact tracing privacy notice

Introduction

This privacy notice explains how the council uses your data for purposes related to contact tracing as part of the national response to COVID-19 (Coronavirus). The notice also provides information about your data protection rights.

The UK is currently experiencing a public health emergency as a result of the coronavirus (COVID-19) pandemic.

NHS Test and Trace is a national programme that aims to ensure that anyone who develops symptoms of coronavirus can be tested quickly and helps trace the recent close contacts of anyone who tests positive to notify them that they must self-isolate or to offer support and advice to help stop the spread of the virus.

Public Health England has published privacy information for NHS Test and Trace.

The council is helping NHS Test and Trace by contacting Hammersmith and Fulham residents who have tested positive for the virus (or contacts of those who tested positive for the virus), to ask them about places they have visited recently.  

Information will be collected by staff in the council’s Customer Service Centre or Public Health teams.

Contact tracing is an important part of the council’s Local Outbreak Control Plan. The council will also use information provided by NHS Test and Trace or collected locally to provide advice on self-isolation, to identify potential locations of local outbreaks, and for other purposes where necessary to prevent danger to the health of the public as a result of the spread of infection or contamination with coronavirus or coronavirus disease.

Who will be using your data and how will we obtain it?

Hammersmith and Fulham Council will be the data controller for the personal data you provide to us.

We may also receive data from NHS Test and Trace, other local authorities, the police, and other organisations that are working with the council on response to the virus, or from other individuals with whom you have been in close contact.

We may also receive data from employers, businesses, schools, and other venues where we think there may have been an outbreak or transmission of the virus.

What personal data do we use?

The council may hold the following data related to individuals who have tested positive for COVID-19 or who have (or may have) been in close contact with someone who has tested positive for COVID-19:

  • Full name
  • Date of birth
  • Gender
  • Ethnicity
  • NHS number
  • Home address and residence type including any link to a care home
  • Contact details such as telephone numbers and email addresses
  • Occupation/key worker type
  • COVID-19 symptoms, including when they started and their nature
  • Test centre and pillar
  • Vulnerability group

The council will also hold records of telephone calls and other contacts with individuals made for the purposes of contact tracing, records of links between individuals, and records of venues and other locations where individuals may have been involved in transmission of the virus including the dates and times.

In some cases the council may match your data with information from other locally held datasets, such as adult social care or Housing records and then if this is unsuccessful, council Tax records. This is in order to improve the quality of contact tracing data and effectiveness of contact tracing processes and to help us identify people that might need additional support.

What types of special category personal data do we use?

The personal data held by the council includes some ‘special category’ or sensitive data. Data related to the health or ethnicity of individuals is special category data.

Why do we use your data?

The council will use your personal data to:

Contact and inform individuals who have tested positive with COVID-19 () for the virus (or contacts of those who tested positive) to offer advice and gather information. ensure individuals self-isolate when they are required to do so.

The council will also use your personal data to:

  • plan for, identify, manage and contain local outbreaks of the virus;
  • support research into COVID-19, including analysis and modelling of the progress and development of the virus locally and nationally;
  • enforce COVID-secure measures at settings and venues; and
  • support planning of services and actions in response to COVID-19.

Where possible the council will aggregate or de-identify your data when it used for purposes that do not require you to be identifiable as an individual.

If you ask the council for support to do with COVID-19 then we will use the data you give us for this purpose.

We will not share or use your information for other purposes unless we have a legal obligation to do so.

What is the legal basis that allows us to use your data?

The council’s processing of personal data for the purposes described above is on the lawful basis of public task in Article 6(1)(e) in the General Data Protection Regulation (GDPR): processing is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority”.

The council’s processing of health information and other special category data for those purposes is based on the condition in Article 9(2)(i) of GDPR: processing is “necessary for reasons of public interest in the area of public health”, as supplemented by Schedule1 Part 1 (3) of the Data Protection Act 2018.

Other lawful bases such as legal obligation may also apply in some situations.

Directions from the Secretary of State under Regulation 3 (4) in the Health Service (Control of Patient Information) Regulations 2002 create an exception to the common law duty of confidentiality that would otherwise restrict sharing of confidential patient information for purposes unrelated to direct care.

When we use your data to support research into COVID-19 our lawful basis is public task GDPR Article 6(1)(e) and our processing of health information and other special category data for research is based on the condition in Article 9(2)(j) of GDPR: processing is necessary for scientific/historical research, archiving in the public interest, or statistics purposes”, as supplemented by Schedule1 Part 1 (4) of the Data Protection Act 2018. 

If you ask the council for support to do with COVID-19 then we will use the data you give us for this purpose. Our lawful basis for processing your personal and other special category data to provide you with support is explicit consent GDPR Article 6(1)(a) and Article 9(2)(a).

Who may we share your data with?

The council will share your data with NHS Test and Trace. We may also share your data with NHS organisations, universities, the Ministry of Defence, and other external organisations including employers when necessary for the purposes of contact tracing, response to local outbreaks, or to support research and analysis to better understand the spread of the virus

We will ensure we only share your data with organisations that the council trusts will comply with data protection law. Where possible the council will aggregate or de-identify your data when it is shared for purposes that do not require you to be identifiable as an individual.

In some circumstances, where we are under a legal obligation to do so or where otherwise necessary, the council may share your data with the police for purposes of enforcing regulations on self-isolation and other legal requirements related to COVID-19

We only process your data in the UK and European Economic Area (EEA). 

How long is your data kept for?

We will only keep your personal data for as long as is necessary for the purposes for which we are processing it, unless we are under a legal obligation or have another legitimate reason for keeping it longer.

It is not possible at this stage to estimate the duration of the pandemic or how long the council may need to keep your data. We will regularly review the data we hold to determine if it is still required. We will take account of guidance from the Government to ensure a co-ordinated approach with other organisations.

We anticipate the council will not need to retain data collected for the purposes of contact tracing beyond the period necessary for local involvement in response to COVID-19, if the same data has been shared with NHS Test and Trace. Public Health England’s privacy notice currently states that it will keep data related to individuals who test positive for COVID-19 for up to eight years and data related to close contacts for up to five years.

Personal data held by the council will be securely deleted or destroyed once we no longer have a legitimate reason to keep it.

What are your rights?

For more information on your rights and how to exercise them please see Your data rights – what they are and Your data rights – how to exercise them.

Who to contact if you’re unhappy about how we use your data or comply with your data rights

For who to contact if you’re unhappy, please see Your data rights – who to contact if you’re unhappy.

What if this notice changes?

If we make a big change to what personal data we process, how or why we process it, or who processes it, we’ll update this notice. We may also contact you using other communication channels to make you aware of the changes.