Privacy Notice – Covid 19 Primary Testing

 

Document title: Privacy Notice – Covid 19 Primary Testing
Version number: 1.0
Policy Status Approved
Date of Issue January 2021
Date to be revised January 2022

 


Privacy notice

Under data protection law, you have a legal right to be told about how our organisation uses any personal information that is held about you. To do with this, we provide a ‘privacy notice’ to you to explain what we do with your data.

This privacy notice explains how we collect, store and use personal data about you.

To enable the Covid-19 testing to be completed at Leigh Academies Trust, we need to process personal data for staff taking part, including sharing of personal data where we have a legal obligation. 

Leigh Academies Trust is the Data Controller for the data required for the management of tests and implementing local arrangements in the event of a positive test. 

The Department for Health and Social Care (DHSC) is the data controller for the information that you transfer to them about you and your test results. For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice 

You should read both this Privacy Notice and the DHSC COVID-19 Privacy Notice to understand how your personal data is used prior to taking a test.


The personal data we hold

We use the following information to help us manage and process the tests:

  • Name
  • Unique code assigned to each individual test and which will become the primary reference number for the tests
  • Test result

Every time you use a lateral flow test you must report the results. More details can be found here – Report a COVID-19 test result – GOV.UK (www.gov.uk).

 

Why we use this data

We will only use information that is collected directly from you specifically for the purpose of the tests, even if you have previously provided us with this information.

 

How we store this data

We will maintain a test kit log which will record against your name details of the testing kit which has been provided to you.  We will also record Personal Data about you in our internal COVID-19 results register (each academy’s COVID-19 results register will not be shared with DHSC).  This information will only be stored securely on locally managed systems with appropriate access controls and will only be accessible to personnel involved in the management of tests and implementing local arrangements in the event of a positive test. 

 

Processing of Personal Data Relating to Positive test results 

We will use this information to enact our own COVID isolation and control processes without telling anyone who it is that has received the positive test.

The information will be transferred to DHSC, who will share this with the NHS, GPs. PHE and the Local Government will use this information for wider test and trace activities as well as statistical and research purposes.

 

Processing of Personal Data Relating to Negative test results 

We will use this information to enact our own COVID isolation and control processes without telling anyone who it is that has received the positive test.

For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice 

 

Processing of Personal Data relating to Negative and Void test results

We will record a negative and void result for the purpose of stock controls of tests and general performance of the testing process.

 

Our legal basis for using this data

We will process personal data relating to staff under article 6.1(f) of the UK GDPR – it is necessary in the legitimate interest of the data controller.  We will process special category personal data under the provisions of article 9.2(i) of the UK GDPR, and Part 1 of Schedule 1(3) of DPA 2018 where it is in the public interest on Public Health Grounds to ensure we can minimise the spread of COVID in a timely manner and enable us to continue to deliver education services as safely and securely as possible.  This data is processed under the obligations set out in Public Health legislation (Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI)) which allows the sharing of data for COVID related purposes and where it is carried out by a health care professional.

This information will be kept by the Leigh Academies Trust for up to 1 month after the testing programme ends and by the NHS for 8 years.

 

Data sharing

The personal data associated with test results will be shared with 

  • DHSC, NHS, PHE – to ensure that they can undertake the necessary Test and Trace activities and to conduct research and compile statistics about Coronavirus.
  • Your GP – to maintain your medical records and to offer support and guidance as necessary. Any data you provide to the school will not be shared with your GP.
  • Local Government to undertake local public health duties and to record and analyse local spreads.

Personal Data in the academy’s test kit log will be shared with DHSC to identify which test kit has been given to which individual in the event of a product recall. The academy will not share its internal COVID-19 results register with DHSC.

 

Your rights:

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information. 

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. 

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you want to make a request please contact your datacontroller@latrust.org.uk

 

Complaints

We take any complaints about how we collect and use your personal data very seriously, so please let us know if you think we’ve done something wrong.

You can make a complaint at any time by contacting our Data Protection Officer.

You can also complain to the Information Commissioner’s Office in one of the following ways:

  • Report a concern online at https://ico.org.uk/concerns/
  • Call 0303 123 1113
  • Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

 

Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our data protection officer:

● Stephane Vernoux, Group Data Protection Officer, datacontroller@latrust.org.uk