NHS Test and Trace Contact

Why we use personal information about you

If you test positive for coronavirus

If you test positive for coronavirus you will be contacted by the contact-tracing service and asked to confirm or provide your:

• full name
• date of birth
• sex
• ethnic group
• NHS number
• home postcode and house number
• mobile phone number
• telephone number
• email address

The DHSC has published privacy information about testing for coronavirus.

If you are a close contact of someone who tests positive

If you are a close contact of someone who tests positive for coronavirus, you will be contacted by the contact-tracing service and asked to confirm or provide your:

• full name
• date of birth
• sex
• ethnic group
• NHS number
• home postcode and house number
• mobile phone number
• telephone number
• email address

You will also be asked:

• if you are experiencing any COVID-19 symptoms, and if so their nature and when they started
• whether you are clinically vulnerable or extremely vulnerable and require support

Other information we may collect

To control the spread of coronavirus and help speed the return to a more normal life, the government has put in place a number of measures to support rapid contact-tracing and help people self-isolate. The personal information you are asked to provide if you visit certain venues, or which you must provide if you are travelling to the UK, may be collected by the contact-tracing service.

We may also collect your personal information from your workplace, school, college or university, or if you have been a visitor to a place where people are at higher risk of coronavirus such as a hospital, if that place is involved in a coronavirus outbreak

Why we are allowed to use your personal information

The law on protecting personal information, known as the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, allows us to use the personal information collected by the contact-tracing service.

The sections of the GDPR and the Data Protection Act that apply where we use personal information to identify and trace contacts, control local outbreaks, check whether people are self-isolating, confirm that someone is eligible for a self-isolation payment, and monitor the impact on public health of coronavirus are:

1. GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
2. GDPR Article 9(2)(i) - processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare
3. Data Protection Act 2018 Schedule 1 Part 1 (3) - public health

Where personal information from the contact-tracing service is used to inform a local authority and the Police that someone is not self-isolating or has not provided accurate and complete information on their close contacts, the sections of the law that apply are:

1. GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
2. GDPR Article 9(2)(i) - processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare
3. GDPR Article 10 - data relating to criminal convictions and offences

What sort of information we may hold about you

• full name
• date of birth
• sex
• ethnic group
• NHS number
• home postcode and house number
• mobile phone number
• telephone number
• email address

You will also be asked:

• if you are experiencing any COVID-19 symptoms, and if so their nature and when they started
• whether you are clinically vulnerable or extremely vulnerable and require support

How long we may keep your personal information

If you test positive for coronavirus, the personal information collected and used by the contact-tracing service will be kept by us for 8 years.

If you are a close contact of someone who tests positive, we will keep your personal information for 5 years. It is possible over time that you may be a close contact of more than one person who has tested positive, so we may hold more than one record about you. We keep each of these records separately for 5 years.

We may share your data with Chorley Council as part of the shared services arrangements.