Covid-19 Test and Trace privacy notice

What personal information is being processed and what for

This notice provides information about how Cheshire East Council will process information about you in relation to the unprecedented challenges we are all facing during the Coronavirus pandemic (COVID-19).

The opening up of the economy following the COVID-19 outbreak is being supported by NHS Test and Trace. Cheshire East Council is assisting Public Health England by keeping temporary records of customers and visitors to council premises, as far as practicable.

When you visit one of our buildings, e.g. libraries, children’s centres, community centres and council offices, you will be asked for basic details including your name and a contact telephone number. This data will be kept safely for 21 days and then securely destroyed. It will be shared with Public Health England’s Test and Trace service only if requested. If there is a positive case of COVID-19 identified that you may have been exposed to, someone from the Test and Trace team may contact you. Further details on why we need to do this are available at GOV.UK.

We will also be exchanging personal data with PHE of patients and service users in order to make the contact tracing service as successful as possible. The Council may use its existing databases to enable us to contact you by telephone or in person if PHE’s contact tracers have been unable to contact you after you have tested positive for COVID-19.

Information held by all departments of Cheshire East Council may be used for local test and trace purposes.

Why we are allowed to use your information

The Secretary of State for Health & Social Care has given notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI Regulations) that the Council is required to process and share necessary health and social care data for a range of purposes, including:

understanding Covid-19 and risks to public health, trends in Covid-19 and such risks, and controlling and preventing the spread of Covid-19 and such risks;
identifying and understanding information about patients or potential patients with or at risk of Covid-19, information about incidents of patient exposure to Covid-19 and the management of patients with or at risk of Covid-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from Covid-19;
understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of Covid-19 and the availability and capacity of those services or that care;

The COPI Regulations refer to the use of health and care information. However, the Council has a duty to respond to emergencies under the Civil Contingencies Act 2004 and also has powers provided by the Public Health (Control of Disease) Act 2984.

The General Data Protection Regulation requires specific conditions to be met to ensure that the processing of personal data is lawful. These relevant conditions are below:

Article 6(1)(e) – is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The processing of special category personal data, which includes data concerning a person’s health, is prohibited unless specific further conditions can be met. These further relevant conditions are below:
Article 9(2)(b) – is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.
Article 9(2)(i) – is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

Who we will share your information with

We will only share your information with other partner organisations as part of the PHE Test and Trace service in response to the Covid-19 outbreak.

We will not share your information with anyone else unless required to do so under additional legal requirements, for example to safeguard public safety, to prevent the risk of harm or to assist in the apprehension or prosecution of offenders.

Where we get your information from

The information we use for the purpose of assisting the Test and Trace service will come directly from you when you book an appointment or visit our premises. However, we will also use existing information held in our systems for the same purpose if necessary.

How long we will keep your personal information

The Council will only keep details of visitors to our premises for the purpose of Test and Trace for 21 days, taking into account Government advice.

Personal information held in existing systems will be retained in accordance with the appropriate retention periods for the relevant records.

When the information is no longer needed for this purpose, it will be securely deleted or destroyed

How your information is stored

Information will be held in a variety of formats depending on the type of venue and working practices. Some may be held in paper form, others may be in electronic systems. Access to the information is restricted to only those that need it to carry out their role in providing support services as part of the response to the coronavirus pandemic. All sharing will be carried out securely.

What happens if you don’t provide us with your information

By maintaining records of staff, customers and visitors, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to the virus. Containing outbreaks early is crucial to reduce the spread of COVID-19, protect the NHS and social care sector, and save lives. This will help to avoid the reintroduction of lockdown measures and support the country to return to, and maintain, a more normal way of life.

You can play a significant role in helping us to stop the spread of COVID-19 by agreeing to provide your contact details.

Will your information be used to make automated decisions

Your rights

For detailed information about your rights please see the data protection pages

If you are not happy about the way your personal data is being processed then contact the Council’s Data Protection Officer

You also have the right to complain to the Information Commissioner’s Office or phone on 0303 123 1113.

If you require further information about how Cheshire East Council processes your personal data, please see our corporate privacy notice .

Page last reviewed: 22 October 2021