Privacy Notice - Backward and Local Contact Tracing

The UK is currently experiencing a public health emergency as a result of the coronavirus (COVID-19) pandemic. Backward Contact Tracing is a programme that aims to establish the source of COVID-19 infections in the local area as well as check on the welfare of those that have tested positive.

NHS Test and Trace is a national programme that aims to ensure that anyone who develops symptoms of coronavirus can be tested quickly and helps trace the recent close contacts of anyone who tests positive to notify them that they must self-isolate or offer support and advice to help stop the spread of the virus. You can find Public Health England’s Test and Trace privacy information here.

Solihull MBC is assisting NHS Track and Trace by contacting Solihull residents who have tested positive for the virus to ask them about their close contacts and places they have visited recently, and by identifying and contacting individuals who have been in recent close contact with residents who have tested positive

Data Controller

Information will be collected by Public Health staff or other teams within the council. Solihull MBC will be the data controller for the personal data you provide to us. We may also receive data from NHS Test and Trace, the police, and other organisations that are working with the Council on response to the virus, or from other individuals with whom you have been in close contact. We may also receive data from employers, businesses, schools and other venues where we think there may have been an outbreak or transmission of the virus.

Categories of personal data we collect and process

The Council may hold the following data related to individuals who have tested positive for COVID-19 or who have (or may have) been in close contact with someone who has tested positive for COVID-19:

  • Full Name
  • Date of Birth
  • Gender
  • Ethnicity
  • NHS Number
  • Home address and residence type including any link to a care home
  • Contact details such as telephone numbers and email addresses
  • Occupation/key worker type
  • COVID-19 symptoms, including when they started and their nature
  • Test centre and pillar
  • Vulnerability group
  • Shielded status

The Council will also hold records of telephone calls and other contact with individuals made for the purposes of contact tracing, records of links between individuals, and records of venues and other locations where individuals may have been involved in transmission of the virus including the dates and times.

In some cases the Council may match your data with information from other locally held datasets, such as Council Tax and social care records, in order to improve the quality of contact tracing data and effectiveness of contact tracing processes and to help us identify people that might need additional support.

Sources and categories of personal data

The personal data held by the Council includes some ‘special category’ or sensitive data. Data related to the health or ethnicity of individuals is special category data.

What we use your personal data for

The data collected will be used to identify potential locations of local outbreaks, and for the purposes where necessary to prevent danger to the health of the public as a result of infection or contamination with coronavirus.

The Council will use your personal data to:

  • contact individuals who have tested positive with COVID-19 to offer advice and gather information about the likely source of infection; and
  • gather information from individuals who may have been in close contact with someone who has tested positive;
  • if additional support is required, whether financial, medical or social, then the council will sign-post individuals to the appropriate services and;
  • ensure individuals self-isolate when they are required to do so.

The Council will also use your personal data to:

  • plan for, identify, manage and contain local outbreaks of the virus;
  • support research into COVID-19, including analysis and modelling of the progress and development of the virus locally;
  • enforce COVID-secure measures at settings and venues; and
    support planning of services and actions in response to COVID-19.
  • Where possible the Council will aggregate or de-identify your data when it used for purposes that do not require you to be identifiable as an individual.

We will not share or use your information for other purposes unless we have a legal obligation to do so.

Our lawful basis for processing the personal data

The Council’s processing of personal data for the purposes described above is on the lawful basis of public task in Article 6(1)(e) in the General Data Protection Regulation (GDPR): processing is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority”.

The Council’s processing of health information and other special category data for those purposes is based on the condition in Article 9(2)(i) of GDPR: processing is “necessary for reasons of public interest in the area of public health”, as supplemented by Schedule1 Part 1 (3) of the Data Protection Act 2018.

Other lawful bases such as legal obligation may also apply in some situations.

Directions from the Secretary of State under Regulation 3 (4) in the Health Service (Control of Patient Information) Regulations 2002 create an exception to the common law duty of confidentiality that would otherwise restrict sharing of confidential patient information for purposes unrelated to direct care.

International Data Transfers and Storage

No international data transfers are made

Who may we share your data with

The Council will share your data with NHS Test and Trace. We may also share your data with NHS Organisations, universities, the MOD, and other external organisations including employers when necessary for the purposes of contact tracing, response to local outbreaks, or to support research and analysis to better understand the spread of the virus.

We will only share your data with organisations that the Council trusts will comply with data protection law. Where possible the Council will aggregate your data when it is shared for purposes that do not require you to be identifiable as an individual.

Personal data disposal and retention

We will only keep your personal data for as long as is necessary for the purposes for which we are processing it, unless we are under a legal obligation or have another legitimate reason for keeping it longer.

It is not possible at this stage to estimate the duration of the pandemic or how long the Council may need to keep your data. We will take account of guidance from the Government to ensure a co-ordinated approach with other organisations.

We anticipate the Council will not need to retain data collected for the purposes of backward contact tracing beyond the period necessary for local involvement in response to COVID-19. Personal data held by the Council will be securely deleted or destroyed once we no longer have a legitimate reason to keep it.