Privacy Notice - Solihull Council Testing Sites

The UK is currently experiencing a public health emergency as a result of the coronavirus (COVID-19) pandemic. Backward Contact Tracing is a programme that aims to establish the source of COVID-19 infections in the local area as well as check on the welfare of those that have tested positive.

Data Controller

Information will be collected by Public Health staff or other teams within the council. Solihull MBC will be the data controller for the personal data you provide to us. We may also receive data from NHS Test and Trace, the police, and other organisations that are working with the Council on response to the virus, or from other individuals with whom you have been in close contact. We may also receive data from employers, businesses, schools and other venues where we think there may have been an outbreak or transmission of the virus.

Categories of personal data we collect and process

The Council may hold the following data related to individuals who have tested positive for COVID-19 or who have (or may have) been in close contact with someone who has tested positive for COVID-19:

  • Full Name
  • Date of Birth
  • Gender
  • Ethnicity
  • NHS Number
  • Home address and residence type including any link to a care home
  • Contact details such as telephone numbers and email addresses
  • Occupation/key worker type
  • COVID-19 symptoms, including when they started and their nature
  • Test centre and pillar
  • Vulnerability group
  • Shielded status

The Council will hold this records pending receipt of an individual’s COVD19 test results. Should individuals result be positive, information will be shared with the Councils Contact and Backward Tracing Teams for follow up directly with individual to capture records of links between individuals, venues and other locations where individuals may have been that may result in the transmission of the virus this will include the dates and times of contacts.   

Sources and categories of personal data

The personal data held by the Council includes some ‘special category’ or sensitive data. Data related to the health or ethnicity of individuals is special category data.

What we use your personal data for

The data collected will be used to identify potential locations of local outbreaks, and for the purposes where necessary to prevent danger to the health of the public as a result of infection or contamination with coronavirus.

The Council will use your personal data to:

  • contact individuals who have tested positive with COVID-19 to offer advice and gather information about the likely source of infection; and
  • if additional support is required, whether financial, medical or social, then the council will sign-post individuals to the appropriate services.

The Council will also use your personal data to:

  • plan for, identify, manage and contain local outbreaks of the virus;
  • support research into COVID-19, including analysis and modelling of the progress and development of the virus locally;
  • enforce COVID-secure measures at settings and venues; and
    support planning of services and actions in response to COVID-19.
  • Where possible the Council will aggregate or de-identify your data when it used for purposes that do not require you to be identifiable as an individual.

We will not share or use your information for other purposes unless we have a legal obligation to do so.

Our lawful basis for processing the personal data

The Council’s processing of personal data for the purposes described above is on the lawful basis of public task in Article 6(1)(e) in the General Data Protection Regulation (GDPR): processing is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority”.

The Council’s processing of health information and other special category data for those purposes is based on the condition in Article 9(2)(i) of GDPR: processing is “necessary for reasons of public interest in the area of public health”, as supplemented by Schedule1 Part 1 (3) of the Data Protection Act 2018.

Other lawful bases such as legal obligation may also apply in some situations.

Directions from the Secretary of State under Regulation 3 (4) in the Health Service (Control of Patient Information) Regulations 2002 create an exception to the common law duty of confidentiality that would otherwise restrict sharing of confidential patient information for purposes unrelated to direct care.

International Data Transfers and Storage

No international data transfers are made

Personal data disposal and retention

We will only keep your personal data for as long as is necessary for the purposes for which we are processing it, unless we are under a legal obligation or have another legitimate reason for keeping it longer.

It is not possible at this stage to estimate the duration of the pandemic or how long the Council may need to keep your data. We will take account of guidance from the Government to ensure a co-ordinated approach with other organisations.

We anticipate the Council will not need to retain data collected for the purposes of backward contact tracing beyond the period necessary for local involvement in response to COVID-19. Personal data held by the Council will be securely deleted or destroyed once we no longer have a legitimate reason to keep it.