Local contact tracing services for Test and Trace privacy notice
Cheshire West and Chester Council is working with Public Health England, other Local Authorities and third party organisations to deliver the Local Contact Tracing Service.
This privacy notice explains what personally identifiable is collected by Cheshire West and Chester Council. It also explains how this information is used, how it is protected, how long it is kept, who it is shared with, who shares it with us, what your rights are, and how you can find out more.
Read Public Health England's privacy notice on how they are handling your information for Test and Trace.
COVID-19 is an infectious disease affecting the whole of the country. The virus that causes COVID-19 is a coronavirus. Infectious diseases present a serious and ongoing threat to public health. If not controlled, they can infect large numbers of people and, depending on the disease and other factors, can result in ill-effects ranging from relatively minor symptoms to early death.
Contact tracing is an important way of controlling the spread of infectious diseases. It involves identifying and tracing all the people who have been in contact with a person who has been infected. Depending on the nature and duration of the contact, these contacts may require advice or treatment to prevent the disease spreading further.
To trace the contacts of people with COVID-19 and support the Cheshire West and Chester Council Local Contact Tracing Service, the Council needs to collect personally identifiable information. To ensure that you have confidence in providing your personal information over the telephone, all call handlers will be calling on behalf of Cheshire West and Chester Council’s Local Contact Tracing Service and will state this at the start of each call.
Personal information will come from different sources:
- Public Health England
- The individual cases and contacts
- Third party organisations/settings (e.g. workplaces, schools, care homes, other local authorities)
The data will include some of the listed information. It will be kept to a minimum and only processed where it is appropriate to do so.
For an individual who has tested positive for COVID-19 (case):
- Unique Record ID
- Full name
- Date of birth
- Gender
- Ethnicity
- NHS number
- Home postcode and house number
- Telephone number and email address
- Occupation/key worker type
- COVID-19 symptoms, including when they started and their nature
- Vulnerability group
- Shielded status
For those who have been in close contact with someone who tests positive (contact):
- Full name
- Date of birth
- Contact details
- Ethnicity
- NHS number
- Home postcode and house number
- Telephone number and email address
- Occupation/key worker type
- Details of any COVID-19 symptoms they may have had
- Vulnerability group
- Shielded status
Your information is used to provide advice on self-isolation and how to protect yourself and others from COVID-19. It will also help identify outbreaks which require support.
The Council is working with Public Health England to provide the local contact tracing service in response to the coronavirus pandemic.
Complex cases will be referred by Public Health England to the Cheshire West and Chester Council’s Local Contact Tracing Service. The personal information will be shared with the Council for the following reasons:
- Enable contact tracers to call people who have tested positive with COVID-19 to offer advice and gather information about the people they may have come into close contact with and who may have been infected with the coronavirus
- Enable contact tracers to manage the process of tracing these contacts to find out if they have any COVID-19 symptoms and if so, to provide advice on how to seek help
- Enable the necessary sharing of personal information to third party organisations using minimum data
- Enable the planning, management and containment of local outbreaks
Your information may also be used for different purposes that are not directly related to your health and care. These include:
- Research into COVID-19
- Planning of services or actions in response to COVID-19
- Monitoring the progress and development of COVID-19
Whenever possible, information that does not directly identify you will be used for these purposes, but there may be times when it is necessary for your personal information to be used. Any releases of information that identify you will be lawful and the minimum necessary for that purpose.
The law on protecting personally identifiable information, known as the General Data Protection Regulation (GDPR), allows the Council to use the personal information collected for the purpose of Test and Trace (COVID-19).
The section of the GDPR that applies is:
- Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’
As information about health is a special category of personal information, a further section of the GDPR applies:
- Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare’
- Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
- Data Protection Act 2018 Schedule 1 Part 1 (4) - research
Separately, we have special permission from the Secretary of State for Health and Social Care to use confidential patient information for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health.
This is known as ‘section 251’ approval and includes using your test results if you test positive for coronavirus to start the contact-tracing process.
The part of the law that applies here is section 251 of the National Health Service Act 2006 and regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002.
Your personal information is protected by us in a number of ways.
It is held on computer systems that have been tested to make sure they are secure, and which are kept up-to-date to protect them from viruses and hacking.
Your information can only be seen by Council’s Local Contact Tracing Services who have been specially trained to protect your privacy.
Strong controls are in place to make sure all these staff can only see the minimum amount of personal information they need to do their job.
We hold your information in the UK only.
No information that could identify you will ever be published by us.
The personal information will only be held as long as directed by the Department of Health and Social Care (DoHSC).
Read GOV.UK's Coronavirus COVID-19 Notice for more information.
If we need to use your information for research or reports, your information will be anonymised, and any information taken from notes (hand written or typed) during any consultation sessions will be securely destroyed. The information will continue to be used in a summarised and anonymised form in any research reports or papers that are published. The anonymised information in the papers may be of historic interest and may be held in public archives indefinitely
Under data protection law, you have rights including:
- Your right of access - You have the right to ask us for copies of your personal information.
- Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
- Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
To make a request follow the instructions on our Data protection for you page.
You can complain directly to our Data protection team online or by post:
- Contact the DPO
- By post: Data Protection Officer, The Portal, Wellington Road, Ellesmere Port, CH65 0BA
You also have the right to complain to the Information Commissioner’s Office:
- Information Commissioner's Office (ICO) website
- By post: The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Email: casework@ico.org.uk
- Telephone: 0303 123 1113 (local rate) or 01625 545745 (national rate)
Should the transfer of personal information outside of the UK become necessary, it will only take place if permitted by law, and then only where there are appropriate safeguards in place to protect the personal information.
Your information will be stored on servers within the UK.