Skip to main content

Local contact tracing services for Test and Trace privacy notice

Cheshire West and Chester Council is working with Public Health England, other Local Authorities and third party organisations to deliver the Local Contact Tracing Service.

This privacy notice explains what personally identifiable is collected by Cheshire West and Chester Council. It also explains how this information is used, how it is protected, how long it is kept, who it is shared with, who shares it with us, what your rights are, and how you can find out more.

Read Public Health England's privacy notice on how they are handling your information for Test and Trace.

What is test and trace?

COVID-19 is an infectious disease affecting the whole of the country. The virus that causes COVID-19 is a coronavirus. Infectious diseases present a serious and ongoing threat to public health. If not controlled, they can infect large numbers of people and, depending on the disease and other factors, can result in ill-effects ranging from relatively minor symptoms to early death.

Contact tracing is an important way of controlling the spread of infectious diseases. It involves identifying and tracing all the people who have been in contact with a person who has been infected. Depending on the nature and duration of the contact, these contacts may require advice or treatment to prevent the disease spreading further.

What personal information do we hold?

To trace the contacts of people with COVID-19 and support the Cheshire West and Chester Council Local Contact Tracing Service, the Council needs to collect personally identifiable information. To ensure that you have confidence in providing your personal information over the telephone, all call handlers will be calling on behalf of Cheshire West and Chester Council’s Local Contact Tracing Service and will state this at the start of each call.

Personal information will come from different sources:

  • Public Health England
  • The individual cases and contacts
  • Third party organisations/settings (e.g. workplaces, schools, care homes, other local authorities)

The data will include some of the listed information. It will be kept to a minimum and only processed where it is appropriate to do so.

For an individual who has tested positive for COVID-19 (case):

  • Unique Record ID
  • Full name
  • Date of birth
  • Gender
  • Ethnicity
  • NHS number
  • Home postcode and house number
  • Telephone number and email address
  • Occupation/key worker type
  • COVID-19 symptoms, including when they started and their nature
  • Vulnerability group
  • Shielded status

For those who have been in close contact with someone who tests positive (contact):

  • Full name
  • Date of birth
  • Contact details
  • Ethnicity
  • NHS number
  • Home postcode and house number
  • Telephone number and email address
  • Occupation/key worker type
  • Details of any COVID-19 symptoms they may have had
  • Vulnerability group
  • Shielded status

How do we use your personal information?

Your information is used to provide advice on self-isolation and how to protect yourself and others from COVID-19. It will also help identify outbreaks which require support.

The Council is working with Public Health England to provide the local contact tracing service in response to the coronavirus pandemic.

Complex cases will be referred by Public Health England to the Cheshire West and Chester Council’s Local Contact Tracing Service. The personal information will be shared with the Council for the following reasons:

  • Enable contact tracers to call people who have tested positive with COVID-19 to offer advice and gather information about the people they may have come into close contact with and who may have been infected with the coronavirus
  • Enable contact tracers to manage the process of tracing these contacts to find out if they have any COVID-19 symptoms and if so, to provide advice on how to seek help
  • Enable the necessary sharing of personal information to third party organisations using minimum data
  • Enable the planning, management and containment of local outbreaks

Your information used for other purposes

Your information may also be used for different purposes that are not directly related to your health and care. These include:

  • Research into COVID-19
  • Planning of services or actions in response to COVID-19
  • Monitoring the progress and development of COVID-19

Whenever possible, information that does not directly identify you will be used for these purposes, but there may be times when it is necessary for your personal information to be used. Any releases of information that identify you will be lawful and the minimum necessary for that purpose.

Who else might we share your personal information with?

As Data Processor, Qwest are acting under the instruction of the Council and will be processing your personal information to deliver some of the Council’s Local Contact Tracing Services via its call centre. The Call Centre will be responsible for contacting individuals who have tested positive for COVID-19 and their Contacts. It is therefore necessary to share data received from Public Health England with Qwest for this purpose.

They are permitted to share your information in accordance with rules set by the Council which are designed to ensure that it will only take place where it is necessary to do so and will consider the minimum level of information that needs to be shared in each circumstance.

Your information will be treated with strict confidence and only disclosed where it is necessary to prevent a COVID-19 outbreak by investigating an establishment for potential contacts, the minimum amount of personal information will be shared if necessary, with:

  • Other Local Authorities to enable Officers to assist the establishment and provide advice to contacts
  • Sub-contractors to deliver support/advice in key sectors (e.g. care homes, education, prisons, housing)
  • We may need to disclose your name and the fact that you have tested positive to your employer or the operator of an institution where you have spent significant time if this is necessary to avoid or limit a COVID-19 outbreak in the workplace.

What is the legal basis for our use of your personal information?

The law on protecting personally identifiable information, known as the General Data Protection Regulation (GDPR), allows the Council to use the personal information collected for the purpose of Test and Trace (COVID-19).

The section of the GDPR that applies is:

  • Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’

As information about health is a special category of personal information, a further section of the GDPR applies:

  • Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare’
  • Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
  • Data Protection Act 2018 Schedule 1 Part 1 (4) - research

Separately, we have special permission from the Secretary of State for Health and Social Care to use confidential patient information for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health.

This is known as ‘section 251’ approval and includes using your test results if you test positive for coronavirus to start the contact-tracing process.

The part of the law that applies here is section 251 of the National Health Service Act 2006 and regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002.

Where will we store your information?

Your personal information is protected by us in a number of ways.

It is held on computer systems that have been tested to make sure they are secure, and which are kept up-to-date to protect them from viruses and hacking.

Your information can only be seen by Council’s Local Contact Tracing Services who have been specially trained to protect your privacy.

Strong controls are in place to make sure all these staff can only see the minimum amount of personal information they need to do their job.

We hold your information in the UK only.

No information that could identify you will ever be published by us.

How long will we keep your personal information?

The personal information will only be held as long as directed by the Department of Health and Social Care (DoHSC).

Read GOV.UK's Coronavirus COVID-19 Notice for more information.

If we need to use your information for research or reports, your information will be anonymised, and any information taken from notes (hand written or typed) during any consultation sessions will be securely destroyed.  The information will continue to be used in a summarised and anonymised form in any research reports or papers that are published. The anonymised information in the papers may be of historic interest and may be held in public archives indefinitely

Your rights

Under data protection law, you have rights including:

  • Your right of access - You have the right to ask us for copies of your personal information.
  • Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
  • Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
  • Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

To make a request follow the instructions on our Data protection for you page.

How to complain if you are unhappy about how your data is used

You can complain directly to our Data protection team online or by post:

  • Contact the DPO
  • By post: Data Protection Officer, 4 Civic Way, Ellesmere Port, CH65 0BE

You also have the right to complain to the Information Commissioner’s Office:

Will my personal information be accessible outside the UK?

Should the transfer of personal information outside of the UK become necessary, it will only take place if permitted by law, and then only where there are appropriate safeguards in place to protect the personal information.

Your information will be stored on servers within the UK.

Terms and conditions Privacy policy Cookies Contact