Privacy: Test and Trace

Essex County Council is working with Public Health England, Southend Borough Council and other Local Authorities and third party organisations to deliver the local Essex County Council and Southend Contact Tracing Service.

For the rapid-turnaround lateral flow (COVID-19) testing service in Essex, Essex County Council is working with the Department of Health and Social Care. Read more information on GOV.UK.

This privacy notice explains what personally identifiable is collected by Essex County Council (ECC). It also explains how this information is used, how it is protected, how long it is kept, who it is shared with, who shares it with us, what your rights are, and how you can find out more.

Read the NHS's privacy notice on how they are handling your information for Test and Trace.

What is test and trace?

COVID-19 is an infectious disease affecting the whole of the country. The virus that causes COVID-19 is a coronavirus. Infectious diseases present a serious and ongoing threat to public health. If not controlled, they can infect large numbers of people and, depending on the disease and other factors, can result in ill-effects ranging from relatively minor symptoms to early death.

Contact tracing is an important way of controlling the spread of infectious diseases. It involves identifying and tracing all the people who have been in contact with a person who has been infected. Depending on the nature and duration of the contact, these contacts may require advice or treatment to prevent the disease spreading further.

What personal information do we hold?

To trace the contacts of people with COVID-19 and support the Essex County Council and Southend Contact Tracing Service, Essex County Council needs to collect personally identifiable information. To ensure that you have confidence in providing your personal information over the telephone, all call handlers will be calling on behalf of Essex County Council and Southend Contact Tracing Service and will state this at the start of each call.

To check whether the call is genuine, our local contact tracers will only call you from this number:

• 01245 904033

You can call us back on this number, or 0300 303 2698 or email provide.escontacttracing@nhs.net to check the call is genuine.

Personal information will come from different sources:

• Public Health England
• The individual cases and contacts
• Third party organisations/settings (e.g. workplaces, schools, care homes, other local authorities)

The data will include some of the listed information. It will be kept to a minimum and only processed where it is appropriate to do so.

For an individual who has tested positive for COVID-19 (Case):

• Unique Record ID
• Full name
• Date of birth
• Gender
• Ethnicity
• NHS number
• Home postcode and house number
• Telephone number and email address
• Occupation/key worker type
• COVID-19 symptoms, including when they started and their nature
• Vulnerability group
• Shielded status

For those who have been in close contact with someone who tests positive (contact):

• Full name
• Date of birth
• Contact details
• Ethnicity
• NHS number
• Home postcode and house number
• Telephone number and email address
• Occupation/key worker type
• Details of any COVID-19 symptoms they may have had
• Vulnerability group
• Shielded status

How do we use your personal information?

This information is used to provide advice on self-isolation and how to protect themselves and others from COVID-19. It will also help identify outbreaks which require support.

Essex County Council is working with Public Health England to provide the local contact tracing service in response to the coronavirus pandemic (Essex County Council and Southend Contact Tracing Service). Complex cases will be referred by Public Health England to the Essex County Council and Southend Contact Tracing Service. The personal information will be shared with the Essex County Council and Southend Contact Tracing Service for the following reasons:

• Enable contact tracers to call people who have tested positive with COVID-19 to offer advice and gather information about the people they may have come into close contact with and who may have been infected with the coronavirus
• Enable contact tracers to manage the process of tracing these Contacts to find out if they have any COVID-19 symptoms and if so, to provide advice on how to seek help
• Enable the necessary sharing of personal information to third party organisations using minimum data
• Enable the planning, management and containment of local outbreaks
• Enable the Districts and Boroughs to assist with tracking deliver their statutory Environmental Health/Food Safety obligations
• Enable contact tracers to send you the link to Commisceo’s Lateral Flow Test booking site
• Enable the evaluation of your customer experience providing you opt in.

Who else might we share your personal information with?

As Data Processor, Provide CIC, are acting under the instruction of Essex County Council (on behalf of itself and Southend Borough Council) and will be processing your personal information to deliver the Essex County Council and Southend Contact Tracing Service call centre. The Call Centre will be responsible for contacting individuals who have tested positive for COVID-19 and their Contacts. It is therefore necessary to share data received from Public Health England with Provide CIC for this purpose.

They are permitted to share your information in accordance with rules set by the local authorities which are designed to ensure that it will only take place where it is necessary to do so and will consider the minimum level of information that needs to be shared in each circumstance.

Your information will be treated with strict confidence and only disclosed where it is necessary to prevent a COVID-19 outbreak by investigating an establishment for potential Contacts, the minimum amount of personal information will be shared if necessary with:

• Other Local Authorities to enable Environmental Health Officers to assist the establishment and provide advice to contacts
• Sub-contractors to deliver support/advice in key sectors (e.g. care homes, education, prisons, housing)
• We may need to disclose your name and the fact that you have tested positive to Your employer or the operator of an institution where you have spent significant time if this is necessary to avoid or limit a COVID-19 outbreak in the workplace.

Your information used for other purposes

Your information may also be used for different purposes that are not directly related to your health and care. These include:

• Research into COVID-19
• Planning of services or actions in response to COVID-19
• Monitoring the progress and development of COVID-19
• Evaluating both Lateral Flow testing and PCR in response to COVID-19

Whenever possible, information that does not directly identify you will be used for these purposes, but there may be times when it is necessary for your personal information to be used. Any releases of information that identify you will be lawful and the minimum necessary for that purpose.

Who is the Data Controller for this processing?

Essex County Council is the Data Controller for this processing. In order to provide this service effectively our main data processor will be Provide CIC who are managing the Call Centre.

Provide CIC and its sub-contractors are only permitted to use information collected as instructed by Essex County Council.

Read more about Provide.

Commisceo is a data processor managing the booking system for the COVID-19 testing service.

Read more about Commisceo.

How your information is protected

Access to the information is restricted to those parties where it is necessary to carry out their function and where it is appropriate personal information will be shared with third party organisations responsible for providing support services as part of the response to the coronavirus pandemic. All sharing will be carried out securely.

Staff will complete the necessary training including their responsibilities for protecting confidentiality and sharing where it is appropriate.

How long will we keep your personal information?

The personal information will only be held as long as directed by the Department of Health and Social Care (DoHSC).

Read GOV.UK's Coronavirus COVID-19 Notice for more information.

What is the legal basis for our use of your personal information?

The law on protecting personally identifiable information, known as the General Data Protection Regulation (GDPR), allows Essex County Council to use the personal information collected for the purpose of Test and Trace (COVID-19).

The section of the GDPR that applies is:

• Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’

As information about health is a special category of personal information, a further section of the GDPR applies:

• Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare’

Your rights

The law gives you a number of rights to control what personal information is used by us and how it is used by us.

You can obtain further information about these rights from the Information Commissioner’s Office.

You also have the right to lodge a complaint in relation to this summary notice, the full privacy notice or our processing activities with the Information Commissioner’s Office.

Contact us

If you wish to exercise any of these rights, you can contact our Data Protection Officer.

Or the transparency team for access to the information held by Essex County Council.