‘Test and Trace’ managing data in times of Covid-19

Please note: the information contained in this legal update is correct as of the original date of publication.

As schools reopen for pupils and staff, a number of questions are being raised concerning steps that must be taken should an individual who has been on the school site be confirmed positive for Coronavirus.

In particular, there have been concerns raised about what information should be collected about visitors to the school site and what information should be shared with other agencies, such as NHS Test and Trace, and the legal basis for doing so under Data Protection requirements.

Guidance from the Department of Health and Social Care has been issued to other sectors outside of Education, including Hospitality and Tourism, as to what support NHS Test and Trace can provide in locating those who may have been exposed to the virus. Whilst this is not directed at education providers specifically, as schools record the attendance of pupils and staff etc., it is a useful approach to manage the information of visitors to your premises. Many schools following risk assessments are limiting visitors on to the school site at any one time, but where it is necessary a system to record their contact details should be adopted alongside your usual approach of recording data of their attendance, including time of visit and organisation details.

Where information is being collected from visitors, you will need to inform them as to the purpose for which you are collecting the data and who you will share it with (if necessary), i.e. NHS Test and Trace. This could be done by sharing a notice with them as they complete the visitor log-in system that you use.

Something to the following effect could be used:

As a visitor to [enter school name], we are required to request the following details from you for the purposes of safeguarding and health and safety. However, in addition, in the current climate we also require your immediate contact details, in the event that anyone at the school tests positive for Coronavirus within the next 21 days. In this instance we may be asked for the information you have provided to us by Government or health agencies such as NHS Test and Trace for the purposes of locating and advising those who may be at risk or be may be required to self-isolate. We would be sharing this information for such purposes under the legitimate interest basis, and we would therefore not require your consent. Further information about how we manage personal data can be found on our website at [enter website link].

You should also revisit your privacy notices (for students and staff) and ensure that these cover the sharing of their details with agencies such as NHS Test and Trace in the interests of public health. On this basis it would not be necessary to seek the consent of the individuals to then process the data and share it for the purposes of Test and Trace should this become necessary.

For further information about managing personal data on your site, please contact us.