Test and Trace (public venue) privacy notice

What is this notice for?

This privacy notice explains how we collect and process your personal data in order to allow us to open certain venues in line with government requirements.

As part of the controlled opening of public places following the COVID-19 outbreak, certain venues are required to assist in the effective deployment of NHS Test and Trace in helping to identify and contain localised outbreaks. We do this by collecting certain data about both visitors to the venue and staff who work there.

We are required to:

• keep a temporary record of venue users/visitors for a period of 21 days
• provide relevant information to the NHS Test and Trace service if required for contact tracing and the investigation of local outbreaks

What personal data is being collected?

We collect the following information from individual visitors:

• name
• phone number
• date and time of visit

We also record staff and volunteer shift patterns (if not already recorded) in order to identify if staff have come into contact with identified visitors.

Who is processing your data?

We are the Data Controller for the information outlined in this privacy notice.

How we will use the information we hold about you?

Information will only be used if we are asked to provide the NHS Track and Trace service with the contact details of individuals who have identified with or may have been exposed to COVID-19.

This allows the Test and Trace service to:

• provide testing for anyone who has symptoms of COVID-19 to find out if they have the virus
• contact anyone who has had a positive test result to help them share information about any close recent contacts they have had; and
• alert those contacts, where necessary, to notify them that they need to self-isolate to help stop the spread of the virus

Who we will share your information with?

Individual visitor data will only be shared with the NHS Test and Trace system and will not be shared with any other party. This will be shared:

• on request should NHS Track and Trace identify an individual who has attended a venue and been tested as positive for COVID-19, we will then provide details of contact information for staff and individuals who may have come into contact with the individual
• we will contact the NHS Track and Trace service should a service user who has attended a venue inform us that they have tested positive for COVID-19 to provide them with details of staff and individuals who may have come into contact

We will not share your information with anyone else unless required to do so under additional legal requirements, for example to assist the government in containing the spread of Covid-19. This may be where we are required to do so by law, to safeguard public safety, and in risk of harm or emergency situations.

NHS COVID-19 app users can now share their venue history via the app with public health authorities if they test positive for coronavirus (COVID-19). This will be used to help other visitors to the venue to be warned that they may be at risk if multiple visitors have tested positive since visiting the venue. Venue names and details will not be shared in these alerts.

How long will my personal data be retained?

We will only keep your contact information for 21 days in order to respond to NHS Test and Trace data requests. Staff shift and attendance records will be kept in line with our corporate retention schedule.

What is your lawful basis for processing your personal data?

The General Data Protection Regulation requires specific conditions to be met to ensure that the processing of personal data is lawful. These relevant conditions are:

• Article 6(1)(c) – Legal Obligation in that we have a legal obligation under the Health and Safety at Work Act 1974 to ensure the safety of both staff and visitors.
• Article 6(1)(e) – Public task in that we are required to carry out the task in our role as a public authority.
• Where a visitor notifies us of a positive test for COVID-19 we will share this data with the NHS Test and Trace service as qualified by the Data Protection Act 2018 Schedule 10(2) and Schedule 1 Part1 Paragraph 3 and the Data Protection Act 2018 Schedule 10(3) and Schedule 1 Part2 Paragraph6(2)(a).

Your rights

If you are not happy about the way your personal data is being processed you can complain directly to our Data Protection team online: Contact the DPO

You also have the right to complain to the Information Commissioner’s Office.

• Information Commissioner's Office (ICO) website
• By post: The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone: 08456 30 60 60 or 01625 54 57 45