Kent Local Tracing Partnership privacy notice
Infectious diseases present a serious and ongoing threat to public health. If not controlled, they can infect large numbers of people and, depending on the disease and other factors, can result in ill-effects ranging from relatively minor symptoms to early death.
COVID-19 disease is caused by a coronavirus that can lead to a severe acute respiratory syndrome (breathing difficulties). We are currently in a COVID-19 pandemic, meaning this viral disease is affecting the world and in particular the UK has had a widespread epidemic of this illness.
Contact tracing is an important way of controlling the spread of infectious diseases. It involves identifying and tracing all the people who have been in contact with a person who has been infected. Depending on the nature and duration of the contact, these contacts may require advice or treatment to prevent the disease spreading further.
NHS Test and Trace is a national programme that was set up to address the COVID-19 pandemic and aims to ensure that anyone who develops symptoms of coronavirus can be tested quickly and the relevant close contacts of positive individuals notified so that they know they must self-isolate. The programme can also offer support and advice to help stop the spread of the virus.
The council is helping NHS Test and Trace by contacting Kent residents who have tested positive for the virus to ask them about their close contacts and places they have visited recently. Kent County Council will use information provided by NHS Test and Trace or collected locally.
This privacy notice explains how Kent County Council (KCC) uses your data for purposes related to contact tracing as part of the national response to COVID-19 (Coronavirus). This privacy notice explains what personally identifiable information is collected by KCC, how this information is used, how it is protected, how long it is kept, who it is shared with, who shares it with us, what your rights are, and how you can find out more. Read Public Health England's privacy notice on how they are handling your information for Test and Trace.
KCC is working with Public Health England, borough and district councils and trusted partner organisations to deliver the Kent Local Tracing Partnership.
Who will be using your data and how we will obtain it
Kent County Council (KCC) and Public Health England are joint data controllers for the personal data you provide to us. KCC works in partnership with Agilisys to provide call centre operations. Agilisys will manage the call centre for the Kent Local Tracing Partnership and will be the main data processor. Agilisys are only permitted to use information collected as instructed by KCC's Public Health Team.
This information is used to provide advice to residents who have had a positive COVID-19 test on self-isolation and how to protect themselves and others. It will also help identify outbreaks which require further Public Health support.
KCC is working with Public Health England to provide the local contact tracing service in response to the coronavirus pandemic. Various cases will be referred by Public Health England to the Kent Local Tracing Partnership. The personal information will be shared with KCC to enable:
- contact tracers to call people who have tested positive with COVID-19 to offer advice and gather information about the people they may have come into close contact with and who may have been infected with the coronavirus
- the necessary sharing of personal information with trusted partner organisations using minimum data
- the planning, management, and containment of local outbreaks.
Personal information we collect and use
The council may hold the following data related to individuals who have tested positive for COVID-19:
- unique record ID
- full name
- date of birth
- gender
- ethnicity
- NHS number
- home address
- contact details such as telephone numbers and email addresses
- occupation/key worker type
- COVID-19 symptoms, including when they started and their nature
- test centre and pillar
- vulnerability group
- shielded status.
Data will be kept to a minimum and only processed where it is appropriate to do so.
The council will also create and maintain records of telephone calls and other contacts with individuals made for the purposes of contact tracing, records of links between individuals, and records of venues and other locations where individuals may have been involved in close contact with others, including the dates and times.
In some cases the council may match your data with information from other locally held datasets, such as Council Tax and social care records, in order to improve the quality of contact tracing data and effectiveness of contact tracing processes and to help us identify people that might need additional support.
We will not share or use your information for other purposes unless we have a legal obligation to do so.
Special category personal data
The personal data held by the council includes some ‘special category’ or sensitive data. Data related to the health or ethnicity of individuals is special category data.
Why we use your data
The council will use your personal data to:
- contact individuals who have tested positive with COVID-19 to offer advice and gather information about other people they may have been in close contact with and who may have been infected with the virus
- support individuals to self-isolate when they are required to do so and, when in the interest of public health, support enforcement agencies to uphold regulations on self-isolation.
The council will also use your personal data to:
- plan for, identify, manage, and contain local outbreaks of the virus
- support research into COVID-19, including analysis and modelling of the progress and development of the virus locally and nationally
- enforce COVID-secure measures at a variety of settings and venues; and
support planning of services and actions in response to COVID-19.
Where possible the council will aggregate or de-identify your data when it is used for purposes that do not require you to be identifiable as an individual.
Legal basis that allows us to use your data
The law on protecting personally identifiable information, known as the General Data Protection Regulation (GDPR), allows KCC to use the personal information collected for the purpose of Test and Trace (COVID-19).
The Council’s processing of personal data for the purposes described above is on the lawful basis of public task in Article 6(1)(e) in the General Data Protection Regulation (GDPR): processing is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority”.
The Council’s processing of health information and other special category data for those purposes is based on the condition in Article 9(2)(i) of GDPR: processing is “necessary for reasons of public interest in the area of public health”, as supplemented by Schedule 1 Part 1 (3) of the Data Protection Act 2018.
Other lawful bases such as legal obligation may also apply in some situations.
Directions from the Secretary of State under Regulation 3 (4) in the Health Service (Control of Patient Information) Regulations 2002 create an exception to the common law duty of confidentiality that would otherwise restrict sharing of confidential patient information for purposes unrelated to direct care.
Who we share your personal data with
The council will share your data with NHS Test and Trace. As data processor, Agilisys, are acting under the instruction of KCC and will be processing your personal information to deliver the Kent Local Tracing Partnership. Agilisys will be responsible for contacting individuals who have tested positive for COVID-19. It is therefore necessary to share data received from Public Health England with Agilisys for this purpose. They are permitted to share your information in accordance with rules which are designed to ensure that it will only take place where it is necessary to do so and will consider the minimum level of information that needs to be shared in each circumstance.
We will also share your data with boroughs and districts when necessary to ensure a co-ordinated local response to COVID-19.
We will ensure we only share your data with organisations that the council trusts and that will comply with data protection law. Where possible the council will aggregate or de-identify your data when it is shared for purposes that do not require you to be identifiable as an individual.
In order to look after your care needs, we may share your personal information with other care providers. We will also be required to share personal information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak.
How long your personal data will be kept
We will only keep your personal data for as long as is necessary for the purposes for which we are processing it, unless we are under a legal obligation or have another legitimate reason for keeping it longer.
It is not possible at this stage to estimate the duration of the pandemic or how long the Council may need to keep your data. We will take account of guidance from the Government to ensure a co-ordinated approach with other organisations.
We anticipate the Council will not need to retain data collected for the purposes of contact tracing beyond the period necessary for local involvement in response to COVID-19, if the same data has been shared with NHS Test and Trace. Public Health England’s privacy notice currently states that it will keep data related to individuals who test positive for COVID-19 for up to eight years and data related to close contacts for up to five years. You can also read GOV.UK's Coronavirus COVID-19 notice for more information.
Personal data held by the Council will be securely deleted or destroyed once we no longer have a legitimate reason to keep it.
Your rights
You have a number of rights that you may exercise in relation to your personal data. Some of the rights do not apply automatically and may not be available in certain circumstances where a lawful exception applies.
You have a right to:
- access your personal data. You can request a copy of the personal data that we hold about you and ask us to explain how we use your data.
- object to processing of your personal data. You have an absolute right to stop your data being used for direct marketing. In other cases where the right to object applies, we may be able to continue using your data if we have a compelling reason for doing so.
- request the restriction or suppression of your personal data.
- have your personal data erased, if we no longer have a legitimate use for it. This right is sometimes called the ‘right to be forgotten’.
- rectification of your personal data if the information we hold in relation to you is inaccurate or incomplete.
- not to be subject to any decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. You can request human intervention or challenge any solely automated decision-making that significantly affects you.
Contact
Please contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.
You can contact our Data Protection Officer, Benjamin Watts, at dpo@kent.gov.uk, or write to: Data Protection Officer, Sessions House, Maidstone, Kent ME14 1XQ.
GDPR also gives you right to lodge a complaint with a supervisory authority. The supervisory authority in the UK is the Information Commissioner who may be contacted on 0303 123 1113.