Contact tracing information for NHS Test and Trace - privacy notice

Privacy Notice - How we use your information

Calderdale Council of Town Hall, Crossley Street, Halifax, HX1 1UJ is registered with the Information Commissioners Office (ICO) under the provision of the Data Protection Act 2018. The Council takes its responsibilities under the Act very seriously.

This privacy notice describes how we may use your information during the Covid-19 outbreak.

To support NHS Test and Trace (which is part of the Department for Health and Social Care) in England, Calderdale Metropolitan Borough Council (CMBC) has decided to collect and keep a limited record of staff, customers and visitors who come onto our premises for the purpose of contact tracing. By maintaining records of staff, customers and visitors, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to the Coronavirus.

Calderdale MBC will be the data controller for the data obtained at the point it is collected from the individual. If any information is passed to the Department of Health and Social Care (DHSC), the DHSC will become the data controller for at the point it receives it from us.

The type of personal information collected

• Name (or for a group of people, the lead party member’s name).
• Telephone number.
• Date and time of arrival and departure (if available).

If you are an employee of Calderdale Council, information which is already held via existing recording methods regarding your attendance in a building will be used to share the above personal information for NHS Test and Trace purposes.

Sharing your information

We will share this information with NHS Test and Trace for the purpose of contact tracing if it is specifically requested from us.

We will not share your information with any other third party unless we are required to do so by law.

The lawful basis for CMBC processing your data information

• Article 6(1)(e) - Processing is necessary for the performance of a public task or in the exercise of official authority vested in the controller.

How long we will keep your information

Test and Trace information collected locally by CMBC will be retained 21 days from the date of your visit as directed by NHS Test and Trace. All data collected purely for contract tracing purposes will then be securely destroyed.

Your rights

The GDPR provides the following rights for individuals. Not all rights are absolute and therefore will only apply in certain circumstances:

1. The right to be informed.
2. The right of access.
3. The right to rectification.
4. The right to erasure.
5. The right to restrict processing.
6. The right to data portability.
7. The right to object.
8. Rights in relation to automated decision making and profiling.

You also have the right to complain to the Data Protection Officer if you feel that your data has not been handled in accordance with the law. You can contact the Council’s Data Protection Officer at information.management@calderdale.gov.uk. You also have the right to lodge a complaint with the Information Commissioner’s Office.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Please contact us at information.management@calderdale.gov.uk if you wish to make a request.