Contact Tracing

Privacy Notice

INTRODUCTION

In England, the easing of social and economic lockdown measures following the COVID-19 outbreak is being supported by NHS Test and Trace. This service aims to rapidly identify people who have come into close contact with a new COVID-19 case, and where necessary, notify them that they need to follow Government guidance on how to self-isolate to help stop the spread of the virus. This process is known as 'contact tracing'.

The University is supporting the NHS Test and Trace service. We are also helping to maintain the safety and wellbeing of our campus community by asking those who show symptoms, or who have been identified as a Contact and informed to self-isolate, to tell us as soon as possible (via this form). We will use that information within specific areas of the University when strictly necessary, to help limit the potential spread of the disease and help us to provide you with support.

We will share information with NHS Test and Trace via the Public Health England – Health Protection Team and Norfolk Public Health, only where it is necessary for contact tracing or Public Health management of COVID-19 cases, either because someone who has tested positive for COVID-19 has listed UEA as a place they visited recently, or because UEA has been identified as the location of a potential local outbreak of COVID-19.

All this means we will be collecting new personal information or using existing data in a new way. This notice explains how we (UEA) will use personal data for contact tracing purposes.

 

 

WHO DOES THIS NOTICE APPLY TO?

This notice applies to any person whose contact details we collect, access, or share for the purposes of contact tracing and / or provision of support. This includes UEA students and employees, and may apply to some customers or visitors to UEA services that are open to the public - for example the Sportspark, the Sainsbury Centre for Visual Arts, or our catering outlets. 

In the areas where contract tracing is being supported we will where possible, also put up printed notices at till points and reception areas or similar. 

This notice relates specifically to the use of personal data or contact tracing purposes. Other privacy notices are provided for staff, students and other groups.

 

WHAT INFORMATION DO WE USE AND WHY?

The University is following government advice and will collect and use only the following information for the purposes of contact tracing.


UEA employees

  • the names of staff who work at the premises
  • School / Department
  • a contact e-mail address for each member of staff
  • a contact phone number for each member of staff
  • campus card number
  • the dates and times that staff are at work. We may obtain this information from swipe card records
  • location(s) visited on campus. We may obtain this information from swipe card records
  • if you are experiencing symptoms of Covid-19 and the date of onset
  • If you have had a Covid-19 test, the date of the test and the result (if known)
  • If you are self-isolating

UEA students

  • name
  • School / Department
  • email address and campus card number
  • student number
  • date of birth
  • mobile phone number 
  • the dates and times that students are on campus. We may obtain this information from swipe card records
  • If a student will interact with only one member of staff, we will record the name of the assigned staff member alongside the name of that student
  • location(s) visited on campus. We may obtain this information from swipe card records
  • if you are experiencing symptoms of Covid-19 and the date of onset
  • if you have had a Covid-19 test, the date of the test and the result (if known)
  • if you are self-isolating
  • if you are living in student accommodation on campus, the location of your room. Otherwise, the first line of your address and postcode

Customers and visitors to the UEA campus

  • the name of the customer or visitor
  • if there is more than one person, we may record the name of the ‘lead member’ of the group, and the number of people in the group
  • a contact phone number for each customer or visitor, or for the lead member of a group of people
  • date of visit, arrival time and, where possible, departure time
  • location(s) visited on campus
  • if a person will interact with only one member of staff, we will record the name of the assigned staff member alongside the name of that person

WHERE DOES OUR INFORMATION COME FROM?

We will collect the information described above either directly from you (for example if you visit one of our catering outlets and 'sign in'), or via the University’s Covid-19 Notification Form (if you are a member of staff or a student), or via existing data sources used by the University. For example, if you are a UEA student we will already hold information on the classes you are registered for / have attended. We may also re-use information collected from swipe cards or other technology in order to ascertain locations you have visited on campus during a certain timeframe.

If you have used the University's testing facility and tested positive, the testing facility will share limited contact details with the University's Safety Services so we can provide you with support and work to limit the spread of the virus.

Please note: we do not have access to the data collected by the NHS Covid-19 app.

HOW WE WILL USE YOUR INFORMATION

Individuals who are symptomatic and those who have tested positive for Covid-19

As soon as you notify us via the University’s Covid-19 Notification form, or you have a positive test result from the University's own testing facility, information will be shared with limited and specific members of University staff who need your details in order to identify individuals on campus that you may have had contact with, in the period spanning 48 hours prior to you experiencing symptoms up until the day you self-isolate.

All staff and students:

Your information will also be shared with certain members of staff in order to provide you with support.

All students: we will share basic contact details (as listed above) of all registered students with Norfolk Public Health to enable them to cross reference data on positive cases, inform their risk assessments, and manage COVID-19 cases in the University community. 

Students in accommodation on campus: In addition to the above, your information will also be shared with certain members of staff so that where appropriate, certain services such as cleaning and essential maintenance can be suspended or instigated, and welfare services can put measures in place in order to keep those staff safe whilst you are self-isolating.

Contacts of individuals who have tested positive for Covid-19

If you have been identified as a contact, either by completion of the University's Covid-19 Notification form, by the NHS Test and Trace service, or by the Public Health England – Health Protection Team, your information will be shared with certain members of staff in order to provide you with support.

Please note: we do not have access to the data collected by the NHS Covid-19 app.

Students in accommodation on campus: In addition to the above, your information will also be shared with certain members of staff so that, where appropriate, certain services such as cleaning and essential maintenance can be suspended or instigated, and welfare services can put measures in place in order to keep those staff safe whilst you are self-isolating.

WHEN WE WILL SHARE YOUR INFORMATION WITH OTHERS

In order to help reduce the spread of infection, we will sometimes need to share your information outside the University. We recognise the importance of keeping health data secure, so will only share the minimum required information, only for contact tracing purposes and to assist local Public Health Officers in identifying and managing COVID-19 cases.

Individuals who are symptomatic and those who have tested positive for Covid-19

The information you provide via the University’s Covid-19 Notification Form will be shared with the NHS Test and Trace service, so that they may contact you to initiate their tracing protocols, which will help identify any individuals that you may have had contact with (in the same time period as above) who were off campus.

Individuals who have not notified the University of COVID-19 symptoms or positive result

If we are notified by the NHS Test and Trace service or by Public Health England of any individual who has tested positive, or about whom they require further information for test and trace purposes, we will share with them the contact tracing information we hold.

All students

We will share basic contact details (as listed above) of all registered students with Norfolk Public Health to enable them to cross reference data on positive cases, inform their risk assessments, and manage COVID-19 cases in the University community. 

HOW LONG WE KEEP YOUR INFORMATION

To support NHS Test and Trace, the University needs to hold records for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional seven days to allow time for testing and tracing.

After 21 days, we will securely disposed of or delete any records that have been collected specifically for this purpose.

Where we are repurposing existing personal data for the purposes of contact tracing, for example membership records in the Sportspark, we will continue to use data for the original purposes as set out in the relevant privacy notice, and in line with our existing records retention policies.

LEGAL BASIS FOR USING YOUR DATA

The lawful basis we are relying on to process your personal data as described above is article 6(1)(f) of the GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests pursued by the University. We will aim to complete a Legitimate Interests Assessment for this activity as soon as time allows. If you would like to see this document, contact dataprotection@uea.ac.uk

Our processing of information about your health will be based on Article 9(2)(i), which relates to public health purposes, and Schedule 1, Part 1 (3) of the DPA 2018.  

CONTACT

If you are a University student or employee, contact covidsecure@uea.ac.uk in the first instance.

Several areas of the University that are open to the public will be collecting records of their customers and visitors for the purpose of supporting NHS Test and trace. If you have any concerns about this process or how it is conducted, please speak to a senior member of staff in that specific area in the first instance. 

For any queries about our use of your personal data, contact dataprotection@uea.ac.uk. Further details are in the link below. 

YOUR RIGHTS, CONCERNS AND COMPLAINTS, FURTHER INFORMATION

We have published further data protection information on the University’s Data Protection webpages

CHANGES TO THIS NOTICE

This privacy notice was written in September 2020 and last updated to version 3 on 13 October, to include details of sharing student contact details with Norfolk Public Health, and to make clear that positive test result data will be shared from the Univeristy's testing facility to the University's Safety Services.

v.2 changes were made to reflect potential sharing of positive test results from the University's Covid-19 testing facility, to improve our explanation of the actions we will take, and to add links to the Covid-19 notification form.

If we need to make further changes to this notice, we will publish them here, explaining what has changed since the previous version.