Contact Tracing

Privacy Notice

INTRODUCTION

In England, the easing of social and economic lockdown measures following the COVID-19 outbreak is being supported by NHS Test and Trace. This service aims to rapidly identify people who have come into close contact with a new COVID-19 case, and where necessary, notify them that they must self-isolate to help stop the spread of the virus. This process is known as 'contact tracing'.

The University is supporting the NHS Test and Trace service. We are also helping to maintain the safety and wellbeing of our campus community by asking those who show symptoms to tell us as soon as possible (via this form). We will use that information within specific areas of the University when strictly necessary, to help limit the potential spread of the disease and help us to provide you with support.

We will share information with NHS Test and Trace via the Public Health England – Health Protection Team, only where it is necessary for contact tracing, either because someone who has tested positive for COVID-19 has listed UEA as a place they visited recently, or because UEA has been identified as the location of a potential local outbreak of COVID-19.

All this means we will be collecting new personal information or using existing data in a new way. This notice explains how we (UEA) will use personal data for contact tracing purposes.

 

 

WHO DOES THIS NOTICE APPLY TO?

This notice applies to any person whose contact details we collect, access, or share for the purposes of contact tracing. This includes UEA students and employees, as well as some customers or visitors to UEA services that are open to the public - for example the Sportspark, the Sainsbury Centre for Visual Arts, or our catering outlets. 

In the areas where contract tracing is being supported we will where possible, also put up printed notices at till points and reception areas or similar. 

This notice relates specifically to the use of personal data or contact tracing purposes. Other privacy notices are provided for staff, students and other groups.

 

WHAT INFORMATION DO WE USE AND WHY?

The University is following government advice and will collect and use only the following information for the purposes of contact tracing.


UEA employees

  • the names of staff who work at the premises
  • a contact e-mail address for each member of staff
  • a contact phone number for each member of staff
  • campus card number
  • the dates and times that staff are at work. We may obtain this information from swipe card records
  • location(s) visited on campus. We may obtain this information from swipe card records
  • if you are experiencing symptoms of Covid-19 and the date of onset
  • If you have had a Covid-19 test, the date of the test and the result (if known)
  • If you are self-isolating

UEA students

  • name
  • email address and campus card number
  • mobile phone number 
  • the dates and times that students are on campus. We may obtain this information from swipe card records
  • If a student will interact with only one member of staff, we will record the name of the assigned staff member alongside the name of that student
  • location(s) visited on campus. We may obtain this information from swipe card records
  • if you are experiencing symptoms of Covid-19 and the date of onset
  • If you have had a Covid-19 test, the date of the test and the result (if known)
  • If you are self-isolating
  • If you are living in student accommodation on campus, the location of your room

Customers and visitors to the UEA campus

  • the name of the customer or visitor
  • if there is more than one person, we may record the name of the ‘lead member’ of the group, and the number of people in the group
  • a contact phone number for each customer or visitor, or for the lead member of a group of people
  • date of visit, arrival time and, where possible, departure time
  • location(s) visited on campus
  • if a person will interact with only one member of staff, we will record the name of the assigned staff member alongside the name of that person

WHERE DOES OUR INFORMATION COME FROM?

We will collect the information described above either directly from you (for example if you visit one of our catering outlets and 'sign in'), or via the University’s Covid-19 Notification Form (if you are a member of staff or a student), or via existing data sources used by the University. For example, if you are a UEA student we will already hold information on the classes you are registered for / have attended. We may also re-use information collected from swipe cards or other technology in order to ascertain locations you have visited on campus during a certain timeframe.

HOW WE WILL USE YOUR INFORMATION

Individuals who are symptomatic and those who have tested positive for Covid-19

As soon as you notify us via the University’s Covid-19 Notification form, this information will be shared with limited and specific members of University staff who need your information in order to identify individuals on campus that you may have had contact with, in the period spanning 48 hours prior to you experiencing symptoms up until the day you self-isolate.

All staff and students: Your information will also be shared with certain members of staff in order to provide you with support.

Students in accommodation on campus: In addition to the above, your information will also be shared with certain members of staff so that where appropriate, certain services such as cleaning and non-essential maintenance can be suspended, and welfare services can put measures in place in order to keep those staff safe whilst you are self-isolating.

Contacts of individuals who have tested positive for Covid-19

If you have been identified as a contact, either via the University form, by the NHS Test and Trace service, or by the Public Health England – Health Protection Team, your information will be shared with certain members of staff in order to provide you with support.

Students in accommodation on campus: In addition to the above, your information will also be shared with certain members of staff so that, where appropriate, certain services such as cleaning and non-essential maintenance can be suspended, and welfare services can put measures in place in order to keep those staff safe whilst you are self-isolating.

WHEN WE WILL SHARE YOUR INFORMATION WITH OTHERS

In order to help reduce the spread of infection, we will sometimes need to share your information outside the University. We recognise the importance of keeping health data secure, so will only share the minimum required information, and only for contact tracing purposes.

Individuals who are symptomatic and those who have tested positive for Covid-19

The information you provide via the University’s Covid-19 Notification Form will be shared with the NHS Test and Trace service, so that they may contact you to initiate their tracing protocols, which will help identify any individuals that you may have had contact with (in the same time period as above) who were off campus.

Individuals who have not notified the University of COVID-19 symptoms or positive result

If we are notified by the NHS Test and Trace service or by Public Health England of any individual who has tested positive, or about whom they require further information for test and trace purposes, we will share with them the contact tracing information we hold.

HOW LONG WE KEEP YOUR INFORMATION

To support NHS Test and Trace, the University needs to hold records for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional seven days to allow time for testing and tracing.

After 21 days, we will securely disposed of or delete any records that have been collected specifically for this purpose.

Where we are repurposing existing personal data for the purposes of contact tracing, for example membership records in the Sportspark, we will continue to use data for the original purposes as set out in the relevant privacy notice, and in line with our existing records retention policies.

LEGAL BASIS FOR USING YOUR DATA

The lawful basis we are relying on to process your personal data as described above is article 6(1)(f) of the GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests pursued by the University. We will aim to complete a Legitimate Interests Assessment for this activity as soon as time allows. If you would like to see this document, contact dataprotection@uea.ac.uk

Our processing of information about your health will be based on Article 9(2)(i), which relates to public health purposes, and Schedule 1, Part 1 of the DPA 2018. Appropriate Policy documentation will be produced as soon as possible and published here. 

CONTACT

If you are a University student or employee, contact covidsecure@uea.ac.uk in the first instance.

Several areas of the University that are open to the public will be collecting records of their customers and visitors for the purpose of supporting NHS Test and trace. If you have any concerns about this process or how it is conducted, please speak to a senior member of staff in that specific area in the first instance. 

For any queries about our use of your personal data, contact dataprotection@uea.ac.uk. Further details are in the link below. 

YOUR RIGHTS, CONCERNS AND COMPLAINTS, FURTHER INFORMATION

We have published further data protection information on the University’s Data Protection webpages

CHANGES TO THIS NOTICE

This privacy notice was written in September 2020 and is version 1. If we need to make changes to this notice, we will publish them here, explaining what has changed since the previous version.