Introduction
In England, the easing of social and economic lockdown measures following the COVID-19 outbreak is being supported by NHS Test and Trace. This service aims to rapidly identify people who have come into close contact with a new COVID-19 case, and where necessary, notify them that they need to follow Government guidance on how to self-isolate to help stop the spread of the virus. This process is known as 'contact tracing'.
The University is supporting the NHS Test and Trace service. We are also helping to maintain the safety and wellbeing of our campus community by asking those who show symptoms, or who have been identified as a Contact and informed to self-isolate, to tell us as soon as possible (via this form). We will use that information within specific areas of the University when strictly necessary, to help limit the potential spread of the disease, help us to provide you with support, and to maintain good order in the University community.
We will share information with NHS Test and Trace via Public Health England – Health Protection Team and Norfolk Public Health, to assist with contact tracing or Public Health management of COVID-19 cases, either because someone who has tested positive for COVID-19 has listed UEA as a place they visited recently, or because UEA has been identified as the location of a potential local outbreak of COVID-19.
All this means we will be collecting new personal information or using existing data in a new way. This notice explains how we (UEA) will use personal data for contact tracing purposes.
Who does this notice apply to?
This notice applies to any person whose contact details we collect, access, or share for the purposes of contact tracing and / or provision of support. This includes UEA students and employees, and may apply to some customers or visitors to UEA services that are open to the public - for example the Sportspark, the Sainsbury Centre, or our catering outlets.
In the areas where contract tracing is being supported we will where possible, also put up printed notices at till points and reception areas or similar.
This notice relates specifically to the use of personal data for contact tracing and Covid related support purposes. Other privacy notices are provided for staff, students and other groups.
What information do we use and why?
The University is following government advice and will collect and use only the following information for the purposes of contact tracing.
UEA employees
- the names of staff who work at the premises
- School / Department
- a contact e-mail address for each member of staff
- a contact phone number for each member of staff
- campus card number
- the dates and times that staff are at work. We may obtain this information from swipe card records
- location(s) visited on campus. We may obtain this information from swipe card records
- if you are experiencing symptoms of Covid-19 and the date of onset
- If you have had a Covid-19 test, the date of the test and the result (if known)
- If you are self-isolating
UEA students
- name
- School / Department
- email address and campus card number
- student number
- date of birth
- mobile phone number
- the dates and times that students are on campus. We may obtain this information from swipe card records
- If a student will interact with only one member of staff, we will record the name of the assigned staff member alongside the name of that student
- location(s) visited on and off campus. We may obtain this information from swipe card records
- if you are experiencing symptoms of Covid-19 and the date of onset
- if you have had a Covid-19 test, the date of the test and the result (if known)
- if you are self-isolating
- if you are living in student accommodation on campus, the location of your room. Otherwise, the first line of your address and postcode
- if you are or have been on placement, or will be on placement in the next two weeks, details of your placement
- location off-campus and who you live with (i.e. students or non-students)
Customers and visitors to the UEA campus
- the name of the customer or visitor
- if there is more than one person, we may record the name of the ‘lead member’ of the group, and the number of people in the group
- a contact phone number for each customer or visitor, or for the lead member of a group of people
- date of visit, arrival time and, where possible, departure time
- location(s) visited on campus
- if a person will interact with only one member of staff, we will record the name of the assigned staff member alongside the name of that person
- if resident on campus, contact details and health related information that you share with us
Where does our information come from?
We will collect the information described above either directly from you (for example if you call us to share information about a test result, or visit one of our catering outlets and 'sign in'), or via one of the University’s Covid-19 Notification Forms, or via existing data sources used by the University, or via the Lateral Flow testing operation run by the University under the authorisation of the DHSC. For example, if you are a UEA student we will already hold information on the classes you are registered for / have attended. We may also re-use information collected from swipe cards or other technology in order to ascertain locations you have visited on campus during a certain timeframe.
If you have used the NTI testing facility (PCR test) and tested positive, the testing facility will share limited contact details with the University's Safety Services so we can provide you with support and work to limit the spread of the virus.
The University has engaged Anglia DNA to provide a testing service where required, for example for students who require a test prior to going on placement and who will not be using 'Lateral Flow' testing. Anglia DNA will provide details of all test results to UEA.
Please note: we do not have access to the data collected by the NHS Covid-19 app.
How we will use your information
Certain members of staff will use information you provide, or that we obtain about your Covid status, in order to provide you with support and ensure good order is maintained in the University community.
All students: we will share basic contact details (as listed above) of all registered students with Norfolk Public Health to enable them to cross reference data on positive cases, inform their risk assessments, and manage COVID-19 cases in the University community.
Students and others in accommodation on campus: In addition to the above, your information will also be shared with certain members of staff so that where appropriate, certain services such as cleaning and essential maintenance can be suspended or instigated, and welfare services can put measures in place in order to keep those staff safe whilst you are self-isolating.
Individuals who are symptomatic and those who have tested positive for Covid-19
As soon as you notify us via one of the University’s Covid-19 Notification forms, or you have a positive test result from the NTI or Lateral Flow testing facility or the service provided by Anglia DNA, information will be shared with limited and specific members of University staff who need your details in order to provide support, ensure good order is maintained, and to identify individuals on campus that you may have had contact with, in the period spanning 48 hours prior to you experiencing symptoms up until the day you self-isolate.
Contacts of individuals who have tested positive for Covid-19
If you have been identified as a contact, either by completion of the University's Covid-19 Notification form, by the NHS Test and Trace service, through the Anglia DNA testing service (for placement students), or by the Public Health England – Health Protection Team, your information will be shared with certain members of staff in order to provide you with support.
Please note: we do not have access to the data collected by the NHS Covid-19 app.
Students in accommodation on campus: In addition to the above, your information will also be shared with certain members of staff so that, where appropriate, certain services such as cleaning and essential maintenance can be suspended or instigated, and welfare services can put measures in place in order to keep those staff safe whilst you are self-isolating.
When we will share your information with others
In order to help reduce the spread of infection, we will sometimes need to share your information outside the University. We recognise the importance of keeping health data secure, so will only share the minimum required information, only for contact tracing purposes and to assist local Public Health Officers in identifying and managing COVID-19 cases.
Individuals who are symptomatic and those who have tested positive for Covid-19
The information you provide via the University’s Covid-19 Notification Forms will be shared with the NHS Test and Trace service, so that they may contact you to initiate their tracing protocols, which will help identify any individuals that you may have had contact with (in the same time period as above) who were off campus.
Individuals who have not notified the University of COVID-19 symptoms or positive result
If we are notified by the NHS Test and Trace service or by Public Health England of any individual who has tested positive, or about whom they require further information for test and trace purposes, we will share with them the contact tracing information we hold.
All students
We will share basic contact details (as listed above) of all registered students with Norfolk Public Health to enable them to cross reference data on positive cases, inform their risk assessments, and manage COVID-19 cases in the University community.
How long we keep your information
To support NHS Test and Trace, the University needs to hold full records for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional seven days to allow time for testing and tracing.
After 21 days, we will take measures to remove identifying information, with the exception of student and staff numbers. Currently, this pseudonymous information is required by Public Health to reconcile their own data with University records.
If we are providing you with ongoing support in relation to your Covid status, we will retain records in line with our Student Privacy Notice and Student Services records retention schedule.
Where we are repurposing existing personal data for the purposes of contact tracing, for example membership records in the Sportspark, we will continue to use data for the original purposes as set out in the relevant privacy notice, and in line with our existing records retention policies.
Legal basis for using your data
The lawful basis we are relying on to process your personal data as described above is article 6(1)(f) of the GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests pursued by the University.
We will aim to complete a Legitimate Interests Assessment for this activity as soon as time allows. If you would like to see this document, contact dataprotection@uea.ac.uk.
For students attending a placement, where a test may be required prior to starting the placement and where positive test results will be shared with the University by the test provider (Anglia DNA), our lawful basis for processing personal data in relation to this test will be article 6(1)(e), as this activity is related to our 'public task' as a University.
Our processing of information about your health will be based on Article 9(2)(i), which relates to public health purposes, and Schedule 1, Part 1 (3) of the DPA 2018.
Contact
If you are a University student or employee, contact covidsecure@uea.ac.uk in the first instance.
Several areas of the University that are open to the public may be collecting records of their customers and visitors for the purpose of supporting NHS Test and trace. If you have any concerns about this process or how it is conducted, please speak to a senior member of staff in that specific area in the first instance.
For any queries about our use of your personal data, contact dataprotection@uea.ac.uk. Further details are in the link below.
Your rights, concerns and complaints, further information
We have published further data protection information on the University’s Data Protection webpages.
Changes to this notice
This privacy notice was written in September 2020 and last updated to version 5 on 16 February 2021 to amend scope of notice to explicitly include Student Services support provision, to amend the data retention period, add new data collected for residents on campus and students off campus, and to include the receipt of test result data from the Lateral Flow testing process.
V.4 changes were made on 04 January 2021, to reflect the possible provision of positive test results to the University by external testing provider, Anglia DNA.
V. 3 changes were made on 13 October, to include details of sharing student contact details with Norfolk Public Health, and to make clear that positive test result data will be shared from the University's testing facility to the University's Safety Services.
v.2 changes were made to reflect potential sharing of positive test results from the University's Covid-19 testing facility, to improve our explanation of the actions we will take, and to add links to the Covid-19 notification form.
If we need to make further changes to this notice, we will publish them here, explaining what has changed since the previous version.