Privacy notice - COVID-19 Test Results

We receive information from Public Health England about residents who have tested positive for COVID-19. This personal data includes unique record identifier, sex, age in years, place of residence postcode, ethnic group, occupational group, key worker status, date of Covid-19 test or specimen test, and Covid-19 test location type (laboratory, mobile testing station, or home test). The data we receive indicating a positive test and ethnic group as classified as ‘special category data’.

We use personal data to help us to meet our legal obligations or where we have a ‘public task’ power in the area of public health. We use special category data where this is necessary for reasons of ‘public interest’ in the area of public health.

We will use the personal data to take action to manage and mitigate the spread and impact of the current outbreak of Covid-19 including:

• Understanding Covid-19 and risks to public health, trends in Covid-19 and such risks, and controlling and preventing the spread of Covid-19 and such risks;
• Identifying and understanding information about patients or potential patients with or at risk of Covid-19, information about incidents of patient exposure to Covid-19 and the management of patients with or at risk of Covid-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from Covid-19;
• Understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of Covid-19 and the availability and capacity of those services or that care;
• Monitoring and managing the response to Covid-19 by health and social care bodies and the Government including providing information to the public about Covid-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services;
• Delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with Covid-19, including the provision of information, fit notes and the provision of health care and adult social care services; and
• Research and planning in relation to Covid-19.

No, only anonymised information will be shared outside of the Council.

Middlesbrough Council completes annual Public Services Code of Connection and NHS Data Security and Protection Toolkit assessments to demonstrate our security compliance.

We use the following measures to ensure that your personal data is secure: data protection and security policies, information security incident reporting, data and device encryption, system and data access controls, user accounts and passwords, physical and environmental security, staff vetting practices, staff training and awareness, data back-ups, ICT network penetration testing, and business continuity and disaster recovery plans.

We will only keep the data that identifies you until 31 March 2021 or unless this is extended by the Secretary of State for Health and Social Care or permitted by Public Health England.

No, the personal data is processed and stored only in the UK.

We will not use this personal data for any direct marketing purposes.

Your Information Rights are set out in law and, subject to some exceptions, you have the:

• Right to rectification - to ask for information to be corrected
• Right to erasure - to have your personal data deleted
• Right to object - to how your data is used
• Right to restriction - to request limits on how your data is used
• Right to portability - to request that we move your data to another organisation
• Right of subject access - to request a copy of data the Council holds about you

If you have a concerns about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner's Office. Visit the website of the Information Commissioner's Office.

If you would like to discuss anything in this privacy notice or your information rights, please contact:

The Data Protection Officer
Middlesbrough Council
PO Box 500, Middlesbrough, TS1 9FT
Phone: 01642 245432
Email: dataprotection@middlesbrough.gov.uk