Privacy Notice - Covid-19 Contact Tracing including statistics

Spelthorne Borough Council (the Data Controller) has processed your personal information to provide support to Surrey local contact tracing service and Public Health England to provide face to face contacts, ie, visits, with positive cases and their contacts who have not been reached by phone. Spelthorne Borough Council will process personal information during normal office hours. Spelthorne Borough Council has contracted "Inside Housing Solutions" (the processor) who will process Covid-19 contact tracing for out of hours service on behalf of Spelthorne Borough Council.

Spelthorne Borough Council and its processor will:

• provide support to Public Health England with face-to-face contact tracing visits in respect of variants of concern (VoC)
• provide support to Surrey County Council (SCC)'s Local Covid-19 Contact Tracing Service with face-to-face contact tracing visits
• will contact with Covid-19 positive case and request the completion of a questionnaire. (This privacy notice covers the personal information collected via the questionnaire)    

In order to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation, Spelthorne Borough Council must provide you with the following information about the personal data you give to us or we receive via third parties.

What information does the Council collect?

We need your personal data such as name, address, contact details, date of birth, people you have been in recent contact with including their contact details, any recent travel information, Covid-19 test results.

Why does the Council process personal data?

Our purpose(s) for processing the personal data is for Covid-19 contact tracing. We will use the information to investigate whether positive Covid-19 cases are self-isolating.

The lawful basis we rely on to process your personal data is article 6(1)(C) processing is necessary for compliance with a legal obligation of the UK GDPR, which allows us to process personal data when this is necessary. We are processing under the followings Acts:

• Coronavirus Act 2020
• Public Health Act

If the information you provide us or we receive in relation to Covid-19 contact tracing contains special category data, such as health information the lawful basis we rely on to process it is article 9(2)(i) of the UK GDPR, where processing is necessary for reasons of public interest in the area of public health, such as protecting cross-border threats to health.

Who does the Council share your personal data with?

When we process your personal data we will share your information with relevant authorities, competent authorities such as Public Health England, Surrey County Council and other councils. We will also inform the police where necessary.

If required to share any personal information with other bodies as mentioned above, we share information securely and proportionately.

How long does the Council keep your data?

We will keep your personal information for 21 days after last contact.

For further information about how the Council uses your personal data, including your rights as a data subject, please see below. 

If you have any direct enquiries, Spelthorne Borough Council's Data Protection Officer can be contacted at data.protection@spelthorne.gov.uk.

The GDPR provides the various rights regarding your personal data; for further information please see the data protection rights page on our website.