WHAT WE WILL DO WITH YOUR DATA FOR COVID-19 PURPOSES

We have always kept records of our customers.  But now data is even more important due to COVID-19.  Organisations have lots of new measures to put in place so that we can re-open safely to the public. This includes collecting customers’ and visitors’ personal information to support the various contact tracing schemes in the UK. 

These are our five simple steps to help ensure that data protection is adhered to:

UK Government Advice for Track and Trace Data

Information to collect:

The following information should be collected by the venue, where possible:

·         Staff

·         the names of staff who work at the premises

·         a contact phone number for each member of staff

·         the dates and times that staff are at work

·         customers and visitors

·         the name of the customer or visitor. If there is more than one person, then you can record the name of the ‘lead member’ of the group and the number of people in the group

·         a contact phone number for each customer or visitor, or for the lead member of a group of people

·         date of visit, arrival time and, where possible, departure time

·         if a customer will interact with only one member of staff (e.g. a hairdresser), the name of the assigned staff member should be recorded alongside the name of the customer

No additional data should be collected for this purpose.

To support NHS Test and Trace, you should hold records for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, this information should be securely disposed of or deleted. When deleting or disposing of data, you must do so in a way that does not risk unintended access (e.g. shredding paper documents and ensuring permanent deletion of electronic files).

Records which are made and kept for other business purposes do not need to be disposed of after 21 days. The requirement to dispose of the data relates to a record that is created solely for the purpose of NHS Test and Trace. All collected data, however, must comply with the General Data Protection Regulation and should not be kept for longer than is necessary.

When information should be shared with NHS Test and Trace

NHS Test and Trace will ask for these records only where it is necessary, either because someone who has tested positive for COVID-19 has listed your premises as a place they visited recently, or because your premises have been identified as the location of a potential local outbreak of COVID-19.

NHS Test and Trace will work with you, if contacted, to ensure that information is shared in a safe and secure way. You should share the requested information as soon as possible to help us identify people who may have been in contact with the virus and help minimise the onward spread of COVID-19.

NHS Test and Trace will handle all data according to the highest ethical and security standards and ensure it is used only for the purposes of protecting public health, including minimising the transmission of COVID-19.

If you are contacted by NHS Test and Trace

Contact tracers will:

·         call you from 0300 013 5000

·         send you text messages from ‘NHStracing’

·         ask you to sign into the NHS Test and Trace contact-tracing website

Contact tracers will never:

·         ask you to dial a premium rate number to speak to them (for example, those starting 09 or 087)

·         ask you to make any form of payment or purchase a product or any kind

·         ask for any details about your bank account

·         ask for your social media identities or login details, or those of your contacts

·         ask you for any passwords or PINs, or ask you to set up any passwords or PINs over the phone

·         disclose any of your personal or medical information to your contacts

·         ask about protected characteristics that are irrelevant to the needs of test and trace

·         provide medical advice on the treatment of any potential coronavirus symptoms

·         ask you to download any software to your PC or ask you to hand over control of your PC, smartphone or tablet to anyone else

·         ask you to access any website that does not belong to the government or NHS

How NHS Test and Trace will take steps to minimise transmission

If you receive a request for information from NHS Test and Trace this does not mean that you must close your establishment. NHS Test and Trace will, if necessary, undertake an assessment and work with you to understand what actions need to be taken.

Depending on the circumstances and the length of time that has elapsed, this could include arranging for people to be tested, asking them to take extra care with social distancing and/or – in some circumstances – asking them to self-isolate. NHS Test and Trace will give you the necessary public health support and guidance. Your staff will be included in any risk assessment and NHS Test and Trace will advise them what they should do.

If there is more than one case of COVID-19 on your premises, you should contact your local health protection team to report the suspected outbreak.