Lambeth local contact tracing privacy notice

This policy explains how the information we collect and hold about you in relation to contact tracing for coronavirus (COVID-19) is used and your rights in relation to that information. 

Our general guidance on how Lambeth Council collects and uses data about you can be found at Lambeth privacy notice.

About contact tracing for coronavirus

NHS Test and Trace forms a central part of the government’s coronavirus (COVID-19) recovery strategy. It aims to ensure that anyone who develops symptoms of coronavirus can be tested quickly, and seeks to trace the close recent contacts of anyone who tests positive to notify them that they must self-isolate to help stop the spread of the virus. Lambeth Council Local Contact Tracing works in partnership with NHS Test and Trace and performs much of the contact tracing function for Lambeth residents.

NHS Test and Trace collects and holds data on people who test positive for coronavirus and on their contacts as detailed below. They will share some of that information with Lambeth Council to enable contact tracing, to support people who need help self-isolating, to ensure people who have been instructed to self-isolate are doing so, and to validate eligibility for support payments to people on lower incomes who have been instructed to self-isolate. 

The Department of Health and Social Care has published an overview of how NHS Test and Trace works.  Privacy information for NHS Test and Trace can be found here.

Data controller

The Department of Health and Social Care (DHSC) has commissioned NHS Test and Trace on behalf of the government and is the data controller for the purposes of data protection legislation.

Public Health England is an executive agency of the DHSC and provides the NHS Test and Trace contact-tracing service in England on behalf of the DHSC.

London Borough of Lambeth is the data controller for any data passed to us by NHS Test and Trace and any data we collect and store directly.

Information shared with us and what we collect

If you test positive for coronavirus you will be contacted by the NHS contact-tracing service and asked to confirm or provide your:

  • full name
  • date of birth
  • sex
  • ethnic group
  • NHS number
  • home postcode and house number
  • mobile phone number
  • telephone number
  • email address

You will also be asked to provide other information for example:

  • details of your COVID-19 symptoms, including when they started and their nature
  • whether you are clinically vulnerable or extremely vulnerable and require support
  • details of people who are your close contacts and how you came into contact with them

This data is recorded in the NHS Test and Trace information system and also in the Lambeth Council contact tracing system.

We will carry out accuracy checks on contact details held by the NHS Test and Trace Service using our local data held in the Council (such as electoral register, council tax, social care or housing data) and support our local contact tracers to complete any outstanding data required to improve levels of contact tracing.  This data will be updated on the national NHS Test and Trace system.

We will ask residents we contact if they would like to be supported by our self-isolation support service, delivered under contract by Age UK Lambeth, and where residents say yes we will pass limited data to this partner in order for the support service to be provided promptly and effectively.

Where we are unable to make contact by telephone or email and the resident has not completed the contact tracing interview via an online webform we may share limited personal data with our contracted self-isolation support service, run by Age UK Lambeth, to enable the resident to be visited at the home address details we hold so that we can gain assurance that the resident is safe, is aware of their positive COVID-19 test result and the requirement to self-isolate, and to make arrangements for a contact tracing interview to take place. This data is: full name, contact details, age, gender, isolation start date, the fact that they have tested positive, whether the client is vulnerable, and what kind of household they live in. They may also provide them with one or more PCR tests for household contacts to get tested.

If the person who answers the door is not the person we are seeking, we will identify whether they are a close contact of the person we are seeking, and aged 16 years old or above. If they are, we will encourage them to get a PCR test for COVID-19 and may provide them with one or more PCR tests.

We will not share this data with other organisations or individuals outside of Lambeth Council for any other purpose other than that stated above.

Purpose

The UK is currently experiencing a public health emergency because of the Coronavirus (COVID-19) pandemic. It is therefore critical that organisations take a range of measures to keep everyone safe.

The personal information about you collected by the national NHS contact-tracing service and the Lambeth Council contact-tracing service is used to help control and prevent the spread of Coronavirus.  The Department of Health and Social Care has asked organisations including Lambeth Council to support this service by keeping a record of residents who have tested positive for COVID-19.  In the event of a local outbreak of the virus this data may be used to assist NHS Test and Trace as needed. This could help contain clusters or outbreaks.

We will follow the NHS Test and Trace guidance on the retention of this data for a period of 8 years for cases and 5 years for contacts of cases. 

Lawful basis

We must have a legal basis to process your personal data. These responsibilities are as set out in the ‘Covid-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ dated 20 March 2020 from the Department of Health and Social Care on behalf of the Secretary of State for Health and Social Care.

The law on protecting personal information, known as the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, allows us to use the personal information collected by the contact-tracing service.

The sections of the UK GDPR and the Data Protection Act that apply where we use personal information to identify and trace contacts, control local outbreaks, check whether people are self-isolating, confirm that someone is eligible for a self-isolation payment, and monitor the impact on public health of coronavirus are:

  • UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
  • UK GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare;
  • Data Protection Act 2018 Schedule 1 Part 1 (2) - health or social care purposes

Separately, we have special permission from the Secretary of State for Health and Social Care to use confidential patient information without people’s consent for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health.

Separately, NHS Test and Trace has special permission from the Secretary of State for Health and Social Care to use confidential patient information without people’s consent for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health. This is known as a ‘section 251’ approval and includes, for example, using your test results if you test positive for COVID-19 to start the contact-tracing process. The part of the law that applies here is section 251 of the National Health Service Act 2006 and Regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002. You can find more information on this via the NHS contact tracing privacy notice.

Between Public Health England, an Executive Agency of the Department of Health and Social Care, and London Borough of Lambeth, we have two signed agreements in place:

  • COVID-19 Testing Rapid Data Sharing Contract
  • Data sharing agreement (controller to controller) (GDPR and DPA 2018)

Data subject rights

By law, you have a number of rights as a data subject and this does not take away or reduce these rights. Your rights under UK GDPR and the UK Data Protection Act 2018 apply.

All information is processed in accordance with the London Borough of Lambeth data protection policy.

These rights are:

  1. Your right to get copies of your information – you have the right to ask for a copy of any information about you that is used.
  2. Your right to get your information corrected – you have the right to ask for any information held about you that you think is inaccurate, to be corrected
  3. Your right to limit how your information is used – you have the right to ask for any of the information held about you to be restricted, for example, if you think inaccurate information is being used.
  4. Your right to object to your information being used – you can ask for any information held about you to not be used. However, this is not an absolute right, and we may need to continue using your information, and we will tell you if this is the case.
  5. Your right to get information deleted – this is not an absolute right, and we may need to continue to use your information, and we will tell you if this is the case.

If you are unhappy or wish to complain about how your personal data is used as part of this programme, you should contact London Borough of Lambeth in the first instance.

If you are still not satisfied, you can complain to the Information Commissioners Office. Their website address is ico.org.uk and their postal address is:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF