COVID-19 employees, staff and contractors Privacy Notice

COVID-19 NHS Test and Trace Privacy Notice

The Department of Health and Social Care has asked organisations including City of York Council to support this service by keeping a temporary records for customers, visitors and employees/staff and Gough and Kelly, for 21 days. In the event of a local outbreak of the virus this data may be used to assist NHS Test and Trace as needed. This could help contain clusters or outbreaks.

Do you have to provide the information?

The Department for Health and Social Care are clear that this is a voluntary scheme and nobody visiting our premises is required to provide their details.

However although this is a voluntary scheme for customers and visitors, we will share details of employees, staff and contractors , in order to support NHS Test and Trace (see Legal basis for processing section below). This information will only be used where necessary to help stop the spread of COVID-19 and protect both employees/staff and customers/visitors using our premises.

The accuracy of the information provided will be the responsibility of the council.

We already collect and process information about our employees, staff and contractors, working in council premises, who will have contact with customer or visitors for other business purposes, for example: rotas, making bookings or appointments. You can find out more about how we use your information on the employee privacy notice on the Intranet.

The information that we already collect and will use for the purposes of NHS Test and Trace are:

  • the names of employees/staff and Gough and Kelly staff who work in council premises where they come into contact with customers and visitors
  • a contact phone number for each of them
  • the dates and times that they are at work in the premises where they come into contact with customers or visitors

Information sharing

We keep the information in the council’s secure network drive and make sure it can only be accessed by authorised staff.

In the event of a local outbreak of the corona virus names and contact details of employees/staff and Gough and Kelly staff, will only be provided to the NHS to support Test and Trace when they ask for these records, either because someone who has tested positive for COVID-19 has listed council premises as a place they visited recently, or because our premises have been identified as the location of a potential local outbreak of COVID-19.

NHS Test and Trace will work with you, if contacted, to ensure that information is shared in a safe and secure way. See further information on how NHS Test and Trace works.

NHS Test and Trace will handle all data according to the highest ethical and security standards and ensure it is used only for the purposes of protecting public health, including minimising the transmission of COVID-19.

  • If you are contacted by NHS Test and Trace, contact tracers will:
  • call you from 0300 013 5000
  • send you text messages from ‘NHStracing’
  • ask you to sign into the NHS Test and Trace contact-tracing website

Contact tracers will never:

  • ask you to dial a premium rate number to speak to them (for example, those starting 09 or 087)
  • ask you to make any form of payment or purchase a product or any kind
  • ask for any details about your bank account
  • ask for your social media identities or login details, or those of your contacts
  • ask you for any passwords or PINs, or ask you to set up any passwords or PINs over the phone
  • disclose any of your personal or medical information to your contacts
  • ask about protected characteristics that are irrelevant to the needs of test and trace
  • provide medical advice on the treatment of any potential coronavirus symptoms
  • ask you to download any software to your PC or ask you to hand over control of your PC, smartphone or tablet to anyone else
  • ask you to access any website that does not belong to the government or NHS

Legal basis for processing information

The council is processing this personal information i.e. sharing with NHS Test and Trace, as it is necessary for the performance of a task carried out in the public interest in accordance with Article 6 1 (e) of the General Data Protection Regulation and Data Protection Act 2018.

The council will not process any special category data for this purpose.

Data Retention Period

The council will only keep the information which is collected and stored for NHS Test and Trace for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, this information will be securely disposed of or deleted.

Also see

Data Protection Officer

West Offices, Station Rise, York, YO1 6GA

Telephone: 01904 554145