Back to Top
Menu

Covid-19 Testing Privacy Statement

Ownership of the Personal Data

To enable the Covid-19 testing to be completed at college, we need to process personal data for staff and pupils taking part, including sharing of personal data where we have a legal obligation. Activate Learning is the Data Controller for the data required for processing the tests and undertaking any actions which we need to undertake to ensure we meet our public health and safeguarding legal obligations.

Personal Data relating to staff is processed on the basis of legal obligation the legitimate interest of data controller to ensure we can minimise the spread of COVID in a timely manner and enable us to continue to deliver education services safely and securely.

The processing of special category personal data is processed under the provisions Section 9.2(i) of GDPR, where it is in the public interest on Public Health Grounds. This data is processed under the obligations set out in Public Health legislation (Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI)) which allows the sharing of data for COVID related purposes and where it is carried out by someone who owes an equivalent duty of confidentiality to that data.

Data Controllership is then passed to the Department for Health and Social Care (DHSC) for all data that we transfer about you and your test results to them. For more information about what they do with your data please see the Test and Trace Privacy Notice. Activate Learning remains the Data Controller for the data we retain about you.

Personal Data involved in the process

We may use the following information to help us manage and process the tests:

  • Personal information (such as name, date of birth, gender and ethnicity)
  • Contact information (such as email address and phone number)
  • Test details (such as test date, test result, and the unique barcode assigned to each individual test, which will become the primary reference number for the tests

We will only use information that is collected directly from you specifically for the purpose of the tests, even if you have previously provided us with this information.

How we store your personal information

The information will only be stored securely on our secure IT system whilst it is needed. It will also be entered directly onto DHSC digital services for the NHS Test and Trace purposes. We will not have access to the information on the digital service once it has been entered.

Processing of Personal Data Relating to Positive test results

We will inform you (or your parent/guardian) of the outcome of your test and provide further advice as necessary. If you test positive, we will use this information to conduct our COVID Case Management process.

The information will be transferred to DHSC, who will share this with the NHS, GPs. PHE and the Local Government will use this information for wider test and trace activities as well as statistical and research purposes.

This information is processed and shared under obligations set out in Public Health legislation under Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) which allows the sharing of data for COVID related purposes.

This information will be kept by Activate Learning for up to 3 months and by the NHS for 8 years.

Processing of Personal Data Relating to Negative test results

We will inform you (or your parent/guardian) of the outcome of your test and the information transferred to DHSC, NHS. PHE and the Local Government who will use the information for statistical and research purposes.

This information is processed and shared under obligations set out in Public Health legislation under Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) which allows the sharing of data for COVID related purposes.

This information will be kept by Activate Learning for up to 3 months and by the NHS for 8 years.

Processing of Personal Data relating to declining a test

We will record that you have declined to participate in a test and this information will not be shared with anyone. This information will be kept by Activate Learning for up to 3 months.

Data Sharing Partners

The personal data associated with test results will be shared with:

  • DHSC, NHS, PHE – to ensure that they can undertake the necessary Test and Trace activities and to conduct research and compile statistic about Coronavirus.
  • Your GP – to maintain your medical records and to offer support and guidance as necessary
  • Local Government to undertake local public health duties and to record and analyse local spreads.

Requesting access to your personal data

Under data protection legislation, you have the right to:

  • Request access to the information we hold about you (Subject Access Request);
  • Be informed of the identity of the controller, the reasons for processing your personal data and other relevant information necessary to ensure the fair and transparent processing of personal data;
  • Object to processing of personal data that is likely to cause, or is causing, damage or distress;
  • Prevent processing for the purpose of direct marketing;
  • Object to decisions being taken by automated means;
  • In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed;
  • Claim compensation for damages caused by a breach of the data protection regulations.

Contact

In order to make a Subject Access Request or to discuss anything in this privacy notice, please contact our Data Protection Officer:

Jamie Wade, Director of Governance
Email: dpo@activatelearning.ac.uk
Phone: 01865 551226
Address: Activate Learning,
City of Oxford College Oxpens Road Oxford OX1 1SA

Concerns

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/