Privacy Statement
Privacy Notice - Schools Record Keeping Relating to Covid-19 to Support Test, Trace, Protect
This privacy notice covers how our School and Pembrokeshire County Council (as Data Controllers) will collect, use and share your personal data, to identify possible and actual cases of COVID-19 within educational settings. This data will also be used to support Test, Trace, Protect which is the Welsh Government strategy to control the spread of COVID-19 disease.
Why we need your information (purpose of processing)
We collect and use your personal information so that we can monitor symptoms of COVID-19 disease amongst pupils, teachers and other staff. This will help to establish background levels of absence caused by symptoms and will assist in identifying potential clusters of COVID-19 disease. This in turn will support the timely investigation of possible clusters to review and, where appropriate, enhancement of public health controls, ahead of test results/full test results being obtained.
The information that you provide will be processed according to the General Data Protection Regulation
2016, the Data Protection Act 2018, The Public Health (Control of Disease) Act 1984, as amended, The Health Protection (Local Authority Powers) (Wales) Regulations 2010 and The Health Protection (Part 2A Orders) (Wales) Regulations 2010.
We will not make any disclosures to third parties for marketing purposes.
Your data will be secure and confidential at all times and we will only collect the personal information that is required for this purpose.
What personal data are being collected?
In order so we can safeguard the health of the local population, prevent and control the spread of the disease, we will collect the following categories of personal data:
Pupils
- Name, data of birth, class, year group, school
- Names of siblings of school age and what school they attend
- Health information (including relevant dates and symptoms)
- Details of self-isolation
- Result of any COVID-19 screening test.
Staff
- Name, date of birth, job title, contact details, school
- Health information (including relevant dates and symptoms)
- Details of self-isolation
- Result of any COVID-19 screening test.
We will also request you notify us whether any other members of your household are displaying symptoms.
What is our legal basis for processing your personal data?
The General Data Protection Regulations (GDPR) requires specific conditions to be met to ensure that the processing of your personal data is lawful. These relevant conditions are below:
- Article 6 (1)(c) Legal obligation: the processing is necessary for you to comply with the law subject to - The Public Health (Control of Disease) Act 1984, as amended, The Health Protection (Local Authority Powers) (Wales) Regulations 2010 and The Health Protection (Part 2A Orders) (Wales) Regulations 2010.
- Article 6 (1)(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
Some types of personal data are more sensitive than others, and need more protection. This is classed as ‘special category data’ and could include information about your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership and the processing of genetic or biometric data, health and sex life and sexual orientation.
We process this type of special category data as it is necessary for reasons of:
- Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health, subject to Schedule 1, Part 1, paragraph 3 (a).
Who will we share your information with?
We may need to share your personal information to facilitate an investigation and respond to cases, clusters, incidents and outbreaks of COVID-19 disease this will include:
- Internal to Pembrokeshire County Council - Contact Tracing Team, Incident Management Centre, Public Protection Service and Local Education Authority.
- External - Hywel Dda University Health Board and Public Health Wales.
How long do we keep hold of your information?
Pembrokeshire County Council will only keep your information for as long as necessary, taking into account Welsh Government guidance. In the absence of any required investigation, your personal information will be deleted after a period of 21 days. In the event of an identified incident cluster or outbreak, your information will be held for 7 years (staff) and 7 years from 18th Birthday (pupils) from the conclusion of any investigation. Once it is no longer needed, your data will be deleted or securely destroyed.
Associated information will be retained in an anonymised form to assist with the monitoring of background levels, patterns or trends of relevant illness over time.
Your Rights
Under the General Data Protection Regulation 2016 and Data Protection Act 2018, you have rights as an individual including:
- The right to Rectification – you have the right to ask to have your information corrected.
- The right to Restrict processing may apply – you may request that we stop processing your personal data however, this may delay or prevent us delivering a service to you. We will seek to comply with your request but may be required to hold or process information to comply with our legal duties.
- The right to Object – this is not an absolute right and will depend on the reason for processing your personal information.
- The right to not be subject to Automated decision making and profiling.
- The right of Access – you have the right to ask us for copies of your personal data. To make a request, please contact:
Access to Records
Pembrokeshire County Council
County Hall
Haverfordwest SA61 1TP
Email: accesstorecords@pembrokeshire.gov.uk Telephone: 01437 775798
Complaints or Queries
Pembrokeshire County Council endeavours to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this seriously. We encourage people to bring to our attention if they believe that our collection or use of information is unfair, misleading or inappropriate.
This privacy notice does not provide exhaustive detail of all aspects of our collection and use of personal information. However we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below:
Data Protection Officer
Pembrokeshire County Council
County Hall
Haverfordwest
SA61 1TP
Email: dataprotection@pembrokeshire.gov.uk Telephone: 01437 764551
If you want to make a complaint about the way we have processed your personal information, you can contact the Information Commissioner’s Office as the statutory body which oversees data protection law:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
Email: wales@ico.org.uk Telephone No: 0303 123 1113
Our Contact Details as Data Controller are:
Pembrokeshire County Council, County Hall, Haverfordwest, Pembrokeshire, SA61 1TP.
Telephone number: 01437 764551 or enquiries@pembrokeshire.gov.uk
Our Data Protection Officer’s information is detailed above in the Complaints and Queries section.
Changes to this privacy notice
We keep our privacy notice under regular review