Search Herts

COVID-19 Asymptomatic (Rapid) Testing - Data Protection privacy notice

The University is committed to stopping the spread of Covid-19 in the local area. Following Government guidance, the University is continuing to carry out large-scale asymptomatic testing programme for COVID-19 to support national efforts in tackling COVID-19.

This Privacy Notice relates to personal data being collected from those taking part in the COVID-19 Rapid Testing programme.

Updated 21/05/21.

Why do we need to collect this data?

We need to collect some contact information from you to manage and administer the on-site test appointment booking process and the home test kit collection process. You will provide this by logging onto our online booking and request forms.

Your test result will also be collected and processed by the University test centre system. As this is sensitive personal data, we have set out our basis for collecting this data and the approach we will take in more detail below.

Your data, including test results, will be used to enable the University to help protect the health and safety of the University community, support the wider efforts to contain the spread of the virus, and to provide support to those who need to self-isolate for the specified 10-day period.

What data will we collect?

We will use contact information provided by you either, in person, through our online booking forms or through automatic feeds from other University business systems. This will include your name, member number, email address and mobile phone number. For home test kits, we will also capture details of the lots/batch numbers of the kits, the location from which you received the kits, and the date you received the kits.

On arrival for your on-site test appointment, you will be provided with a test barcode and registration card and asked to register on the NHS website. The University will not have access to any of your NHS registration data.

You will be notified by both the University and the NHS of your test result either by SMS or to the email you provide when you register. The University will not receive your test results from the NHS but will itself record your test result against your appointment record.

Your personal information relating to test registration and test results will also be processed by NHS Test and Trace. Information about how the NHS will use your data can be found here.

Personal data collected when you request a home test kit may be used to support further efforts to control the spread of Coronavirus should cases begin to rise nationally. This may include contacting you about obtaining further kits and ensuring more widespread distribution of home test kits.

How will your data be shared?

Your test result, if positive, will be shared with a restricted number of colleagues in the UH Track and Trace Team. This data will be used for the purpose of track and trace processing and for offering support through the isolation period. In the event of a positive test result, you will be contacted directly with help and advice.

Your data may also be shared, when requested, with Public Health England (PHE) and the NHS for the purposes of protecting public health, including minimising the transmission of COVID-19.

In the event of a home testing kit recall, your name and phone number will be shared with the Medicines and Healthcare products Regulatory Agency (MHRA) so they can contact you directly.

Your data will be held on on-site and Microsoft Cloud servers, for which the University has put in place robust data processing agreements for the protection of personal data.

Your data will not be shared or used for any other purpose and will be held securely at all times.

What is our lawful basis for collecting this data?

Under data protection law, there must be a lawful basis to allow us to collect and process personal information. In this case, the lawful bases for processing your data are:

  • Legal Obligation - the processing is necessary to comply with the law, i.e., the University has an obligation under the Health and Safety at Work Act (1974) to take all steps that are reasonably practical to ensure the health and safety of its staff and students (in accordance with GDPR Article 6(1)(c)).
  • Public Interest – the processing of the data is necessary for the performance of a task carried out in the public interest, i.e., to support the efforts to stop the spread of COVID-19 (in accordance with GDPR Article 6(1)(e)).
  • Legitimate Interest – we have a legitimate interest to ensure the wellbeing of, and minimise risk to, the public as well as our staff and students, as well as ensuring the delivery and continuation of operations (in accordance with GDPR Article 6(1)(f)).

Your test result, which is health information and therefore defined as sensitive or special category information under the General Data Protection Regulation (GDPR) and Data Protection Act 2018, requires a higher level of protection and an additional reason for processing. The lawful basis for processing this data is:

  • Public Health – it is necessary for reasons of public interest in the area of public health, i.e., to support efforts to stop the spread of COVID-19 (in accordance with Article 9(2)(i). The associated condition in the UK Data Protection Act (2018) comes under Schedule 1, Part 2(6), i.e., it is necessary for reasons of substantial public interest and for the purpose of a function conferred on a person by an enactment or rule of law, e.g. Health Protection (Coronavirus) Regulations 2020 and Coronavirus Act 2020.

How long will we retain the data?

All personal data will be held securely and will only be held for as long as is necessary for the purposes described in this notice. Personal data related to the collection of home test kits will be held for up to 12 months. All data will be disposed of in a safe and secure manner or will be anonymised, so it will not be associated with you. Anonymised data may then be retained for a longer period

Your rights

You have certain rights with regards to how your data is processed. Further information on these rights can be found here (PDF - 0.15 Mb), and you can also contact dataprotection@herts.ac.uk for further information.

Do you have a query or concern?

If you have any issues about this statement or the way the University has handled your personal data, please contact dataprotection@herts.ac.uk.