COVID-19 Testing Privacy Statement

Co-op Academies Trust – COVID-19 Testing Privacy Statement

Why are we doing this?

Schools and Colleges have been offered the equipment and supplies to provide rapid COVID-19 tests to students and staff.

You can choose if you want to be tested and we can only test if we have a signed consent form.

For those under 16, a parent or guardian must give consent. Those over 16 can give consent themselves.

We have to collect and use personal data to manage this testing and we must share some of that data with the NHS.

Who is in charge of the data?

For the data we collect as part of providing the testing the Co-op Academies Trust is responsible for ensuring that is handled correctly. We are called the Data Controller.

What will the data be used for?

The data will be used for the following purposes

  • Recording who has agreed to be tested
  • Recording who has declined testing
  • Recording when tests have been carried out
  • Recording the results of the tests that are carried out
  • Managing the risk of COVID-19 to our pupils and staff (For example, asking people to self-isolate)

We will only use information that is collected directly from you specifically for the purposes above, even if you have previously provided us with this information.

What data will we collect?

If you agree to be tested, the following data will be used:

  • Name
  • Date of birth (and year group)
  • Gender
  • Ethnicity
  • Home postcode
  • Email address
  • Mobile number
  • Unique barcode assigned to each individual test and which will become the primary reference number for the tests
  • Test result
  • Parent/guardians contact details (if required)

If you choose not to be tested, we will record:

  • Name
  • Date of birth (and year group where appropriate)
  • Your decision not to be tested

Why are we allowed to use your personal data?

All schools and Colleges are required to support the wellbeing of pupils and staff.

For our pupils in our Academies this duty comes from the Education (Independent School Standards) Regulations of 2014 and for our Special Schools from the Non-Maintained Special Schools (England) Regulations 2015.

For our staff this duty comes from the Health and Safety at Work Act 1974.

The Trust is required to meet these duties in order to operate. This means we can use the personal data as part of delivering a task in the public interest. This is covered by Article 6(1)(e) of the UK GDPR.

Some of the data, like your ethnicity and the results of the tests, are called special category personal data. This is more sensitive information. We can use this personal data because helping to control the spread of COVID-19 is in the public interest. This is covered by Article 9(2)(i) of the UK GDPR.

How we store your personal information

The information will only be stored securely on local spreadsheets in school whilst it is needed.

Who will we share this information with?

We are required to share the information from all the tests we do with the Department for Health and Social Care (the DHSC).

Where we get a positive result we will enter it directly to the Test and Trace system.

The details of negative results will be transferred to the Department of Health and Social Care regularly for statistical and research purposes.

Once the information is transferred to the DHSC, they become responsible for it and are the Data Controller.

The DHSC have requested that we tell you that the information we provide will be shared with;

  • DHSC, NHS, Public Health England – to ensure that they can undertake the necessary Test and Trace activities and to conduct research and compile statistic about Coronavirus.
  • Your GP – to maintain your medical records and to offer support and guidance as necessary
  • Local Government to undertake local public health duties and to record and analyse local spreads.

How long will we keep your information?

Information about whether you agree to be tested will be kept for as long as testing is being carried out and then erased.

Information about tests carried out will be kept for 14 days and then erased.

What rights do you have

Under data protection law, you have rights including:

  • Your right of access – You have the right to ask us for copies of your personal information.
  • Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate.
  • Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
  • Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
  • Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.

If you want to use of any these rights please contact your Academy, or you can contact the Trust’s Data Protection Officer, using the details below.

What should I do if I want to complain?

If you’re not happy with how we use your personal data, please get in touch with our Data Protection Officer:

GDPR Sentry
Unit 434 Birch Park,
Thorp Arch Estate,
West Yorkshire
LS23 7FG
Telephone: 0113 804 2035 (Option 2)

You can also contact the Information Commissioner’s Office (ICO) who regulate the use of personal data in the UK.

The ICO’s address:
Information Commissioner’s Office
Wycliffe House,
Water Lane,
Helpline number: 0303 123 1113

window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-152967461-4'); (function(h,o,t,j,a,r){ h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)}; h._hjSettings={hjid:2050882,hjsv:6}; a=o.getElementsByTagName('head')[0]; r=o.createElement('script');r.async=1; r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv; a.appendChild(r); })(window,document,'','.js?sv=');