Privacy Notice - COVID-19

COVID-19 Testing at home of students in Secondary Schools

Ownership of the Personal Data

To enable the Covid-19 testing to be completed at Kesteven & Sleaford High School we need to process personal data, including the sharing of personal data where this is allowed under data protection legislation. Kesteven & Sleaford High School is the Data Controller for the data required for the management of tests and implementing local arrangements in the event of a positive test and undertaking any actions needed by school as part of the school’s health (including public health), welfare and safeguarding role and obligations.

Personal data relating to tests for students is processed under article 6 (1) (e) of the UK GDPR (public task). This is based on the requirements pertaining to policies on health and welfare for 16-19 Academies.

We will process special category personal data under the provisions of article 9.2(i) of the UK GDPR, and Part 1 of Schedule 1(3) of DPA 2018 where it is in the public interest on Public Health Grounds to ensure we can minimise the spread of COVID in a timely manner and enable us to continue to deliver education services as safely and securely as possible. This data is processed under the obligations set out in Public Health legislation (Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI)) which allows the sharing of data for COVID related purposes and where it is carried out by staff with an equivalent duty of confidentiality to that data.

Ownership of the Personal Data you share with DHSC

Every time you use a lateral flow test you must report the results. More details can be found here - Report a COVID-19 test result - GOV.UK (www.gov.uk). The Department for Health and Social Care (DHSC) is the Data Controller for the information that you transfer to them about you and your test results. For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice

Kesteven & Sleaford High School remains the Data Controller for the data we retain about you for the management of tests and implementing local arrangements in the event of a positive test.

You should read both this Privacy Notice and the DHSC COVID-19 Privacy Notice to understand how your personal data is used prior to taking a test.

Personal Data involved

The following personal data is processed by Kesteven & Sleaford High School in relation to your test:

For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice

How we store your personal information

Kesteven & Sleaford High School will maintain a test kit log which will record against your name details of the testing kit which has been provided to you. The school may also record Personal Data about you in its internal COVID-19 test register (the school’s COVID-19 test register will not be shared with DHSC). This information will only be stored securely on locally managed systems with appropriate access controls in schools and will only be accessible to personnel involved in the management of tests and implementing local arrangements in the event of a positive test.

The school will retain its test kit log and COVID-19 test register for a period of twelve (12) months from the date of the last entries made by the school into them.

For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice

Processing of Personal Data Relating to Positive test results

We will use this information to enact our own COVID isolation and control processes without telling anyone who it is that has received the positive test.

For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice

This information will be kept by the school for a period of twelve (12) months and by the NHS for eight (8) years.

Processing of Personal Data Relating to Negative and Void test results

We will record a negative and void result for the purpose of stock controls of tests and general performance of the testing process.

Data Sharing Partners

The personal data associated with test results will be shared with

Personal Data in the school’s test kit log will be shared with DHSC to identify which test kit has been given to which individual in the event of a product recall. The school will not share its internal COVID-19 test register with DHSC.

Your Rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact me at dpo@robertcarretrust.uk, 01529-411017 or at Jermyn Street, Sleaford, Lincs, NG34 7RS if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us by contacting me at dpo@robertcarretrust.uk.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Jeremy Green
Data Protection Officer