Updated: 15th March 2021
This document is to read in conjunction with the NHS Test and Trace Privacy Notice available here: https://www.gov.uk/government/publications/coronavirus-covid-19-testing-privacy-information.
Ownership of the Personal Data
To enable the Covid-19 testing to be completed within the John Taylor MAT family of schools, we need to process personal data for staff and students taking part, including sharing of personal data where we have a legal obligation. John Taylor MAT is the Data Controller for the data required for processing the tests and undertaking any actions which are needed by our schools to ensure we meet our public health and safeguarding legal obligations. All data is processed under Section 3 of the Non-Maintained Schools Regulations 1999. Data Controllership is then passed to the Department for Health and Social Care [DHSC] at the point that we transfer data to them.
Personal Data involved in the process
We use the following information to help us manage and process the tests:
Personal data processed:
- Full name
- Personal Phone number (if known)
- Job Role
- NHS number (if known)
- Gender
- Date of Birth
- Address & Postcode of residence
- Comments – e.g. Experience of using test
Special category data processed:
Data concerning health:
- Ethnicity
- Date of test/s performed
- Time of test performed
- Lot number of test strip
- Result – Positive, Negative or Invalid
Other Information:
- Name or postcode of the school
- Reason for taking the test (Testing for an education provider – like a school or college)
We will only use information that is collected directly from you specifically for the purpose of the tests, even if you have previously provided us with this information.
How is this data collected (in-school tests)?
Personal information is can obtained via various mechanisms includes your HR file, School file, submission of new information via a secure means for example Microsoft forms or Schoolzine or you School Management Information System.
How is this data collected (at home tests)?
When recording a test on the Department for Health and Social Care [DHSC] you, as the date subject or their representative enter the provide the required information.
How we store your personal information
The information will only be stored securely on local spreadsheets or another secure electronic means such as Test Register. It will also be entered directly onto DHSC digital services for the NHS Test and Trace purposes unless this process can be automated. The Trust or its schools will not have access to the information on the digital service once it has been entered.
Processing of Personal Data Relating to Positive test results
The member of staff, student or parent will be informed only if the result is positive by the staff or students’ home school and advised how to book a confirmatory test.
Each school will use this information to enact their own COVID isolation processes without telling anyone who it is that has received the positive test. The information will be transferred to DHSC, who will share this with the NHS. PHE and the Local Government will use this information for wider test and trace activities as well as statistical and research purposes.
This information is processed and shared under obligations set out in Public Health legislation under Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) which allows the sharing of data for COVID related purposes.
For more information about what the DHSC do with your data please see their COVID-19 Privacy Notice
This information will be kept by the school for a period of twelve (12) months and by the NHS for eight (8) years.
Processing of Personal Data Relating to Negative test results
Each school will record a negative result and the information will be transferred to DHSC, NHS. PHE and the Local Government who will use the information for statistical and research purposes.
This information is processed and shared under obligations set out in Public Health legislation under Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) which allows the sharing of data for COVID related purposes.
This information will be kept by the school for a period of twelve (12) months and by the NHS for eight (8) years.
Data Sharing Partners
The personal data associated with test results will be shared with:
- DHSC, NHS, PHE – to ensure that they can undertake the necessary Test and Trace activities and to conduct research and compile statistical information about Coronavirus.
- Your GP – the NHS may share the information you provide with your GP to maintain your medical records and to offer support and guidance as necessary. Any data you provide to the [school/college] will not be shared with your GP.
- Local Government to undertake local public health duties and to record and analyse local spreads.
- Test Register – to collate tests, allocation of test kits and to automate certain processes such as reminders. Test Register’s privacy notice can be here: https://d1elvl9dn6c8xu.cloudfront.net/44d0a27e-1f93-4db5-8491-00fc2ab1faf2/documents/Privacy%20Policy.pdf
Personal Data in the school/college’s test kit log will be shared with DHSC to identify which test kit has been given to which individual in the event of a product recall. The school will not share its internal COVID-19 test register with DHSC.
Your Rights
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances. You are not required to pay any charge for exercising your rights. If you make a request, we have one
month to respond to you.
Please contact us at the address below if you wish to make a request.
Data Protection Officer
John Taylor MAT
c/o John Taylor Free School
Branston Road
Tatenhill
Burton-on-Trent
DE13 9SA
Telephone: 01283 247823
Email: dpo@jtmat.co.uk
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us by contacting the Trust at the above address. You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1111