COVID-19 Privacy Notice
What is this notice?
This document provides you with the key information about how the University of the West of England, Bristol (the University, UWE Bristol, we, us) processes your personal data for the purposes of:
- supporting the NHS Test and Trace COVID-19 service and complying with any of our own obligations in relation to that service; and
- ensuring the health and safety of individuals on campus, as well as supporting efforts to prevent possible COVID-19 outbreaks and/or protect individuals in the event of an outbreak; and
- providing relevant information to third parties where necessary.
The University is supporting Public Health England and the NHS Test and Trace service with its efforts in managing the outbreak of COVID-19. We are also helping to maintain the safety and wellbeing of our campus community by asking those who show symptoms to tell us as soon as possible. In practice, this means that UWE Bristol will be collecting new personal information and, on occasion, use some of the existing data that we hold about you for contact tracing purposes.
For more information about the existing personal data that we may hold about you and how we ordinarily use it please see our other privacy notices.
What types of personal data do we process and where does it come from?
As part of the University’s COVID-19 data collection activities, we are likely to process some or all of the following information about you:
- Your name and contact details (including your current address and telephone number)
- If you are a member of staff, UWE Bristol student or a recent visitor
- Details of your COVID-19 symptoms and your COVID-19 test (if you have had one)
- Location(s) visited on campus and details about your student accommodation living arrangements (including the contact information of your flat mates)
- Whether or not you have recently been in a health/social care or educational environment as part of your studies/teaching/research
- The place(s) you have visited where you think you may have contracted the virus
- Whether or not you:
- intend to book a COVID-19 test (only if you have symptoms)
- have been following social distancing guidelines
- have recently been admitted to a hospital
- have already engaged with NHS contact test and trace service.
In addition, where you are a student who has tested positive for COVID-19 and are self-isolating in university-owned/controlled accommodation in accordance with government requirements, we may use your swipe card access records if we have concerns that you are not self-isolating and may be endangering other individuals on campus. In this case, we will use the swipe card access records to identify whether this is the case and to provide you with any necessary support as well as take appropriate steps to reduce any health and safety risks to others (such as the deep clean of an area you are known to have visited and/or notification to those with whom you are known to have been in contact with).
We get this information from the following sources:
- You (via the online form submission or if you call us via the helpline number)
- Someone acting on your behalf (via the online form submission or if the individual calls us via the helpline number)
- University systems as appropriate (such as timetable information and swipe card access records)
- Relevant local authorities and/or government bodies
Our purposes for using your personal data and our lawful bases
We will only use the information you provide in order to:
- identify you and ensure we have the most appropriate details in order to contact you on
- report the relevant information to the appropriate organisations when we are required to (see later section)
- help us determine how best to support you
- inform our risk assessment practices and ensure our university campuses and community remain COVID-19 secure.
Under data protection law, we are only allowed to use your personal data if we have a lawful basis for doing so.
The lawful basis we are relying on to process your personal data as described in this notice is:
Article 6(1)(e) of the GDPR, which allows us to process personal data when the purpose(s) is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University.
In addition, where Article 6(1)(e) above does not apply to our processing (for example, where we do not have a specific legal responsibility) we are relying on article 6(1)(f) of the GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests pursued by the University.
The University already has in place an appropriate policy document (PDF) which sets out how the University complies with its obligations under Data Protection Law when processing special category data.
Additionally, you can review the University’s general Data Protection Policy document (PDF).
How long do we keep your information?
The University will hold this information about you for no longer than 21 days at which time we will securely dispose of/delete any records that have been collected specifically for this purpose.
Who may your data be shared with and why?
We will process your personal data within specific areas of the University only when strictly necessary in order to help limit the potential spread of COVID-19 and help us to provide you with the necessary support.
In order to help reduce the spread of COVID-19, we may in certain circumstances need to share your information outside the University. We are likely to only share relevant personal data with the following organisations:
- Public Health England (specifically the Health Protection Team)
- NHS Test and Trace
- South Gloucestershire Council
- Bristol City Council
We will share your personal data with the organisations listed above only when it is necessary for contact tracing purposes. For example, we may share your personal data if:
- someone has tested positive for COVID-19 and they currently live in university halls of residence and/or have informed us that they visited one of our campuses recently
- a university campus has been identified as the location of a potential local outbreak of COVID-19.
Where it is necessary as part of your course requirements to undertake a professional work placement in a care or educational setting, we will also share your personal data with the relevant NHS organisations and schools, to ensure lawful compliance within that workplace (but only where we are satisfied that you have tested positive for COVID-19 and haven’t already informed the relevant placement organisation yourself).
How do we keep your data secure?
Access to your personal data is strictly controlled on a need-to-know basis. Data is stored and transmitted securely using methods such as encryption and access controls for physical records where appropriate.
Under the General Data Protection Regulation, you have the following qualified rights:
- The right to be informed about and access your personal data held by the University
- The right to rectification if the information is inaccurate or incomplete
- The right to restrict processing and/or erasure of your personal data
- The right to data portability
- The right to object to processing
- The right to object to automated decision making and profiling (Please note: we will not be using your personal data to make decisions about you using automated means)
If you wish to exercise any of these rights please contact the Data Protection Officer at firstname.lastname@example.org. You also have an unreserved right to complain to the Information Commissioner’s Office.