This privacy notice explains:
- what information we collect
- how we are allowed to use your data
- who it might be shared with and why
- how long it is kept.
West Sussex County Council has decided to use, collect and keep a limited record of staff, customers and visitors who come onto our premises for the purpose of contact tracing. This is done to support NHS Test and Trace (which is part of the Department for Health and Social Care) in England.
By maintaining records of staff, customers and visitors, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to the coronavirus.
West Sussex County Council (WSCC) complies with the Data Protection Act and the General Data Protection Regulation (GDPR). It is registered as a ‘Data Controller’ with the Information Commissioner’s Office (Reg. No. Z6413427).
We ensure that your personal data is accurate, processed fairly and lawfully, kept secure and retained for no longer than is necessary.
Processing personal data
Under Government guidance, the information we collect may include information which we would not ordinarily collect from you. Therefore, we will collect it only for the purpose of contact tracing. Information of this type will not be used for other purposes (such as surveillance of an individual's movements or marketing activities).
Information we collect
As a customer/visitor of West Sussex County Council you will be asked to provide some basic information and contact details. The following information will be collected:
- The names of all customers or visitors, or if it is a group of people, the name of one member of the group.
- A contact phone number for each customer or visitor, or for the lead member of a group of people.
- Date of visit and arrival and departure time (if available).
- Library borrower number.
This data may already be held as part of the service you are accessing, for example when booking an appointment or using the library.
How we use your personal information
The use of your information is covered by the General Data Protection Regulations Article 6 (1) (e) - public task. This is covered by one of the permissive powers local authorities have regarding public health, general wellbeing of the area and to help fight any local outbreak of coronavirus.
If you do not wish your contact information to be passed to NHS Test and Trace if requested, please speak to a member of staff.
Who we share your information with
We will only share information with NHS Test and Trace if it is specifically requested by them. For example, if another customer at the venue reported symptoms and subsequently tested positive, NHS Test and Trace can request the log of customer details for a particular time period. This may, for instance, be all customers who visited on a particular day or time-band, or over a two-day period.
NHS Test and Trace will not disclose this information to any third party unless required to do so by law (for example, as a result of receiving a court order).
How long we keep your personal data
NHS Test and Trace have asked us to retain this information for 21 days from the date of your visit. This will enable contact tracing to be carried out by NHS Test and Trace during that period.
However, the Government guidance may also cover information that we would usually collect and hold onto as part of our ordinary dealings with you (for example, your name and contact details). Where this is the case, this information only will continue to be held after 21 days. We will use it as we usually would, unless and until you tell us not to.
Your information will always be stored and used in compliance with the relevant data protection legislation.