This is a supplementary privacy notice which describes how your personal data will be used as part of the University’s COVID-19 Response Programme. It should be read in addition to other relevant privacy notices.
Who are we and who is our representative?
The University of Plymouth (“we” “us” or “our”) is the Data Controller. The University is registered with the Information Commissioner’s Office under registration Z7546246.
The Data Protection Officer can be contacted through firstname.lastname@example.org.
Why do we collect your data?
We are required to assist the NHS Test and Trace service and / or public health authorities where necessary to help minimise and manage the transmission of COVID -19. We also have a duty of care to our staff, student and visitors.
What type of data do we collect?
We may already collect your data for a number of purposes which are detailed in other privacy notices e.g. for students or members of staff. This data, which may include attendance and location data will also, where necessary, be used as part of the COVID-19 Response Programme and the University’s Local Outbreak Response Plan. Additional data, such as contact details when you use certain facilities such as campus cafes in accordance with specific government guidance will also be recorded.
We may also collect data regarding suspected or confirmed cases of COVID-19 which include details of support and assistance which you may require.
When and how do we collect your data?
The data will be collected through your activities and engagement with us (as detailed in the existing privacy notices). Additional information will be collected from you e.g. where you report COVID-19 symptoms, a positive Covid-19 test or where you provide contact details when visiting a café. It may also be provided to us by external public health agencies.
How do we use your personal data?
We strongly encourage students and staff to engage with NHS Test and Trace but also to report to us where they have symptoms or a positive test via the following mechanisms:
If you disclose to us that you have received a positive COVID–19 test (or are self-isolating because you have symptoms) we will use the information to provide support and advice where required in relation to your studies or employment. We may need to share with different areas within the University in order to provide such support but this will be done on a confidential basis and only where necessary to support you or to manage health and safety risks to staff, students and visitors. We will also provide this information to Public Health England and the local authority Public Health Team (this could be Plymouth, Devon or Cornwall teams).
We may also need to use data provided by you or data we routinely collect about dates and times when you were on University premises to decide whether we need to provide your details to NHS Test and Trace, Public Health England and the local authority Public Health Team.
Information about your Covid-19 status and the fact that you are self-isolating/in quarantine will be processed in accordance with the University Data Protection policies.
What is the lawful basis for the processing?
The University must have a lawful basis in order to process personal data. For the purposes described these have been identified as follows:
- Legal obligation: the processing is necessary to comply with the law (not including contractual obligations) by ensuring health and safety within the University environment.
- Public task: the processing is necessary for you to perform a task in the public interest which includes the provision of a safe learning and teaching environment
Information about your health is special category data and where we process this we must have an additional lawful basis to do so. These have been identified as follows:
- for the purpose of carrying out the obligations and exercising specific rights of the University or of individual data subjects in the field of employment and social security and social protection law
- for reasons of substantial public interest
- for reasons of public interest in the area of public health.
How long do we keep your data?
Where data is already collected for other purposes in accordance with existing privacy notices the data will be retained in accordance with those notices. Where contact data is given specifically for contact tracing purposes eg. as a result of a visit to a campus café that data will be retained only for 21 days.
Data about students who have told us they have received a positive test result for COVID-19 or are symptomatic will be retained for 12 months unless required for other academic or support purposes such as to support extenuating circumstances claims. For staff, this will be retained in accordance with the existing HR privacy notice in relation to sickness and absence management.
Who do we share your data with?
We will only share your information in identifiable form where this is necessary for the purposes outlined in this notice. Any other University reporting requirements, for example, to the Office for Students, will be fulfilled by anonymised data and you will not be identified from this.
If we are required by law or government guidance to disclose such information e.g. following a request from NHS Test and Trace or local or national public health authorities we will do so.
For students we may also inform the appropriate accommodation provider in order for them to take appropriate steps to provide support you and to take any action required to safeguard you and others.
What rights do you have?
As a data subject you have a number of rights in relation to your personal data. You can:
- access and obtain a copy of your data on request
- require the University to amend incorrect or incomplete data
- require the University to stop processing your data, for example where the data is no longer necessary for the purposes of processing
- object to the processing of your data where the University is relying on its legitimate interests as the legal ground for processing
- require us to erase your personal data
- require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
- receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller.
Please note that the above rights are not absolute, and the University may be entitled to refuse requests where exceptions apply.
If you wish to exercise any of these rights or if you have a complaint about the way you believe your data is being processed, in the first instance, please email: email@example.com.
Changes to the Notice
This privacy notice is reviewed when required to reflect any changes in the processing of data resulting from compliance with COVID-19 requirements. If significant changes are made to this notice and the way we treat your personal information we will make this clear and may seek to communicate this directly to you