Our contact details
The following organisations are joint data controllers in respect of this service:
| Organisation: | Data Protection contact details: |
|---|---|
| Blaenau Gwent County Borough Council info@blaenau-gwent.gov.uk | info@blaenau-gwent.gov.uk 01495 311556 |
| Caerphilly County Borough Council dataprotection@caerphilly.gov.uk | dataprotection@caerphilly.gov.uk 01443 864322 |
| Monmouthshire County Council dataprotection@caerphilly.gov.uk | dataprotection@monmouthshire.gov.uk 01633 644744 |
| Newport City Council information.management@newport.gov.uk | information.management@newport.gov.uk 01633 656656 |
| Torfaen County Borough council | DPA@torfaen.gov.uk 01633 647467 |
The type of personal information we collect
If you have received a positive SARS-CoV-2 test, we collect and process the following information about you:
- your name, date of birth, address and contact details,
- your job title, place of work, line manager and description of your work,
- names, date of birth and contact details of those in your household together with whether they were present during your infectious period,
- names and contact details of others who you have been in contact with during your infectious period, and
- the places you have visited during your infectious period.
- any symptoms of COVID19 that you may have and if you have hospitalised with those symptoms.
If you have been identified as being in contact with an individual who has received a positive SARS-CoV-2 test, we collect and process the following information about you:
- your name, date of birth, address and contact details,
- your job title, place of work, line manager and description of your work,
- names, date of birth and contact details of those in your household, and
- any symptoms of COVID19 that you may have and if you have hospitalised with those symptoms.
How we get the personal information and why we have it
Some of the personal information we process is provided to us directly by you, or your representative, for the following reasons:
- in order to operate a COVID19 contact tracing service, including providing advice and support to those that have been in contact with an individual who has received a positive SARS-CoV-2 test, and the booking of SARS-CoV-2 tests for those displaying COVID19 symptoms.
We also receive personal information indirectly, from the following sources in the following scenarios:
- If you have received a positive SARS-CoV-2 test; your name, date of birth, address and contact details would have been provided to us by the testing centre.
- If you have been identified as being in contact with an individual who has received a positive SARS-CoV-2 test; your name, date of birth, address and contact details would have been provided to us by that individual or their representative.
We may share this information with those organisations detailed above that make up the Gwent Contact Tracing Service, for the purpose of responding to the critical public health crisis in respect of the COVID-19 pandemic. We may also share information with Welsh Government for this purpose.
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:
• Article 6(e) – The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vesting in the controller
This is supported by the Health Service (Control of Patient Information) Regulations 2002.
As extra protection is provided for certain classes of information called 'special category personal data' such as health information, an additional lawful basis must be identified in order to process these classes of information, as outlined below:
- Article 9(i) – processing is necessary for reason of public interest in the protection of public health.
Other applicable articles may include:
- Article 9(g) – processing is necessary for reasons of substantial public interest
- Article 9(h) – processing is necessary for the purposes of preventive or occupational medicant, for the assessment of working capacity of the employee, medical diagnosis, the provision of health or social care treatment or the management of health or social care systems and services.
How we store your personal information
Your information is securely stored securely in the Gwent Contact Tracing Service Data System.
We keep only for as long as it is needed and when no longer needed it will be deleted / destroyed securely.
Your data protection rights
Under data protection law, you have rights including:
Your right of access - You have the right to ask us for copies of your personal information.
Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact the relevant organisation, as detailed above, if you wish to make a request.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint by contacting the relevant organisation, as detailed above.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk