NHS Test and Trace
How we handle your information
This Privacy Notice is designed to help you understand how Museums Northumberland (Museums Northumberland is the public brand of Woodhorn Charitable Trust*) as a registered Data Controller with the Information Commissioner’s Office (ICO) will handle your personal information. It will outline why we ask for your personal information, detail the information we hold, how it is used, in what circumstances it is shared (and with whom) and how long it is kept for. It will also detail how you can exercise your rights under UK Data Protection Legislation (which includes the General Data Protection Regulations, known as ‘GDPR’).
Why do we ask for your personal information?
We record information about visitors to our Museums in accordance with our main privacy policy and to support NHS Test and Trace in conducting contact tracing. This may be necessary in the event that an individual, who is at the museum at the same time as you, tests positive for COVID-19. NHS Test and Trace may then contact you to provide appropriate advice.
NHS Test and Trace is a key part of the country’s ongoing COVID-19 response and is run by the Department of Health & Social Care (DHSC). It includes dedicated contact-tracing staff working at national level under the supervision of Public Health England (PHE) and local public health experts who manage more complex cases. Local public health experts include both PHE health protection teams and local authority public health staff.
By maintaining records of staff, customers and visitors attending any of our museums (and by sharing these with NHS Test and Trace where requested by them) this can directly help to identify people who may have been exposed to the virus.
The more rapidly and accurately way the NHS can identify people who may have been exposed to the virus and, if necessary, ask them to self-isolate, the more effectively we can break the chains of COVID-19 transmission and thereby reduce the likelihood of increased infections and localised outbreaks.
What information do we hold?
We only gather the minimum personal information required for the purposes set out in our main Privacy Policy and if required, to share this information with NHS Test and Trace when requested to by them.
You may be asked to provide some basic information and contact details at our Museums when you attend:
Information about staff:
· the full names of staff who work at or attend the premises
· a contact phone number for each member of staff
· the dates and times that staff are at work, or in attendance at the premises
Information about customers and visitors:
· the full names of all customers or visitors, or if it is a group of people, the name of the ‘lead member’ of the group
· a contact phone number for each customer or visitor, or for the lead member of a group of people
· date of visit, with arrival and departure time
· if a person/group only interacts with one member of Museums Northumberland’s staff during their visit, the name of the assigned staff member will be recorded alongside that information.
How does the law allow us to use your personal information?
There are a number of legal reasons (or ‘lawful bases’ for processing your personal data) why we are allowed to collect and use your personal information. In order to process your personal data, we rely on one or more of the following legal bases;
· Processing personal data falls within the Council’s ‘Public Task’
· Processing personal data is necessary to protect the ‘Vital Interests’ of the data subject or other parties.
How long do you keep my information for?
Information collected as part of this contact-tracing initiative will be stored securely and lawfully by Museums Northumberland, and by NHS Test and Trace (if passed to them at their request), in line with the requirements of the GDPR and the Data Protection Act 2018.
Your data that is collected for NHS Test and Trace will be retained by Museums Northumberland for 21 days after your visit, at which point it will be permanently deleted or destroyed. Museums Northumberland may hold the information for longer for other legitimate business purposes in accordance with the GDPR.
Where your data is passed to NHS Test and Trace in the case of a suspected outbreak, your information will be kept for up to 8 years, as part of the standard contact-tracing retention period set out by PHE.
Who will you share my information with?
Museums Northumberland will disclose your information to DHSC if you have agreed to share it with them. DHSC will collect your information directly from Museums Northumberland.
DHSC will only request these records where it is necessary for running an effective NHS Test and Trace service. It might be necessary (for this purpose) either because:
· someone who has tested positive for COVID-19 has listed a specific Council premise as a place they visited recently
· one of our museums has been identified as a potential location of a local outbreak of COVID-19
Under these circumstances DHSC, through NHS Test and Trace, will contact Museums Northumberland by phone or text and request that it shares specific information (that is, the contact details of individuals who were the premises between specific times on a specific day). NHS Test and Trace will then conduct a contact-tracing exercise with a view to providing those individuals with appropriate advice.
Information will be processed and shared within the UK only.
Can I request a copy of my records?
You can request what information Museums Northumberland holds about you. If you wish to see a copy of your records you should contact us via our website. Under the GDPR, subject to any applicable exemptions, you are entitled to receive a copy of your records free of charge, within a month
Do I have Other Rights? Data Protection legislation gives you the right:
1. To be informed why, where and how we use your information
2. To ask for access to your information
3. To ask for information to be corrected if inaccurate or incomplete.
4. To ask for your information to be deleted or removed where there is no need for us to continue processing it.
5. To ask us to restrict the use of your information.
6. To ask us to copy or transfer your information from one IT system to another in a safe and secure way.
7. To object to how your information is used.
8. To challenge any decisions made without human intervention (automated decision making).
9. To lodge a complaint with the Information Commissioner’s Office
10. If our processing is based upon your consent, to withdraw your consent.
Further information
If you would like to know more about how we use your information, or if for any reason you do not wish to have your information used in any of the ways described in this notice, please tell us. Please contact us via our website www.museumsnorthumberland.org.uk or call us on 01670 624455.
You also have the right to complain to the Information Commissioner’s Office if you are unhappy with the way we process your data. Details can be found on the ICO website, or you may write to the ICO at the following address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Email: casework@ico.org.uk