COVID-19 privacy notice

What is this notice?

This document provides you with the key information about how the University of the West of England, Bristol (the University, UWE Bristol, we, us) processes your personal data for the purposes of:

  • supporting the NHS Test and Trace COVID-19 service and complying with any of our own obligations in relation to that service; and
  • ensuring the health and safety of individuals on campus, as well as supporting efforts to prevent possible COVID-19 outbreaks and/or protect individuals in the event of an outbreak; and
  • enabling you to be tested for COVID-19 at one of our campuses if you are eligible (for example, you want to find out if you have COVID-19 and are asymptomatic) and have volunteered to do so; and
  • providing relevant information to third parties where necessary.

The University is supporting Public Health England and the NHS Test and Trace service with its efforts in managing the outbreak of COVID-19. We are also helping to maintain the safety and wellbeing of our campus community by asking those who show symptoms to tell us as soon as possible. In practice, this means that UWE Bristol will be collecting new personal information and, on occasion, use some of the existing data that we hold about you for contact tracing purposes.

For more information about the existing personal data that we may hold about you and how we ordinarily use it please see our other privacy notices.

Last updated: January 2021

What types of personal data do we process and where does it come from?

As part of the University’s COVID-19 data collection activities, we are likely to process some or all of the following information about you:

  • Your name and contact details (including your current address and telephone number)
  • If you are a member of staff, UWE Bristol student or a recent visitor
  • Details of your COVID-19 symptoms and your COVID-19 test (if you have had one)
  • Location(s) visited on campus and details about your student accommodation living arrangements (including the contact information of your flat mates)
  • Where necessary to allocate you a placement we will ask you to declare details about your vaccination status
  • Whether or not you have recently been in a health/social care or educational environment as part of your studies/teaching/research
  • The place(s) you have visited where you think you may have contracted the virus
  • Whether or not you:
    • intend to book a COVID-19 test (only if you have symptoms)
    • have been following social distancing guidelines
    • have recently been admitted to a hospital
    • have already engaged with NHS contact test and trace service.

In addition, where you are a student who has tested positive for COVID-19 and are self-isolating in university-owned/controlled accommodation in accordance with government requirements, we may use your swipe card access records if we have concerns that you are not self-isolating and may be endangering other individuals on campus. In this case, we will use the swipe card access records to identify whether this is the case and to provide you with any necessary support as well as take appropriate steps to reduce any health and safety risks to others (such as the deep clean of an area you are known to have visited and/or notification to those with whom you are known to have been in contact with).

We get this information from the following sources:

  • You (via the online form submission or if you call us via the helpline number)
  • Someone acting on your behalf (via the online form submission or if the individual calls us via the helpline number)
  • University systems as appropriate (such as timetable information and swipe card access records)

Our purposes for using your personal data and our lawful bases

We will only use the information you provide in order to:

  • identify you and ensure we have the most appropriate details in order to contact you on
  • report the relevant information to the appropriate organisations when we are required to (see later section)
  • help us determine how best to support you
  • inform our risk assessment practices and ensure our university campuses and community remain COVID-19 secure.

Under data protection law, we are only allowed to use your personal data if we have a lawful basis for doing so.

The lawful basis we are relying on to process your personal data as described in this notice is:

Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR), which allows us to process personal data when the purpose(s) is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University.

In addition, where Article 6(1)(e) above does not apply to our processing (for example, where we do not have a specific legal responsibility) we are relying on article 6(1)(f) of the UK GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests pursued by the University.

Our processing of information about your health is based on Article 9(2)(i) of the UK GDPR, which relates to public health purposes, and Schedule 1, Part 1 of the DPA 2018.

The University already has in place an appropriate policy document (PDF) which sets out how the University complies with its obligations under Data Protection Law when processing special category data.

Additionally, you can review the University's general Data Protection Policy (PDF).

How long do we keep your information?

The University will hold the information that has been collected about you specifically for this purpose for no longer than 21 days at which time we will securely dispose of it/delete any relevant records.

However, your personal data will be retained after 21 days where:

  • the University adequately anonymises it in order to inform its business as usual practices/risk management activities and/or statistical reporting requirements; and/or
  • the University continues to process it in order to discharge any of its obligations to you and in accordance with existing privacy notices and its applicable/usual retention periods.

Who may your data be shared with and why?

We will process your personal data within specific areas of the University only when strictly necessary in order to help limit the potential spread of COVID-19 and help us to provide you with the necessary support.

In order to help reduce the spread of COVID-19, we may in certain circumstances need to share your information outside the University. We are likely to share relevant personal data with the following organisations:

  • Public Health England (specifically the Health Protection Team)
  • NHS Test and Trace
  • South Gloucestershire Council
  • Bristol City Council

We will share your personal data with the organisations listed above only when it is necessary for contact tracing purposes. For example, we may share your personal data if:

  • someone informs us that they have tested positive for COVID-19 and they currently live in University halls of residence and/or have informed us that they visited one of our campuses recently;

or

  • a university campus has been identified as the location of a potential local outbreak of COVID-19.

In addition:

  • Where it is necessary as part of your course requirements to undertake a professional work placement in a care or educational setting, we will also share your personal data with the relevant NHS organisations, other healthcare providers and schools, to ensure lawful compliance within that workplace (but only where we are satisfied that you have tested positive for COVID-19 and haven’t already informed the relevant placement organisation yourself or where sharing details about your vaccination status are a requirement of the placement provider).
  • If you voluntarily decide to participate in a COVID-19 test at one of our campuses because you are eligible (eg you want to find out if you have COVID-19 and are asymptomatic) the University will use a third party to process limited personal information about you in order to manage and book you an appointment for this test. Additionally, in these circumstances, your actual COVID-19 test result (health data) will be entered directly into the NHS Test and Trace system and not processed or stored on any University system.
  • If you are living in UWE managed accommodation and are being supported by the University for the purposes of receiving an NHS COVID-19 home testing kit then we will share a limited amount of your personal information (e.g. name, address and contact information) outside the University in order to be able to facilitate the delivery and collection of your NHS COVID-19 home testing kit. For example, you may have been unable to book or attend a local test site and have requested the University to assist you with obtaining the COVID-19 home testing kit.

How do we keep your data secure?

Access to your personal data is strictly controlled on a need-to-know basis. Data is stored and transmitted securely using methods such as encryption and access controls for physical records where appropriate.

Your rights

Under UK GDPR, you have the following qualified rights:

  • The right to be informed about and access your personal data held by the University
  • The right to rectification if the information is inaccurate or incomplete
  • The right to restrict processing and/or erasure of your personal data
  • The right to data portability
  • The right to object to processing
  • The right to object to automated decision making and profiling (Please note: we will not be using your personal data to make decisions about you using automated means)

If you wish to exercise any of these rights please contact the Data Protection Officer at dataprotection@uwe.ac.uk. You also have an unreserved right to complain to the Information Commissioner’s Office.

Who can answer any questions?

If you have any questions about how we use your personal data please contact our Data Protection Officer at dataprotection@uwe.ac.uk