Data Protection Frequently Asked Questions for Parents – Covid testing in schools and colleges
How can you use my child’s data? What is the difference between consenting to the test and consenting to you using my child’s data?
You will need to give medical consent for your child to take the test (if they are under 16), If you want your child to be tested, you will also need to understand that as part of testing we process their personal data. This processing of their data is allowed under data protection legislation, known as UKGDPR and the Data Protection Act 2018.
We are responsible for the processing of the test and ensuring all the personal data relating to the test is properly managed in accordance with their legal obligations.
Before we can use any personal data in the administration of taking the test and processing the results, we must tell you the lawful basis for why it is necessary to process personal data and it must be in one of 6 reasons which are allowed in UK data protection legislation. For the purpose of COVID-19 we are using Public Task, where it is necessary to process personal data to ensure we meet our obligations in education legislation to safeguard and promote the wellbeing of pupils.
Public Health legislation also allows the sharing of personal data with DHSC, Local Government, Test and Trace and the NHS.
You can find details of the specific legislation in the privacy notice or ask your school’s data protection officer for more details (email@example.com)
What personal data will you be asking for?
When you register for a test you need to provide us with your child’s
• Date of birth
• Home postcode
• Email address
• Mobile number
• Name of Parent or Guardian
This allows us to register your child for a test and to process the results. Once your child is registered for a test they will be assigned a unique barcode which will be used to identify the test without the need for sharing a lot of personal data. Once the test has been completed, we will also record the results.
Do you process any personal data if I refuse the test?
We will record that you have been offered and rejected a test so that we do not keep asking you to agree to a test. We will not tell any unauthorised person that is not directly involved in the recording of tests who has refused to test. Schools and colleges will not share refusals with other parents or pupils.
What Personal Data is used in getting test results?
We will use the personal data you provided when you register your child for the test to send the result to the named parents/guardians of children who test positive for coronavirus on the day of the test. You will not be informed of a negative test. If you test positive, you will be offered a further test of a different kind (called a PCR test) positive to confirm that your test result and details for this will be sent by email/and or text to parents/legal guardians within 24-48 hours of the test by the NHS.
Who are results shared with?
In the event of a positive result, in addition to sharing with the parent/guardian we will only share the result with appropriate contacts such as the head teacher and named nominated person in the school to allow us to start their own COVID isolation processes. We will not tell any unauthorised person (that is anyone not involved in the recording of test results) who has received a positive result. Schools and Colleges will not share positive results with other parents or pupils.
In the event of a negative result, We will only share the result with appropriate contacts such as the head teacher and named nominated person. We will not tell any unauthorised person (that is anyone not involved in the recording of test results) who has received a negative result. Schools and Colleges will not share negative results with other parents or pupils.
All results – both positive and negative – are shared by us with the Department for Health and Social Care (DHSC).
DHSC will share results with the NHS to offer advice and support. Results will also be sent to your GP so they can support you. If you have tested positive, a notification will be sent to Public Health England to enable them to contact people who have been in close contact with your child.
Will you tell people connected with my child if they have had a test?
No. We will not tell anyone that is not directly involved with administrating the test who has had a test and who has not had a test, or any result. If we have to advise other parents that their child has to isolate due to another receiving a positive test, we will not identify any individual positive results and you do not have any rights to know who may have tested positive.
Will my child’s personal data be used for research and statistical purposes?
Yes. However, data used for research and statistical purposes by DHSC/NHS will not use any personal data that can identify your child. Aggregate level data that will not identify individuals will be used. This is lawful under UK data protection legislation.
How will my child’s data be used?
Your child’s details will be used to complete testing. As part of testing, details of pupils and their parents or guardians, as well as staff, may be used for:
• registering your child and recording their participation in the testing
• matching your child’s contact details with health data stored by the NHS
• communicating with you about testing
• contacting you if you are the parent or guardian of someone who is participating in the Programme
• contacting you with your child’s test results by text message/email
• contacting you relating to your child’s positive or inconclusive result to collect other medical information about your child’s health relating to COVID-19
• phoning you to gather feedback to inform improvements that could be made to a full end-to-end testing process.
How long will my child’s data be kept for?
We will keep the data used for testing for up to 14 days. Your child’s information will be passed on to the DHSC who will share this information with NHS who will keep it for as long as it is required to provide your child with direct care and to support NHS initiatives to fight COVID-19. Information held for direct care purposes are stored in line with the Records Management Code of Practice for Health and Social Care 2016.