What’s the purpose of collecting personal data?
We are collecting personal data to manage time slots for asymptomatic COVID-19 testing; and to manage the spread of COVID-19 in our community by enabling us to send follow-up emails to advise what you need to do after the test; and to provide support in the event of a positive test.
What are we collecting?
- For the booking process: your username, name and your chosen time slot(s).
- For the testing process: your Aber Card number, the barcode from your testing kit(s), and your test result(s).
What’s our lawful basis?
Under the General Data Protection Regulation (GDPR), the lawful basis we rely on for processing this information is that we have a legal obligation (Article 6(1)(c) GDPR).
Under the Health and Safety at Work Act, the University has a responsibility to protect staff, students and the community. We must minimise the risk of the spread of COVID-19 by managing the number of people visiting the testing site at any one time, by making sure that individuals comply with The Health Protection (Coronavirus Restrictions) (No. 5) (Wales) Regulations 2020 and by providing appropriate public health advice.
As we will be processing special category data (test results relate to your health), we have identified ‘substantial public interest’ as the appropriate Article 9 condition (GDPR Art. 9(2)(g)), together with ‘statutory purposes’ as the relevant Data Protection Act 2018 condition (DPA 2018 Sch. 1, Para. 6).
Who will have access to this data?
Only the key team managing the testing site will have access to booking slot data.
Registration staff will scan your Aber Card and barcode, and the test processor will scan the barcodes of any positive or inconclusive results. Only staff in the Covid-19 support team will be able to see the result linked to an individual student.
No data will be shared from the booking system with the Department for Health and Social Care (which is running the testing programme).
Will we share the data with any third parties?
In the event of a positive test result, we may be asked to share your contact details with Ceredigion County Council’s contact tracing team in order to facilitate the Test, Trace Protect strategy.
How long will we keep the data for?
- The content of the booking system will be deleted after 21 days.
- A record of your test result(s), whether positive or negative, will be retained as part of your student record for the duration of your studies.
Your data protection rights
Under data protection legislation you have various rights, including:
Right of access - You have the right to ask us for copies of your personal information.
Right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
If you have any concerns about our use of your personal information, you can make a complaint to the University’s Data Protection Officer at firstname.lastname@example.org.
You can also complain to the ICO if you are unhappy with how we have used your data.