Maintaining records of staff, customers and visitors to support NHS Test and Trace

The UK is currently experiencing a public health emergency as a result of the coronavirus (COVID-19) pandemic. It is therefore critical that organisations take a range of measures to keep everyone safe.

The easing of social and economic lockdown measures following the COVID-19 outbreak is being supported by NHS Test and Trace. The Department of Health and Social Care has asked organisations to support this service by keeping a temporary record of our visitors for 21 days.  In the event of a local outbreak of the virus this data may be used to assist NHS Test and Trace as needed. This could help contain clusters or outbreaks.

Mendip District Council will be asking staff, customers and visitors to offices (listed below) to provide their details to help Mendip District Council maintain records of staff, customers and visitors to our premises to support NHS Test and Trace:

Shepton Mallet, The Council Offices, Cannards Grave Road, Shepton Mallet, BA4 5BT
Frome, Frome Library, Justice Lane, Frome, BA11 1BE
Glastonbury, Glastonbury Library, 1 Orchard Court, Glastonbury, BA6 9JB
Street, Crispin Community Centre, Leigh Road, Street, BA16 0HA
Wells, Wells Town Hall, Market Place, Wells, BA5 2RB

Do I have to provide the information?

The Department for Health and Social Care are clear that this is a voluntary scheme and nobody visiting our premises is required to provide their details.  If you do not wish to be added to Mendip District Councils register you do not have to provide your information to be used for this purpose.

Although this is a voluntary scheme we strongly encourage our customers and visitors to share their details in order to support NHS Test and Trace - this information will only be used where necessary to help stop the spread of COVID-19.
The accuracy of the information provided will be the responsibility of the individual who provides it. The Council will not verify any visitor's identity for NHS Test and Trace purposes.

We collect and process information about -

  • persons visiting council premises
  • our employees working in Council premises who have had contact with visitors

The types of information we hold includes:

Customers and visitors -

  • the name of the customer or visitor
  • a contact phone number(s)
  • date of visit, arrival time and, where possible, departure time
  • if a customer will interact with only one member of staff, the name of the assigned staff member will be recorded alongside the name of the customer or the if the officer is not known the Service Area will be recorded

Staff -

  • the names of staff who work at the premises
  • a contact phone number for each member of staff
  • the dates and times that staff are at work

The data will be collected at the point that visitors enter the premises by scanning a QR code / using the website to register or if visitors are unable to do this it will be collected by a member of staff member.

Recording both arrival and departure times (or estimated departure times) will help reduce the number of customers or staff needing to be contacted by NHS Test and Trace. We recognise, however, that recording departure times will not always be practicable.

Legal Basis for Processing

The Council is processing this personal information as it is necessary for the performance of a task carried out in the public interest in accordance with Article 6 1 (e) of the General Data Protection Regulation.

The Council will not process any special category data for this purpose.

How we use your personal information

This information is used to provide advice on self-isolation and how to protect themselves and others from COVID-19. It will also help identify outbreaks which require support and will be shared for the following reasons:

  • Enable contact tracers to call people who have tested positive with COVID-19 to offer advice and gather information about the people they may have come into close contact with and who may have been infected with the coronavirus
  • Enable contact tracers to manage the process of tracing these contacts to find out if they have any COVID-19 symptoms and if so, to provide advice on how to seek help
  • Enable the necessary sharing of personal information to third party organisations using minimum data
  • Enable the planning, management and containment of local outbreaks
  • Enable the Districts and County Councils to assist with tracking deliver their statutory Environmental Health/Food Safety obligations

Information sharing

In the event of a local outbreak of Coronavirus, the names and contact details of visitors to our sites may be provided to the NHS to support Test and Trace work.

NHS Test and Trace will ask for these records only where it is necessary, either because someone who has tested positive for COVID-19 has listed Council premises as a place they visited recently, or because our premises have been identified as the location of a potential local outbreak of COVID-19.

NHS Test and Trace will work with you, if contacted, to ensure that information is shared in a safe and secure way. You can find further information on how NHS Test and Trace works on the government website.

NHS Test and Trace will handle all data according to the highest ethical and security standards and ensure it is used only for the purposes of protecting public health, including minimising the transmission of COVID-19.

NHS Test and Trace will handle all data according to the highest ethical and security standards and ensure it is used only for the purposes of protecting public health, including minimising the transmission of COVID-19.

If you are contacted by NHS Test and Trace:

Contact tracers will:

  • Call you from 0300 013 5000
  • Send you text messages from 'NHStracing'
  • Ask you to sign into the NHS Test and Trace contact-tracing website

Contact tracers will never:

  • Ask you to dial a premium rate number to speak to them (for example, those starting 09 or 087)
  • Ask you to make any form of payment or purchase a product or any kind
  • Ask for any details about your bank account
  • Ask for your social media identities or login details, or those of your contacts
  • Ask you for any passwords or PINs, or ask you to set up any passwords or PINs over the phone
  • Disclose any of your personal or medical information to your contacts
  • Ask about protected characteristics that are irrelevant to the needs of test and trace
  • Provide medical advice on the treatment of any potential coronavirus symptoms
  • Ask you to download any software to your PC or ask you to hand over control of your PC, smartphone or tablet to anyone else
  • Ask you to access any website that does not belong to the government or NHS

Data Retention Period

Information which is collected and stored solely for NHS Test and Trace will be retained for 21 days.

This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, this information will be securely disposed of or deleted.

Your Rights

You have the right to request access to the personal information we hold about you, to be informed about the collection and use of your personal information, for the information held to be corrected (where the law permits) and to ask us to restrict the processing of your personal information. In certain circumstances you have the right to object to the processing of your personal information. This information will not be subject to any automated decision making.