View our Privacy Notice here
Data collected for the purposes of public health (including visitor contact data for COVID-19) will be kept as long as required. Contact data for visitors will be kept for 21 days after the most recent visit, with information on visitors kept as per standard retention requirements. Public Health data may be shared with third-parties as required including, but not limited to:
- National Health Service (including NHS Test and Trace)
- Public Health England
- Other local health authorities
Data collected and processed for public health purposes is done so under GDPR Article 9(2)(i) which states: (in part) “processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health…” and Recital 54 which includes: “The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject.”
Collection and processing of visitor data will be documented in the privacy notices and in a statement available to visitors at the time of data collection to include the following information:
“We collect the following visitor information for the purposes of security, safety and public health:
- Date and time of visit
- [Car registration]
- Contact details
These are kept for six years in case of any claims by students, staff or visitors under the Limitations Act (1980).
Contact details will be deleted after 21 days.
Should a positive test for COVID-19 be identified, relevant visitor data will be shared with the required public health authorities.
For further details, please see the Data Protection Policy, or contact the Data Protection Officer