Privacy notice : Royal Borough Local Contact Tracing (LCT) Service

This privacy notice sets out how the Royal Borough of Windsor and Maidenhead's Public Health Team is working in collaboration with Public Health England to deliver a Local Contact Tracing Service. This privacy notice explains how the personal data of residents will be used for our Local Contact Tracing (LCT) Service as part of a nation-wide effort to combat and contain the further spread of COVID-19 within the Borough.

Who we are

Royal Borough Public Health
Town Hall
St Ives Road
Maidenhead SL6 1RF

How we use information about you

COVID-19 is an infectious disease affecting the whole of the country. The virus that causes COVID-19 is a coronavirus. Infectious diseases present a serious and ongoing threat to public health. If not controlled, they can infect large numbers of people and, depending on the disease and other factors, can result in ill-effects ranging from relatively minor symptoms to early death.

Contact tracing is an important way of controlling the spread of infectious diseases. It involves identifying and tracing all the people who have been in contact with a person who has been infected. Depending on the nature and duration of the contact, these contacts may require advice or treatment to prevent the disease spreading further.

The national Test and Trace service is delivered by Public Health England. To learn more about how your personal data is used for this purpose, read their privacy notice

The LCT service is designed to improve on the tracing rates achieved by the national Test and Trace service. By using local support and intelligence, local contact tracing will help minimise the delay between a person testing positive for COVID-19 and a contact tracing call taking place, thereby potentially reducing further transmission within the community.

Your information is used to provide advice on self-isolation and how to protect yourself and others from COVID-19. It will also help identify outbreaks which require support.

NHS Test and Trace will refer cases of COVID-19 to our Local Contact Tracing Service in instances where they have not been able to establish telephone contact with the case in the first 24 hours following notification of the positive test result.

The personal information will be shared with the council for the following reasons:

  • Enable contact tracers to call people who have tested positive with COVID-19 to offer advice and gather information about the people they may have come into close contact with and who may have been infected with the coronavirus.
  • Enable contact tracers to manage the process of tracing these contacts to find out if they have any COVID-19 symptoms and if so, to provide advice on how to seek help.
  • Enable the necessary sharing of personal information to third party organisations using minimum data.
  • Enable the planning, management and containment of local outbreaks.

Your information may also be used for different purposes that are not directly related to your health and care. These include:

  • Research into COVID-19.
  • Planning of services or actions in response to COVID-19.
  • Monitoring the progress and development of COVID-19.

Whenever possible, information that does not directly identify you will be used for these purposes, but there may be times when it is necessary for your personal information to be used. Any releases of information that identify you will be lawful and the minimum necessary for that purpose.

Lawful basis for processing information

The law on protecting personally identifiable information, known as the General Data Protection Regulation (GDPR), allows the Council to use the personal information collected for the purpose of Test and Trace (COVID-19).

Our lawful basis for implementing a local test and trace service is in accordance with GDPR Article 6(1)(e) where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

We also rely on GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health, such as protection against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare. Article 9(2)(j) also applies – processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Separately, we have special permission from the Secretary of State for Health and Social Care to use confidential patient information for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health.

This is known as ‘section 251’ approval and includes using your test results if you test positive for coronavirus to start the contact-tracing process.

The part of the law that applies here is section 251 of the National Health Service Act 2006 and regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002.

How we collect information

We will receive information about cases directly from the national Test and Trace Service so that we can make phone calls where no contact has been made by the national service. To enable the contacts of people with COVID-19 to be traced and support the Royal Borough's Local Contact Tracing Service, we need to collect personally identifiable information during our telephone calls to contacts. To ensure that you have confidence in providing your personal information over the telephone, all call handlers will be calling on behalf of our Local Contact Tracing Service and will state this at the start of each call.

Should you require written confirmation of the caller’s identity, contact tracers will ask you to provide an email address to which they will send an email from their official email address ( 

Personal information will come to us from different sources:

  • Public Health England – from the national Test and Trace service.
  • The individual cases and contacts – during telephone calls with LCT staff members. We will also send text messages to individual cases where attempts to make telephone contact have not been successful, asking them to contact the LCT team to provide their details.
  • Data sources within the council – if we are unable to make contact with an individual using a telephone number supplied to the national Test and Trace service, we will check to see whether we hold an alternative contact number by checking contact information held in a local system, such as council tax or the electoral roll.

The data will include some of the listed information. It will be kept to a minimum and only processed where it is appropriate to do so. Data collected from phone calls is recorded and stored on the national Test and Trace system (CTAS) held by Public Health England.

For an individual who has tested positive for COVID-19 (case):

  • Unique Record ID
  • Full name
  • Date of birth
  • Gender
  • Ethnicity
  • NHS number
  • Home postcode and house number
  • Telephone number(s) and email address
  • COVID-19 symptoms, including when they started and their nature
  • Occupation/key worker type
  • Place of work or educational setting and date last attended
  • Details of activities attended seven days prior to symptoms starting
  • Vulnerability group
  • Shielded status

Individuals who have tested positive will also be asked to supply information about those they have recently been in close contact with (contacts), including:

  • Full name.
  • Whether aged over 18 years of age.
  • Telephone number(s) and email address.
  • Whether contact was direct or close to case (proximity and duration).
  • Setting in which contact with the case took place.

Data on close contacts of cases will be passed to the national Test and Trace service, who will issue advice on self-isolation by phone, email and text message. 

Who has access to the information about you

Council employees seconded to work in our LCT Service will have access to your details in order to make contact with you via telephone for test and trace purposes. 

Your information will be treated with strict confidence and only disclosed where it is necessary to prevent a COVID-19 outbreak by investigating an establishment for potential contacts, the minimum amount of personal information will be shared if necessary, with: 

  • Other local authorities to enable the appropriate public health response in other areas affected by onwards transmission of the coronavirus.
  • Sub-contractors to deliver support/advice in key sectors (e.g. care homes, education, prisons, housing)
  • We may need to disclose your name and the fact that you have tested positive to your employer, educational provider or the operator of an institution where you have spent significant time if this is necessary to avoid or limit a COVID-19 outbreak in the workplace.

How long we store your information

The personal information will only be held as long as directed by the Department of Health and Social Care (DoHSC). Read GOV.UK's Coronavirus COVID-19 Notice for more information.

If we need to use your information for research or reports, your information will be anonymised, and any information taken from notes (handwritten or typed) during any consultation sessions will be securely destroyed.  The information will continue to be used in a summarised and anonymised form in any research reports or papers that are published. The anonymised information in the papers may be of historic interest and may be held in public archives indefinitely.