Privacy notice for Covid-19 monitoring

Manchester Metropolitan University (the ‘University’) are obligated to assist the NHS in their Test and Trace scheme and the Manchester City Council Population Health Team to help contain the spread of COVID-19. The schemes are a key part of the country’s ongoing COVID-19 response. The NHS has asked organisations to keep a temporary record of visitors for 21 days, which should be shared with the NHS where necessary. 

How will information be collected?

Students and staff - are required to report positive cases to the University. 

For students - the University will maintain a record of who you have been in contact with as part of a study group and a living group based on information in our timetabling, attendance and accommodation systems. For students residing in houses of multiple occupancy, (outside of University accommodation), where possible, we will determine your living group based on address information in our student records.

The University has also taken the decision to monitor attendance at certain areas of the University, including the library, catering outlets, sports facilities, student services and faith/prayer sites. It is likely that this requirement will be rolled out further when other facilities across campus begin to open. We will keep this notice up-to-date to reflect any changes.

There will be posters and other notifications displayed in each venue to inform you that Test and Trace is in place.

We will collect your data in different ways depending on which venue you visit – for example, if you visit the library, we will use our entry monitoring system to record this information. If you visit a catering outlet, we will use a web-based system that we will ask you to register through.

What information is collected?

Covid-19 cases within the student and staff population.

If you are an MMU staff member:

• The names of staff who work at the premises.
• A contact phone number for each member of staff.
• The dates and times that staff are at work.

 If you are a student, customer or visitor:

• The name of the student, customer or visitor. If there is more than one person we will try to record everyone’s details, but we may only record the name of the ‘lead member’ of the group and the number of people in the group if this is not possible.
• A contact phone number for each customer or visitor, or for the lead member of a group of people.
• Date of visit, arrival time and, where possible, departure time.
• If a customer or visitor will interact with only one member of staff (e.g. if they have a scheduled appointment with an advisor), the name of the assigned staff member will be recorded alongside the name of the customer or visitor.

How will this information be used?

Your information will be used to support NHS Test and Trace purposes, as follows:

• Monitoring COVID-19 cases amongst our staff and students, to help contain outbreaks.
• To reduce the spread of COVID-19 and infection control.
• Contain outbreaks early.
• Help identify and contact individuals who may have been exposed to the virus.

Who we will share your personal data with?

The University will share your information with:

• Manchester City Council’s Population Health Team.
• NHS Test and Trace only where it is necessary, either because you have tested positive, you have contacted us to inform us you have COVID-19 symptoms or you have been in contact with someone who is believed to have the virus.

Student Services will work with the NHS Test and Trace Teams to notify potential student contacts.  It is likely that we will send you a text message to notify you that you have been in contact with someone who has tested positive for COVID-19.  If you are contacted, you should assume that a disclosure of your information will be made to NHS Test and Trace. 

For further information about how NHS Test and Trace will use your information please see their privacy notice: https://contact-tracing.phe.gov.uk/help/privacy-notice

Please be reassured that Government guidance is clear that: ‘NHS Test and Trace will handle all data according to the highest ethical and security standards and ensure it is used only for the purposes of protecting public health, including minimising the transmission of COVID-19.

If you visit one of our venues that asks you to download an application or register your attendance on a website, that application is hosted by an external company. You will provide your information directly to them. In these instances, the provider is operating as a processor for the information. Don’t worry: the University has appropriate contracts and safeguards in place to ensure your data is well protected, although you are encouraged to read any privacy information provided by that company prior to using the application.

Lawful basis for collecting, using and sharing this data

Under data protection law the University has a number of lawful bases that allow us to collect and process personal information. In this case, the lawful basis for processing your data is that it is required for reasons in the public interest and substantial public interest in the area of public health, such as protecting against serious cross-border threats to health. Processing of this nature is in line with Common Law, the Public Health (Control of Disease Act) 1984, and the Coronavirus Act 2020, and is required to protect the welfare and wellbeing of individuals who make use of our facilities and our staff.

Data retention

Government advice is clear that temporary records collected for test and trace purposes should be held for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, information held for Test and Trace purposes will be securely disposed of or deleted.

Records which are made and kept for other business purposes will not be disposed of after 21 days and will be retained in line with the University Retention and Disposal Schedule. The requirement to dispose of the data relates to a record that is created solely for the purpose of NHS Test and Trace.

Please see our main privacy notices for information about on-going data retention for non-Test and Trace purposes. https://www.mmu.ac.uk/data-protection/privacy-notices/, Student Privacy Notice, Staff Privacy Notice, Library Privacy Notice.

Your rights

We strongly encourage you to cooperate with Test and Trace for the purposes defined in this notice. Cooperation means better detection of people who have recently come into close contact with a new COVID-19 case and that swift action to minimise transmission of the virus is taken. This is important as lockdown measures are eased and will help us return to a more normal way of life and reduce the risk of needing local lockdowns in the future. The Health Secretary has described cooperation with track and trace as a ‘civic duty’. However, the scheme is voluntary and you are under no obligation to provide your information. You can contact us to ask that your information is not disclosed to NHS Test and Trace. If you do not want us to collect your data where Test and Trace is in operation via entry recording systems, for example the library, please make yourself known to a member of staff prior to your entry.  Our staff will assist to facilitate your entry without your information being recorded. If you are visiting one of our other monitored venues, for example a catering outlet, please do not download the application or register on the website that is in use. To request that your information is not disclosed to NHS Test and Trace please contact dataprotection@mmu.ac.uk or if you are a student at MMU, studentservices@mmu.ac.uk.

You have a range of other rights in relation to your personal data under the Data Protection Legislation. These rights include being able to request corrections, erasure, and access to your personal data and that the processing of your personal data stops or is restricted for certain purposes. Further detail about these rights can be found here:  https://www.mmu.ac.uk/data-protection/data-subject-rights/  

You can also contact the University’s Data Protection Officer about the processing of your personal data, including if you have concerns about the use of your data or wish to discuss the exercise of your rights. The University’s Data Protection Officer can be contacted at dataprotection@mmu.ac.uk. You also have the right to lodge a complaint at any time about the processing of your personal data or the way in which a request to exercise your rights has been handled with the Information Commissioner’s Office. Contact details can be found at www.ico.org.uk.