The Scottish Government/NHS Test and Protect, in partnership with the UK Department of Health and Social Care, is responsible for the overall delivery of COVID-19 Lateral Flow Testing (LFT) of staff and pupils in primary, secondary and special schools and Early Learning and Childcare (ELC) in Scotland. The testing of asymptomatic people can support education settings to identify positive cases, break chains of transmission and reduce risks in settings.

Fife Council is responsible for the local management of the COVID-19 Lateral Flow Testing in its schools and Early Learning and Childcare settings via participation forms and testing logs/stock information.

Testing and the submission of test results is voluntary. Test results will be submitted through the UK Department of Health and Social Care self-test portal and will be passed to NHS National Services Scotland to initiate contact tracing for positive results, and to Public Health Scotland for the management of outbreaks, statistics and research.

By taking up the test, you are agreeing to the collection and use of your personal information in accordance with legislative requirements, including the Data Protection Act 2018 and GDPR (General Data Protection Regulation).

For staff testing, information will be used about you in line with the Human Resources Privacy Notice which is available here: www.fife.gov.uk/privacy/hr

For further information on how your information is being used by Fife Council and other organisations, please see the detailed privacy notice below.

Privacy Notice for LFD at Home Testing: Secondary Schools, Primary Schools, Special Schools and Early Learning and Childcare Providers

Background

The Scottish Government/NHS Test and Protect, in partnership with the UK Department of Health and Social Care, is responsible for the overall delivery of COVID-19 Lateral Flow Testing (LFT) of staff in primary, secondary and special schools and Early Learning and Childcare (ELC) in Scotland. The testing of asymptomatic people can support education settings to identify positive cases, break chains of transmission and reduce risks in settings.

Fife Council is responsible for the local management of the COVID-19 Lateral Flow Testing in its schools and Early Learning and Childcare settings via participation forms and testing logs/stock information.

Scope of this privacy notice

This privacy notice covers the uses of personal data of staff in primary, secondary and special schools and Early Learning and Childcare (ELC) settings by NHS National Services Scotland (NHS NSS) and Public Health Scotland (PHS).

This privacy notice provides you with information about how your personal data will be collected and used in connection with COVID-19 Lateral Flow Testing. It covers the collection and use of your personal data, from providing the LFT data to the test results being recorded and processed.

As part of this testing, different organisations may require a different level of information about your LFT data, including the Department of Health and Social Care (DHSC) and schools/ELC providers.

Please refer to the relevant privacy notices if you want to know more about the uses of your personal data by other organisations. Every organisation involved in this data processing is independently responsible for complying with the applicable data protection legislation.

Who am I giving my personal data to?

If you decide to participate in this LFT process, you will need to submit the results of your self-administered COVID-19 lateral flow tests through the DHSC LFT self-test digital journey portal. DHSC is the data controller in relation to this data processing and you can find more information here.

For individuals based in Scotland, in line with mandatory notifiable disease reporting regulations and the public tasks of NHS National Services Scotland (NSS) and Public Health Scotland, LFT data submitted through the digital journey portal will flow through the National Pathology Exchange (NPEx) (DHSC’ processor) into NSS, who safely and securely store the provided data. Public Health Scotland (PHS) also has access to this data to perform their public functions.

NHS NSS and PHS are data controllers for the below purposes.

What is the purpose of processing my personal data?

Providing the LFT data is voluntary and aims to enable you to administer the COVID-19 tests directly without relying on a test centre. It also enables the involved parties to perform their public duties in managing the Covid-19 public health outbreak. In particular,

Fife Council is the controller for

• Collecting participation forms;
• Maintaining stock records including to whom test kits have been issued via a testing log.

The following personal data will be collected from other sources:

• Community Health Index (CHI) number – where this is not provided by you, NHS NSS may have to carry out CHI matching for your data set for the positive tests based on the information kept by NHS NSS. This is necessary to ensure that your records are accurate and kept updated.

In the event of a positive LFT test, you should book a PCR test to confirm the results. The involved parties in the PCR process will provide you with information about the processing of your personal data in this case.

What happens if I choose not to provide the personal data requested?

This privacy notice covers the LFT COVID-19 weekly testing of staff rapid identification of asymptomatic positive cases to reduce onward transmission within schools and ELC providers. This testing programme, alongside other protective measures such as physical distancing and handwashing, helps reduce the risks of coronavirus in education settings.

Staff participation in LFT testing is voluntary. It is the responsibility of the participating schools to ensure that they obtain the participation form and testing logs/stock information. People who decline to participate in twice-weekly contact testing may still attend school/ELC providers, provided they continue to follow national guidance on symptomatic testing and self-isolation.

In order to submit the LFT data to the LFD portal, you will need to provide personal data.

What is the lawful basis for collecting, storing and using my data?

NHS NSS and PHS rely on the below lawful bases to process the personal  data:

UK General Data Protection Regulation (GDPR) Article 6(1)(e) (lawful basis to permit the processing of personal data) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authorities vested in the data controllers.

UK GDPR Article 9(2)(h) (lawful basis to permit the processing of special category data) processing is necessary for the purposes of preventive or occupational medicine, the provision of health or social care or treatment or the management of health or social care systems and services.

UK GDPR Article 9(2)(i) (lawful basis to permit the processing of special category data) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

UK GDPR Article 9(2)(j) (lawful basis to permit the processing of special category data) processing is necessary for archiving purposes in the public interest or scientific and historical research purposes.

The processing of personal data covered in this policy also adheres to Schedule 1 of the UK Data Protection Act 2018. In particular, the applied conditions under Schedule 1 are:

Condition 2 – Health or social care purposes

Condition 3 - Public health

Condition 4 – Research etc

Condition 6 - Statutory etc. and government purposes

The Council relies on

UK GDPR Article 6(1)(e) (lawful basis to permit the processing of personal data) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authorities vested in the data controllers.

In this instance, the task in the public interest is assisting NHS NSS and PHS in fulfilling their statutory functions.

How will my personal data be used?

NHS NSS and PHS process your personal data for the following purposes:

• To perform their public duties and functions in supporting the public healthcare system as outlined under the National Health Service (Functions of the Common Services Agency) (Scotland) Order 2008 for NHS NSS (e.g. management services to support the Scottish

Government and Health Boards) and the Public Health Scotland Order 2019 for PHS (e.g. research).

• To administer the processing of your LFT results.
• To enable contact tracing.
• To share the test outcome with other parties involved in this process, such as local Health Boards so they can provide you with appropriate advice and support.

The Council’s purpose is the facilitation of the work of NHS NSS and PHS as above.

Where your personal data is shared with third parties acting as data controllers, they are responsible for ensuring compliance with data protection law.

How will my personal data be shared?

Your personal data will only be shared with specific parties as part of this processing and on a need-to-know basis. Where special categories of personal data are shared, this is subject to suitable and specific measures to safeguard your rights and freedoms. NHS NSS and PHS may share your personal data with:

• Your local Health Boards to carry out their public health duties
• The GP of the person who tested positive
• NHS Test and Protect service undertake contact tracing to initiate contact tracing for positive cases
• Other parties of the health and care system for monitoring and planning actions in response to COVID-19

Where positive tests become part of the medical records of the tested person, parties authorised to access your medical records will also have access to this information.

Information about COVID-19 LFT tests may be provided to the Scottish Government in an aggregated and anonymised format for the evaluation of the effectiveness of this testing, including operational performance, and clinical and public health effectiveness.

Your school/ELC provider may need to access information about your LFT for certain purposes (e.g. stock management and incident reporting about the quality or safety of testing). Information submitted to the self-test digital journey portal is not shared with the school/ELC provider and you may have to provide this information directly to these organisations. Your school and/or ELC provider should provide the necessary contact details for reporting the information to all participants.

How long will my personal data be kept?

• The test information processed by NHS Scotland is kept for as long as is required to provide you with direct care and to support NHS Scotland's initiatives to fight COVID-19. Information held for direct care purposes is stored in line with the Scottish Government Health and Social Care Records Management Code of Practice 2020. This means such information will be held for up to 7 years before it is deleted.
• When positive test results are added to your personal medical records, this will be retained on these records for your lifetime.
• Upon receipt of the participation form, the relevant school will update the required testing log to note that the form has been completed and received.  The participation form will thereafter be securely destroyed. The Council will retain testing log/stock information for 12 months.

Where is my personal data stored?

Your data will be stored securely within the United Kingdom and safely accessed by authorised parties. We will not share your personal data outside the United Kingdom.

Is my personal data kept private and secure?

We have legal duties to keep information about you confidential. Strict rules apply to keep your information safe and comply with the Data Protection Act 2018, UK GDPR and organisational Data Protection policies. Appropriate technical and organisational measures are used to keep your data safe, including adherence to the NHS Scotland Information Security Policy framework, PHS/NSS Corporate Information Security Policies, PHS/NSS Information Security Acceptable Use Policy, NHSS Information Security and Cyber Security incident reporting and management processes and information governance training.

The Council has similar technical and organisation measures in place.

What Are My Rights?

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

1. The right to be informed.
2. The right of access.
3. The right to rectification.
4. The right to erasure.
5. The right to restriction of processing.
6. The right to data portability.
7. The right to object.
8. Rights in relation to automated decision-making.
9. The right to lodge a complaint with a supervisory body.

Exercising Your Rights

(1)  In relation to personal data processed by NHS NSS

If you have questions, or complaints or would like to make a data subject access request (DSAR) regarding how your personal data is collected and processed by NHS NSS, the contact information you need is noted below.

Website:   https://nhsnss.org/contact-us Email Address: nss.dataprotection@nhs.scot

Postal Address: Gyle Square, 1 South Gyle Crescent, Edinburgh, EH12 9EB Telephone:  0131 275 6000

For more information about your rights and how to invoke them in relation to your test results, visit the website at:   https://nhsnss.org/how-nss-works/data-protection

(2)  In relation to personal data processed by PHS

If you have questions, or complaints or would like to make a data subject access request (DSAR) regarding how your personal data is collected and processed by NHS NSS, the contact information you need is noted below.

Website: //www.publichealthscotland.scot/contact-us/ Email Address: phs.dataprotection@phs.scot

Postal Address: Gyle Square, 1 South Gyle Crescent, Edinburgh, EH12 9EB Telephone:  0131 314 5436