The test being performed is called a lateral flow test (LFT). This is a self-administered swab test which can provide results within 20 to 30 minutes.
We're following the instructions of the Department of Health and Social Care (DHSC). It's important that you read this notice and DHSC’s Privacy Notice to understand how your personal data will be used as part of this programme.
Prior to receiving your LFT you'll be required to register using the online booking system, the system is hosted by NHS Digital and operated by DHSC and NHS Digital. If you're unable to access to the online booking system you'll need to register with a member of staff who will complete the registration on your behalf.
You'll then be required to register and will be asked a series of questions by our staff. You'll then be provided with a unique test kit barcode which you'll need to input into the system.
Once you have completed your LFT it will be analysed by a member of the community testing team. This is carried out at the testing station. The results of your test will be uploaded directly on to the NHS Digital portal where they'll be sent to you via text message and email.
Information we collect
Basic details about you including name, address, date of birth, telephone number and email address. We'll ask for your NHS number if you have it.
We'll also need to collect details about your health to identify if you have any coronavirus symptoms.
We'll also ask for details of your gender, ethnicity and work status.
Processing your data
All personal data held is processed in accordance with the Data Protection Act 2018 and General Data Protection Regulation. We're the data controller for the information outlined.
The results of your test are stored by NHS Digital. We do not have access to this system.
Using the information
We'll use the information you provide to comply with testing requirements on behalf of the Department of Health and Social Care.
We'll use your data will also be used to assess the effectiveness of community testing and to improve the service.
Purpose of processing
The legal basis for processing the data is that it is in the public interest for us to identify and limit the spread of COVID-19.
The General Data Protection Regulation requires specific conditions to be met to ensure that the processing of personal data is lawful. These relevant conditions are:
- Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- Section 8(c) of the Data Protection Act sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law
The conditions for processing special categories of personal data, which includes data concerning a person's health and ethnicity are:
- Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems
- Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health
- Data Protection Act 2018, Schedule 1, Part 1(3) – processing is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, for example, governmental guidance published by Public Health England
Sharing your information
We'll not share your personal information with any third parties, except for when required to do so by law in order to improve the government's response to the COVID-19 pandemic. Your data will not be transferred or stored on a system outside of the EEA.
Amount of time we will hold your information
We'll only keep your information for as long as it necessary, taking into account government advice and the ongoing risk presented by coronavirus. At a minimum the information outlined in this privacy notice will be kept for the duration of the COVID-19 response.
When the information is no longer needed for this purpose, it will be securely deleted.
You have rights regarding your personal information including the right to access copies any records we hold about you.
For detailed advice on your rights visit the Information Commissioner's Office (ICO).
All personal information we record is stored securely and in accordance with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR).
Your data is held on secure internal systems. If you have any queries, concerns or complaints, relating to you, about how we obtain, use, store or share your personal information, or if you wish to make a request relating to your individual rights under the new legislation, please contact us:
Or you can write to our data protection officer at:
Derbyshire County Council
If you're not satisfied with our response, you can contact the Information Commissioner's Office with your concerns.
Tel: 0303 123 1113 (local rate) or tel: 01625 545 745 (national rate).
Information Commissioners Office