PRIVACY NOTICE FOR TEST AND TRACE
Date: 28 August 2020
What is the purpose of this document?
Wrigleys Solicitors LLP (registered number OC318186) of 19 Cookridge Street, Leeds, West Yorkshire, LS2 3AG is committed to protecting the privacy and security of the personal information of all those whose personal data we process. As we return to our offices following the Covid-19 pandemic, we are keen to assist the government in its Test and Trace programme. We are therefore asking all those attending our office (“Data Subjects”) to provide us with contact information we can share with NHS Test and Trace if requested.
This privacy notice describes how we collect and use personal information about Data Subjects in connection with the NHS Test and Trace programme, in accordance with the General Data Protection Regulation (GDPR). This privacy notice is supplemental to any other applicable privacy notice relating to how we process personal data and should be read in conjunction with the relevant further privacy notice (for example, if a Data Subject is a client, our privacy notice for clients (available on our website) will apply alongside this privacy notice).
Wrigleys is a "data controller". This means that we are responsible for deciding how we hold and use personal information about Data Subjects. We are required under data protection legislation to notify Data Subjects of the information contained in this privacy notice.
This notice does not form part of any contract we enter into to provide our services to our clients or any contract with our employees or contractors. We may update this notice at any time.
It is important that Data Subjects read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about Data Subjects, so that they are aware of how and why we are using such information.
Data protection representatives
If you have any questions about this privacy notice or how we handle the personal information referred to in it, please contact our Data Protection Representatives (via firstname.lastname@example.org). If you have any complaints about the processing of the personal information referred to in this privacy notice, you have the right to make a complaint to the Information Commissioner's Office (ICO) (www.ico.org.uk), the regulator and supervisory authority for data protection in the UK.
The kind of information we hold about Data Subjects when collecting and sharing information for the purpose of NHS Test and Trace
We will collect, store, and use Data Subjects’ names and contact details for the purpose of sharing this with the NHS Test and Trace programme if we are asked to do so.
We do not anticipate that we will collect any special category personal data (as defined in the GDPR) or criminal conviction personal data about Data Subjects in the course of collecting information for the NHS Test and Trace programme.
How is personal information about Data Subjects collected?
We will collect personal information about Data Subjects either directly from the Data Subject or using information we already hold (e.g. contact details).
Wherever possible, we will ask Data Subjects to complete an online form (accessed through a QR code we make available) to collect personal information in connection with NHS Test and Trace. Microsoft will act as our data processor in collecting and sharing this information with us through the online form, following receipt of which we will store the information securely. Microsoft’s privacy notice can be found on the online form.
How we will use information about Data Subjects
We will only use personal information about Data Subjects when the law allows us to do so. In connection with the NHS Test and Trace programme, we have identified that we have a legitimate interest in collecting this information to ensure the wellbeing of our staff and visitors and the wider public, and also in ensuring that we comply with government guidance. Collecting contact and attendance information for Data Subjects is necessary to pursue these legitimate interests.
We have balanced Data Subjects’ rights and freedoms by only collecting information required by NHS Test and Trace and only storing it for as long as is required by NHS Test and Trace. Further, we have ensured that the Data Subject has been informed (by this privacy notice and the short form privacy statement available at the point of collection) as to how their personal information will be processed.
If a Data Subject fails to provide personal information (or we do not have it) or if a Data Subject opts out of sharing the information with NHS Test and Trace
Where a Data Subject fails to provide personal information (or we find that we do not have it) or where a Data Subject opts out of providing information to us, we will be unable to share their information with NHS Test and Trace if we are asked to do so.
Even where a Data Subject has opted out of sharing information with NHS Test and Trace, we will continue to keep details of all those who enter and leave our offices for health and safety purposes or where we have another lawful reason for holding that information (as identified in our other privacy notices to which this notice is supplemental).
Change of purpose
We will only use personal information about Data Subjects for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use personal information of Data Subjects for an unrelated purpose, we will tell them about the legal basis which allows us to do so.
Please note that we may process personal information about Data Subjects without their knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Sharing personal data with the NHS Test and Trace programme
We will, if requested to do so, share attendance and contact information of Data Subjects with the NHS Test and Trace programme, who will then process the information in accordance with their privacy notice.
Why might we share personal information about Data Subjects with third parties?
We have identified above our legitimate interest in sharing personal information with the NHS Test and Trace programme. For further information on how we share personal information with other third parties, please consult the relevant privacy notice to which this notice is supplemental (e.g. clients should consult our privacy notice for clients available on our website).
Data transfer outside of the EU
We do not anticipate that information held in connection with the NHS Test and Trace programme will be shared outside of the EU (which, for the purpose of this privacy notice, includes the UK during the transition period following the UK’s departure from the EU).
We have put in place measures to protect the security of personal information about Data Subjects and restrict access to the personal information about Data Subjects required for contact tracing. Details of these measures are available upon request.
We will only retain personal information about Data Subjects collected in connection with the NHS Test and Trace programme for 21 days, after such time we will destroy the information.
In some circumstances we may anonymise or pseudonymise personal information about Data Subjects so that it can no longer be associated with them, in which case we may use such information without further notice to them.
Data Subjects' duty to inform us of changes
It is important that the personal information we hold about Data Subjects is accurate and current. We ask that Data Subjects keep us informed if their personal information changes.
Data Subjects' rights in connection with personal information
Under certain circumstances, a Data Subject has the right to exercise certain rights under data protection law. Further detail on these rights can be found in the corresponding privacy notice to which this privacy notice is supplemental (e.g. clients should consult our privacy notice for clients available on our website).
Changes to this privacy notice
We review this privacy notice periodically and reserve the right to update it at any time, and we will make a new privacy notice available to Data Subjects when we make any substantial updates. We may also tell Data Subjects in other ways from time to time about the processing of their personal information.
If you have any questions about this privacy notice, please contact our Data Protection Representatives, via email at email@example.com, post to 19 Cookridge Street, Leeds, LS2 3AG or telephone 0113 244 6100.