Coronavirus - Test & Trace FAQs for Academies & Maintained Schools

The use of personal data in relation to coronavirus is a case point. Here we look at some of the key data protection issues for schools that we have been asked to advise on recently.

Q: A parent has told us that the school is not to share information about them or their child with NHS Test and Trace under any circumstances. Where do we stand?

DfE guidance provides that a school's first port of call would be to contact the health authorities through the DfE helpline. As such, we suggest treating such a request as a request  to not share COVID-19 related information with health authorities more generally, not just Test and Trace.

Data protection law does not prevent a school from sharing information about pupils and parents with health authorities, even against their wishes. If a situation does in fact arise, any decision to pass information on should involve a balancing exercise based on the individual circumstances of the case taking account of the wider benefits (for example, to public health) against individual data protection rights.

The school should look carefully at the reason for the objection and in many cases may well conclude that the balance lies in favour of disclosure. Any objection might count as a formal 'right to object' request under the GDPR.

Q: Our sports facilities are used by the public. Is there anything specific we need to be aware of?

Organisations in the hospitality sector are required to keep records relating to staff and customers and share those records with NHS Test and Test if requested. This may be relevant to school commercial activities as the requirements apply to a number of different settings including cafes and indoor sport and leisure centres. 

See the Gov.uk page on maintaining records of staff, customers and visitors.

Q: A pupil has tested positive for COVID-19.  DfE guidance states that "Schools must not share the names of people with coronavirus (COVID-19) unless essential to protect others." Does this mean that we cannot tell staff?

This will require a careful judgement and should be considered on a case-by-case basis. Adopting a blanket rule that all staff will be informed is unlikely to be data protection compliant. There may be specific circumstances that would justify revealing the name of the pupil to specific staff members, for example, if a member of staff had been in close contact with the pupil and lived with a vulnerable individual.

Q: Can we require pupils aged 16 and over to use the NHS Test and Trace app?

Data protection law does not prevent this in principle but such a policy would raise a number of additional legal and practical issues, particularly as DfE guidance states that pupils are not required to use the app. In addition, the app does not work on older devices and the school will also need to consider how such a policy would fit in with the school's existing mobile phone policies and practices.

If this is something that your school does wish to pursue then you will also need to consider the same sorts of wider data protection compliance issues that you might have already considered when handling personal data relating to the pandemic.  For example:

• The school must be satisfied that what it plans to do is fair, necessary and proportionate. The school should also carry out a data protection impact assessment (DPIA), to help identify, document and mitigate risks. 
• Pupils, parents and staff should be given clear information about how their personal data will be used, including information about who the school will share information with (both within the school and with external agencies, such as the health authorities).
• The school will also need to make sure that it has identified the relevant lawful basis under Article 6 of the GDPR. Health information counts as 'special category' data, so the school will also need to identify a condition for the processing (in addition to a lawful basis) under Article 9 of the GDPR / Schedule 1 of the Data Protection Act.

For specialist advice on data protection, please contact Andrew Gallie in our Information Law team on 07467 220831. Alternatively, complete the form below.