Privacy Notice: Local Tracing Partnership for COVID-19

The following Privacy Notice applies to Horsham District Council’s (HDC’s) effective support of the Local Tracing Partnership (LTP) in West Sussex.

This Notice explains how personal information is going to be used, what it is used for, who it might be shared with and why and for how long it is to be kept.

HDC is fully committed to complying with The Data Protection Act 2018 and the General Data Protection Regulation (GDPR). We ensure that your personal data is processed fairly, lawfully kept safe and secure and retained for no longer than is necessary.

Data Controller

HDC is registered as a Data Controller with the Information Commissioner's Office (registration number: Z7294458). As a Data Controller we take all necessary steps to comply with the Data Protection Act (DPA) 2018 and the GDPR when handling any personal information.

What information does the Council collect/ hold?

All cases passed from Public Health England (PHE) to the LTP will be regarding individuals who have had a positive Covid-19 test result.

Data received from PHE and used for LTP comprises:

  • Name
  • Postcode
  • Whether resident in a Care Home
  • Telephone No.
  • D.O.B/Age
  • Gender
  • Ethnicity

Data collected from interviews with contacts and entered into the PHE Contact Tracing and Advice Service (CTAS) computer system may comprise:

  • Symptoms
  • Date of first symptoms
  • Support needs
  • Name and address information
  • Household contacts
    • Resident or visitor
    • Whether over 18
    • Email address
    • Phone number
    • Direct or close contact
  • Workplace/Educational institution Information
  • Place of work
    • Job title
    • Address
    • Postcode
    • Date last attended
    • Contacts – name/surname/phone/email
  • Activities outside the house
    • Activities attended in 7 days before symptoms
    • Nature and details of activity
    • When activity took place
  • Transactional data and activity logging:
  • Outbound call attempts, time, duration, number called
  • Outcome of calls
  • Customer feedback on national and local service provision

Why does the council process personal data?

Part of the National Test and Trace System involves the tracing of contacts of a positive case. The national service attempts to trace/contact all individuals who have been in contact with a positive case, to determine the level of contact and, if necessary, ask them to self-isolate.

Due to rising cases nationally, upper tier/unitary local authorities have been asked, via their Public Health teams, to provide additional capacity to the national service by becoming a LTP. A LTP has therefore been established in West Sussex, working with East Sussex County Council, and with support and guidance from PHE.

The LTP will provide additional capacity to the National Test and Trace Service by contacting non-complex positive cases that the national service has been unable to contact within a window of time. It will ensure that those people will be given advice and support as soon as possible, and that details of their contacts are collected and inputted into the national system for the national team to contact themselves.

The local service is being managed by the West Sussex County Council (WSCC) Customer Experience Service, with dedicated WSCC Community Hub staff undertaking the contacting.

HDC is playing an important role in supporting the effectiveness of the LTP due to our having contact details for local residents  to enable contacting when contact information for those who have tested positive for Covid-19 is incorrect or incomplete.

Who has access to data?

We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

Data collected will be shared with the WSCC Customer Experience Service, Community Hub, entered onto the national CTAS system and shared with the National Test and Trace Service.  Information entered onto CTAS will be viewed by PHE and may be utilised to produce local and national statistics and inform any further actions needed to combat the spread of COVID-19.

We may be required to share information with other statutory bodies or internal services within the Council to full fill our statutory obligations.

Details of transfers to third country and safeguards

If your personal data needs to be transferred outside of the EEA we will make sure that an adequate level of protection is in place.

How does the council protect data?

HDC takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

The personal information that we collect from you must be handled and dealt with properly, covering how it is collected, recorded and used whether it is on paper, in computer records or recorded by other means and how long it is kept.

We store your data in secure electronic management database systems, spreadsheets stored on internal secure folders and accessed on secure encrypted laptops. All data is stored on secure servers.

We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

For how long does the council keep data?

We will only keep your information for as long as it is required to be retained. The retention period is either dictated by law or by our discretion. Once your information is no longer needed it will be securely and confidentially destroyed

What is the Legal Basis to allow us to use your personal information?

There are a number of legal reasons why we need to collect and use your personal information. In this case, we will use the data in order to perform the function and provide the service as set out above in order to protect public health.

What if you do not provide personal data?

We will only ask for personal information that is appropriate to enable us to deliver our services. If you have not provided the information we need then we may not be able to provide/ process the above service.

Your rights

You have the right to:

  1. Be informed of data processing (which is covered by this Privacy Notice).
  2. Access information (by making a Subject Access Request).
  3. Have inaccuracies corrected.
  4. Have information erased.
  5. Restrict processing.
  6. Data portability.
  7. Intervention in respect of automated decision making and profiling.
  8. Withdraw consent (see above).
  9. Complain to the Information Commissioner’s Office (See below).

To exercise any of these rights please contact:

Information Governance Team, Parkside, Chart Way, Horsham, West Sussex RH12 1RL


As a public authority we are required to have a Data Protection Officer who is responsible for monitoring HDC’s compliance with the DPA 2018, GDPR and other data protection laws.  Our Privacy Statement is available on our website.

If you need to contact the Data Protection Officer, contact details are:

Sharon Evans,  Data Protection Officer, Parkside, Chart Way, Horsham, West Sussex, RH12 1RL


Last review date: November 2020