Track & Trace 

 Here is what the data protection law says:

Can we share personal data with NHS/Track and Trace?

Schools are entitled (and have lawful basis) to share personal data relating to health where necessary relating to employees, pupils, parents and visitors to school under the GDPR and Data Protection Act 2018

Telling people their Personal Data May be Shared 

Pupil Personal Data is shared with the NHS.

“personal data of employees, parents or visitors to school may be shared with NHS/Public Health Agencies where relevant to the Covid pandemic”.

What the ICO says: The ICO states “Where possible, organisations should have clear and accessible privacy information in place before processing begins. However, we recognise that in this exceptional period, this may not always be possible. Organisations should ensure that privacy notices are in place and updated as soon as reasonably practical.”

Sharing Personal Data with NHS/Public Health Agencies 

Where data needs to be shared with Health officials we will: 
• limit the data shared to the minimum necessary, 
• only share data with the appropriate authorities, 
• share via secure methods (e.g. encrypted email). 
• verify the identity of persons making phone calls/sending emails requesting personal data (be aware of the risk of cyber/impersonation crime), 
• keep a note/copy of the data shared at school, 
• notify any individuals whose data has been shared (if practicable).

Sharing Data under the “Track and Trace” Scheme 

Schools may be required to share Personal Data of individuals under the Track and Trace scheme. The scheme does have a Privacy Notice https://contact-tracing.phe.gov.uk/help/privacy-notice  
Personal data of those that attend/work at/visit the school may be shared under Data Sharing Advice for Schools.