Test and Trace Self-Isolation Support scheme – Data Sharing Agreement
The information you submit on your application for a Test and Trace Self-Isolation Support scheme payment will be processed by Central Bedfordshire Council for the purpose of confirming your eligibility for this Test and Trace Self-isolation Support scheme payment to enable you to stay at home and stop the spread of the COVID-19.
The personal data we will collect and process
When completing the application you may be asked to provide the following information:
- full name
- full residential address
- contact details (for example, an email address or phone number)
- proxy applicant details (as above where you may nominate someone else to complete this application on your behalf)
- employer name and address (where applicable)
- Contact Tracing ID (the unique reference you will be given by NHS Test and Trace to self-isolate)
- bank account details
- bank statements
- National Insurance Number
- a recent payslip or proof of self-employment, for example recent business bank statement (within the last 2 months), most recent set of accounts or evidence of self-assessment
- details of a child or young person who has been instructed to self-isolate
Source of personal data
The NHS Test and Trace service will confirm if an individual has either tested positive for COVID-19 or been in close contact with someone who has tested positive for COVID-19 and their vaccination status, and if they have been told to self-isolate as a result. As this data is related to an individual’s health it is referred to as ‘special category data’.
You or your nominated representative will be asked to provide the relevant personal data referenced above in relation to an application for a Test and Trace Support Payment. Central Bedfordshire Council will verify this using the NHS Test and Trace data.
Central Bedfordshire Council will also use the information it holds to verify your application and where appropriate use it for Council Tax, Housing Benefits and housing purposes.
What the personal data will be used for
The Council will carry out eligibility verification checks and potentially share data with the NHS Test and Trace Service, the Department for Work and Pensions (DWP) and Her Majesty’s Revenue & Customs (HMRC) for verification purposes.
Certain information will be provided to HMRC in relation to any payments made, as Test and Trace Support Payment scheme payments are subject to tax and National Insurance contributions and we may check this with your employer.
Where applicable we will check the child or young person’s details with their education or childcare setting.
To validate your bank account details, we need to share relevant information you've given us with TransUnion. This will be used to ensure your support payment is paid to the correct bank account and to help prevent fraudulent use of support payments. This is not a credit check and won't impact your credit rating. Find out how TransUnion can use your information.
Individuals who are self-employed will need to declare any payment on their self-assessment tax return. Information relating to applications will be shared between Department of Health and Social Care (DHSC) and the Council, to help understand public health implications, support anti-fraud checks and determine how well the scheme is performing.
Irregularities Central Bedfordshire Council find, in checking your application details against the information it holds, may be used for Council Tax, Housing Benefits and housing purposes.
We will not share your data with other organisations or individuals outside of the Council for any other purpose, unless the law allows it, such as for the prevention and detection of fraud. All information is processed in accordance with the Council's Data Protection policy.
Our lawful basis for processing the personal data
When using personal data to confirm that an individual is eligible for a Test and Trace Support Payment, the sections of the law that apply are:
- GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare
- GDPR Article 9(2)(b) – Social Security or Social Protection obligations
- Data Protection Act 2018 Schedule 1 Part 1 (3) – public health purposes, Part 1 (1) Social security and social protection
Separately, special permission from the Secretary of State for Health and Social Care is in place to use confidential patient information without people’s explicit consent for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health.
This is known as a ‘section 251’ approval and includes, for example, using an individual’s test results if they test positive for COVID-19 to start the contact-tracing process.
The part of the law that applies here is section 251 of the National Health Service Act 2006 and Regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002.
You can find out more information in the NHS Contact Tracing Privacy Notice and privacy information for the NHS Test and Trace self-isolation support payment scheme has been published by the Department of Health and Social Care.
How long the information will be kept
The information will be retained for eight years and only as long as necessary.
You have the right to ask us for a copy of the data we hold about you, and to rectify inaccurate information and to object to the processing of your personal information in certain circumstances.
Please contact the Council’s Data Protection Officer firstname.lastname@example.org if you would like to utilise your rights and in the first instance, if you have any concerns about the way your personal data is processed. Once we have dealt with your concern you have the right to contact the Information Commissioner's Office (ICO).