Oxford Brookes University (Oxford Brookes) will be the Data Controller of any Personal Data that you supply for the purpose of booking or collecting an Asymptomatic Covid test.
This means that Oxford Brookes will make the decisions on how your data is used and for what reasons. You can contact OBU’s Information Management Team on email@example.com.
Why do we need your data?
Oxford Brookes is performing Asymptomatic COVID-19 testing on behalf of the NHS and from mid May will also be providing LFD home test kits for staff and student use. Your personal data is needed by Oxford Brookes when you choose to book a test appointment. Your data will also be collected for the purpose of identifying students who have a positive test result so that contact tracing can be undertaken and support provided.
For Asymptomatic Covid Testing both on site and for the collection of home tests from May 2021 student or staff ID is recorded against the unique reference number of test registration cards or test kits, along with the specific site ID for the test site you have attended. We do this in order to enable us to identify the identity of staff and students who have a positive Covid test, and to support product recall tracing. We will capture this information securely at the point of registration. Positive testing on site will be matched with test result data if that result is positive. We will then record the positive result using our Covid Reporting Form, undertake contact tracing with students and staff and put in place any necessary support for self-isolation, as per our Covid Response process.
For onsite LFD testing:
Please note that your registration for the test (on arrival at the test centre) and the return of your test results is covered under this separate Privacy Notice produced by the Department of Health and Social Care (DHSC) for the Covid testing programme.
When Oxford Brookes records your test results at the test centre, it is providing DHSC with non-identifiable data only – ie. a barcode ID and a test result. This is then matched with the personal data you give DHSC when you registered with that bar code on arrival at the test centre.
For home LFD testing:
This is covered under a separate Privacy Notice. You will be responsible for submitting your own test results onto the NHS portal and onto a separate University reporting form to enable the Covid response team to begin contact tracing and put in place support processes during any self-isolation periods.
Oxford Brookes’ legal basis for collecting and/or using this Personal Data (information) is:
- Public task: the processing is necessary for Oxford Brookes to perform a task in the public interest or for official functions in line with the University’s legal powers and Constitution (core business).
If you are sharing sensitive data (Special Category) such as: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, data concerning health or sexual life, genetic/biometric data or criminal records Brookes it is lawful for this data to be processed because one of the following processing grounds applies:
- Oxford Brookes need to use this data for public health where there is public interest such as infection control and ensuring high standards of medical care or delivery.
What types of personal data will Oxford Brookes University use?
Oxford Brookes will collect the following personal data for the booking system:
- Student/Staff number
- Contact number
- Whether you require any special assistance with the test
Oxford Brookes will collect the following personal data at the point of test registration and processing:
- Student/Staff ID number
- Test registration barcode/ref number
- Positive Covid test result (for tests carried out on site)
Oxford Brookes will collect the following personal data at the point of registering a home LFD test result:
- Student/Staff ID number
- Source of Test
- Date of Test
- Test Result
Whom will Oxford Brookes share your data with?
Your personal data collected for the purpose of booking the test will not be shared outside of Oxford Brookes.
If you have a positive test result this will be shared in line with our Privacy Notice for Covid reporting.
Please read the DHSC Privacy Notice for information about how your personal data will be used when you register for the test on arrival at the test centre.
Data may also be used for research purposes.
Will your data be transferred outside the EEA?
What rights can you have regarding your personal data that Oxford Brookes holds?
- You have the right to be informed
- You have the right of access to your data
- You have the right to correct data if it is wrong
- You have the right to ask for your data to be deleted
- You have the right to restrict use of the data we hold
- You have the right to data portability
- The right to object to OBU using your data
- You have rights in relation to using your data automated decision making and profiling.
Your rights will depend on the legal ground used to process your data.
What was the source of your data?
Personal data provided by you via an online booking system and on arrival at the test centre.
Are there any consequences if you refuse this processing?
Brookes may not be able to provide you with a Covid-19 test.
Will there be any automated decision making using my data?
How long will Oxford Brookes keep your data?
Oxford Brookes will keep your data for as long as is necessary or in line with the Oxford Brookes Retention Schedule (whichever is the shorter period)
Whom can you contact if you have concerns?
You can contact the IT Services Information Security Management Team via firstname.lastname@example.org if you have a concern about Data Protection matters or if you want to exercise your rights under Data Protection or Freedom of Information law.
You can contact Oxford Brookes‘ Data Protection Officer via BrookesDPO@brookes.ac.uk. The Data Protection Officer ensures that Data Protection provisions are applied lawfully in Oxford Brookes.
You can contact the information Commissioner via the website ICO.org.uk if you wish to contact the national regulator for Data Protection or Freedom of Information matters.