This notice explains how the University of Aberdeen handles the personal information of individuals to support contact tracing by NHS Scotland. Separate University privacy notices describe how we handle personal information about students and staff on a routine basis.
Who we are
The organisation responsible for the personal information in terms of data protection legislation is the University of Aberdeen.
If you have any questions about the University’s handling of personal information, or the rights under privacy laws, you can contact the University Data Protection Officer in the following ways:
By email: dpa@abdn.ac.uk
By post: King’s College, Aberdeen. AB25 3FW
Information we collect and use
We collect the following information from the Test & Protect Contact form that you complete when you visit one of the University’s Aberdeen campuses:
- Personal identifiers: name
- Relationship to the University of Aberdeen
- Contact details: email address and telephone number
- Details of visit to campus: date, time, buildings visited and purpose
We also use the same types of information from the following systems to determine whether you have been in an affected location:
- Electronic point of sale systems, which indicate the users of retail outlets managed by the University
- SafeZone, which indicates the presence of SafeZone app users on one of the Aberdeen campuses
- MyTimetable, which indicates the attendance of students at timetabled teaching sessions on one of the Aberdeen campuses
- Attendance records for students in the Institute of Education for Medical and Dental Sciences
- Door entry system, which indicates the presence of student and staff users in buildings controlled by swipe-card access
- CMIS Go, which indicates student bookings of study spaces on one of the Aberdeen campuses
- Accommodation system, indicating which students occupy rooms in accommodation managed by the University
- Reset, which indicates the presence of contractors on one of the Aberdeen campuses
Information from these systems may be linked to details from the Student Record System or the Human Resources system to identify you.
Why we process this information, and our lawful basis
We use personal information in this way to support NHS Scotland to identify, alert and support people who appear to have been in contact with a person who has tested positive for coronavirus.
There are two lawful bases for processing this personal information. These are as follows:
The University is legally obliged to collect information about visitors to premises in which food or drink is sold for consumption on the premises. This requirement is set out in The Health Protection (Coronavirus)(Restrictions)(Scotland) Amendment (No. 11) Regulations 2020.
The University is acting in the legitimate interests of NHS Scotland and of the University to collect information about students, staff and visitors who may be at risk of coronavirus. This is in the interests of the health of individuals, of the safe operation of the University’s campuses and of the public health efforts to interrupt the spread of coronavirus in the community.
Disclosing your information
The University will disclose personal information to NHS Scotland if the NHS contacts the University for information to pursue contact tracing. Further details on this service can be found at http://www.nhsinform.scot/campaigns/test-and-protect.
We will not routinely disclose your personal information to any other organisation. We may disclose personal information to other recipients in exceptional circumstances or when required to do so by law.
The external suppliers we use for IT support may have access to your personal information in order to provide that service to the University. These arrangements may involve transfers of personal data outside the European Union. Our third-party supplier arrangements are regulated by contracts designed to protect the information and limit the way it is used.
How long your information is kept
Personal information collected on the Test & Protect Contact form for contact tracing purposes will be held by the University for a period of 21 days from the date of collection and will then destroyed securely.
We will retain personal information from other systems processed to respond to contact tracing requests for as long as required by NHS Scotland and to fulfil the University’s role in the process.
Your rights
You have the right to request access to your personal information, to ask for personal information to be corrected, erased or used for limited purposes.
You also have a right to object to the use of your personal information in this way where the University is acting on the basis of legitimate interests.
You can ask about your privacy rights or make a request about personal information by contacting the University Data Protection Officer at the address above.
If you are dissatisfied with the way the University has handled personal information or dealt with a data protection issue, you have the right to lodge a complaint with the Information Commissioner. The Information Commissioner’s Office can be contacted via their website at www.ico.org.uk/concerns/.