Covid-19 testing: processing personal data of staff and students

As part of the on-going response to the Covid-19, BU may carry out additional processing of staff and student personal data. Your information will be processed where this is necessary for the purposes of public health and to safeguard vulnerable people.

The approach set out in these privacy notices was approved by BU’s Major Incident Group in 2020. Since then, we have continued to keep our approach under review and change it if required in light of changes to the law or government guidance. Individual decisions on the processing of this information (including decisions on disclosure of information to public health authorities and decisions on internal use of information) are taken by Karen Parker (Director of HR Services) or her nominee in respect of staff information and by Mandi Barron (Director of Student Services) or her nominee in respect of student information. 

When we refer to “public health authorities”, we mean any organisation with public/government functions in relation to public health. This will include Public Health England and any organisation which replaces it or works with it in relation to infection control activities, and local public health authorities.

The following principles will be applied in making individual decisions about processing of personal data related to Covid-19, i.e. information relating to identifiable individuals:

  • Processing of personal data will be minimised. This means that we will only process information in a form which identifies individuals (rather than being anonymised) where this is necessary for the relevant purposes, and we will put appropriate protections in place to minimise potential access to identifiable information. The names of individuals will only be shared if necessary.
  • BU will only disclose personal data externally where this is requested by a relevant government, NHS or public sector organisation and we are satisfied that the disclosure is required by law or necessary for the performance of a public task (such as protection of public health)
  • BU will comply with the Data Protection Policy in processing personal data for these purposes.

Catering services at BU are provided by our contractor Chartwells. They are separately responsible for processing customer information and will provide you with privacy information about this if it’s relevant to you when using their services.

Your data protection rights

Under the data protection laws, you have a number of rights in relation to our processing of your data. In summary, these are:

  • Right to request access to your data as processed by BU and information about that processing [“subject access request”]
  • Right to rectify any inaccuracies in your data
  • Right to request erasure of your data from our systems and files
  • Right to place restrictions on our processing of your data
  • Right to object to our processing of your data
  • Right to data portability: where we are processing data that you have provided to us, on the basis of consent or as necessary for the performance of a contract between us, you have the right to ask us to provide your data in an appropriate format to you or to another controller.

Most of these rights are subject to some exceptions or exemptions, depending on the purposes for which data is being processed.

If you have any questions or concerns about our processing of your data in relation to Covid-19, please contact the BU Data Protection Officer (DPO):

Email: [email protected]

Telephone: 01202 962472

Address: Poole House, Bournemouth University, Fern Barrow, Poole BH12 5BB

If you would like to exercise any of your rights as outlined above, you can contact the DPO as above or visit the Data Protection page on our website to access the relevant forms.

We will always aim to respond clearly and fully to any concerns you have about our processing and requests to exercise the rights set out above. However, as a data subject if you have concerns about our data processing or consider that we have failed to comply with the data protection legislation then you have the right to lodge a complaint with the data protection regulator, the Information Commissioner:

Online reporting: https://ico.org.uk/concerns/

Email: [email protected]

Tel: 0303 123 1113

Post:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF