In the context of the pandemic, BU may need to carry out additional processing of your information for the purposes of public health and to safeguard vulnerable people.

Managing information within BU: self-isolation and positive Covid-19 test results

If you self-isolating under the terms of the government guidance you should contact your line manager to explain the position and make arrangements to work remotely. We will support you in following government guidance. Further information and guidance on self-isolation and/or quarantine can be found on the staff intranet.

If you test positive for Covid-19, we would ask you to let us know by emailing [email protected]. This mailbox can only be accessed by a limited number of staff, who will keep your information strictly confidential. We will use this information to identify any steps we should take to help ensure a safe environment for staff and students. These might include additional cleaning, further risk assessment of particular activities and notifying staff and/or students that they have been in contact with someone who has tested positive. We will not disclose your name to others at BU as the person who has tested positive.

If you are waiting for the results of a Covid-19 test, if you wish we can support you in alerting colleagues or students with whom you’ve been in recent close contact, in line with the government guidance. Again, we will not use your name when passing on this information.

If you tell us that you have received a positive Covid-19 test, we will not disclose information about your Covid-19 status to any external organisation unless required by law or guidance, we will, however, use this information within BU on a confidential basis for the purposes of managing risks to the health and safety of staff and students.

We will use data we hold about dates and times when you were at work on BU premises to decide whether we need to contact you to tell you that you may have been in contact with someone who has tested positive for Covid-19.

Legal basis under data protection law

Under the data protection legislation, we need to identify and explain the legal basis for the processing of your personal data. For the uses of your data described above we consider this to be:

  • For disclosure as part of NHS Test and Trace and wider public health measures, necessary for the performance of a public task: the public task of the NHS and public health authorities in controlling the spread of Covid-19;
  • Necessary for the performance of our public task as a university, which includes providing a safe learning and teaching environment;
  • Necessary for compliance with legal obligations on BU, i.e. where there is a legal requirement under the Covid-19 legislation to record staff and/or service-user data for Test and Trace purposes;
  • Necessary for legitimate interests, i.e. ensuring health and safety within the university environment. We consider that the scope of data being processed and the way in which we will process it means that our approach is proportionate and the legitimate interests are not outweighed by damage to the rights of the individuals.

Where you tell us that you are experiencing Covid-19 symptoms or that you have tested positive for Covid-19, this is “special category data” which requires an additional legal basis. This is that it is necessary for carrying out BU’s health and safety obligations as an employer and social protection in respect of both staff and students (Article 9(2)(b) GDPR and paragraph 1 of Schedule 1 to the Data Protection Act 2018); and safeguarding of individuals at risk (Article 9(2)(g) GDPR and paragraph 18 of Schedule 1 to the Data Protection Act 2018).