In the context of the pandemic, BU may need to carry out additional processing of your information for the purposes of public health and to safeguard vulnerable people.

This notice only relates to processing of information by BU: it does not cover processing which may be undertaken by third parties such as accommodation providers or Chartwells, our catering providers, except for the sharing of information between accommodation providers and BU as described below.

Covid vaccination status: students undertaking mandatory placements in health and social care settings (from November 2021 onwards)

In November 2021 the government announced that there would be a legal requirement for personnel undertaking activity in NHS and Social Care settings to have received their Covid 19 Vaccinations by 01.04.2022. This requirement applies to students undertaking placements as part of university courses leading to registration in the health and social care professions: if by 01.04.2022 students on these courses are not able to provide the required evidence either of full vaccination or medical exemption from vaccination they will not be able to undertake placement activity in these settings.

BU therefore needs to support placement providers by providing required information and assurance about every student’s vaccine status: this is required to enable BU to plan and manage placements and meet the information and assurance requirements of placement providers.

For these purposes BU is collecting and holding information about the type and date of the vaccinations received by relevant students and will need to share such information with placement providers. Some providers only require an assurance that each student is “fully vaccinated” in accordance with the new requirements, whereas others may require details as to the date(s) of vaccination and type of vaccine. 

BU also needs to collect, hold and share information about students’ medical exemptions from vaccination. This is necessary for the same purposes, and to enable BU, its occupational health services provider and placement providers to undertake appropriate risk assessments of and in connection with medically exempt students before making placement arrangements for them.

The Faculty of Health and Social Sciences is providing students affected by these requirements with guidance on steps to take and further information about processing of their information.   

Covid-19 home test kits 2021-2022

The Department of Health and Social Care (DHSC) has asked universities to support distribution of home test kits to staff and students. BU is working closely with AUB in managing this exercise to support both sets of staff and students.

Prior to 1 September 2021

For health and safety reasons, DHSC needs to be able to trace the end user of a home test kit. To enable this BU is obliged, under its arrangements with DHSC, to set-up and keep a log of those issued with home test kits. This log will cover your first name, surname and contact telephone number, linked to the particular test kit.

The information will be collected by BU staff, or others on BU’s behalf – such as AUB or agency staff, acting as a processor for DHSC.

This information will only be passed to DHSC if they request to see it for health and safety reasons, such as a batch recall, adverse incident investigation or providing a safety notice. BU will not use the information other than to respond to a DHSC request. BU will not hold this information for longer than 12 months after the test kit is provided.

A DSHC privacy notice specific to this processing will be displayed at the point of collection.

As of September 2021

BU is no longer required to record your name, surname and contract telephone number. BU is still required to provide any assistance reasonably requested by DHSC to identify the location of any testing kits impacted by a product recall. Any existing logs currently held by BU in relation to testing prior to September 2021 will be retained, in accordance with the existing agreements with the DHSC, but for no longer than 12 months from the date on which the relevant data is collected, unless DHSC instructs BU to delete or destroy those logs.

Data sharing between accommodation providers and BU

This paragraph relates to BU’s accommodation partners i.e. companies who have a contract with BU for the provision of accommodation and whose accommodation can be booked by BU students through BU’s accommodation portal. Where a student living in their accommodation notifies the accommodation provider that they have tested positive for  Covid-19, these accommodation providers will share this information with BU. BU (rather than the accommodation provider) will then share this information with NHS Test & Trace/public health authorities as described in the section above. This avoids duplication of reporting to public health authorities, which could cause confusion, and supports public health authorities in making quick and fully informed assessments of the infection control situation at BU and any additional steps required to control public health risks. This data sharing is covered by existing data sharing agreements between BU and these accommodation providers, which provide for appropriate management of personal data in compliance with the data protection legislation.

Aside from this data sharing, processing of personal data of students in connection with Covid-19 by accommodation providers (whether or not they are BU accommodation partners) is not covered by this notice. The accommodation providers will separately notify their student residents about how they process this information.

Managing information within BU: self-isolation and positive Covid-19 test results

We ask you to contact AskBU to let us know if:

  • You test positive for Covid-19
  • You need to self-isolate or quarantine for any reason under the terms of government guidance.

We will use this information to:

  • Consider your welfare and ensure you can access support you need to manage your health and wellbeing (further information about support available in these circumstances is on the BU website)
  • Ensure you are appropriately supported to manage any impact on your studies
  • Identify any steps we should take to help ensure a safe environment for staff and other students. These might include additional cleaning, further risk assessment of particular activities and notifying students and/or staff that they have been in contact with someone who has tested positive.

BU Student Services has published information about how students and staff should manage self-isolation.

For these purposes, if you notify us that you have tested positive for Covid-19 and/or you are self-isolating or in quarantine for Covid-19 purposes:

  • We may inform your faculty programme support team. They will process this information in the same way as any other notification of a health-related or personal matter which may affect your studies and may contact you to offer support and discuss how to manage the impact;
  • If we have any concerns about your welfare as a result of your notification, we will pass your details to the Student Support and Engagement Team within Student Services. They will contact you to offer appropriate support; and
  • If you are in BU portfolio accommodation, we may share your information with your accommodation provider (although we will also ask you to notify the accommodation provider direct) so that they are able to offer you support and take any action required to safeguard you and others.

In some circumstances, BU may seek assistance from third-party charitable organisations to help provide practical support to students who are self-isolating/in quarantine, e.g. delivery of food and medicines, and this will require us to share some of your information with the charity. We will let you know if this is relevant to you.

If you tell us that you have received a positive Covid-19 test, we will not disclose information about your Covid-19 status to any external organisation (other than your accommodation provider as stated above) unless required by law or guidance, such as if we receive a request from public health authorities for information required perform their public health and safety roles (see section above). We will use this information within BU on a confidential basis for the purposes of managing risks to the health and safety of students and staff.

We will use data we hold about dates and times when you were on BU premises to decide whether we need to contact you to tell you that you may have been in contact with someone who has tested positive for Covid-19. Please see below for details of when we may record this information.

Information about your Covid-19 status and the fact that you are self-isolating/in quarantine will be processed in accordance with the BU Data Protection policy. We will only share your information in identifiable form where this is necessary for the purposes outlined in this notice.

Recording information about your presence on BU premises

We may record some additional data about dates and times when you have been on BU premises, where this can reasonably be recorded. BU does not have the facility to record information about your presence on BU premises generally, e.g. your entry to or exit from BU campuses or specific BU buildings. BU is not planning to use tracking technology to record individuals’ presence on BU premises. We may record information about your physical use of Library, the gym and certain other on-campus facilities. We may record attendance at timetabled teaching and learning sessions or other pre-arranged meetings with BU staff (in addition to any recording of attendance data usually undertaken in accordance with BU’s Engagement Monitoring and Withdrawal Procedure (3K) (pdf 299kb)). For these purposes we may also use timetabling information (where relevant) to identify when you were on BU premises.

Legal basis under data protection law

Under the data protection legislation, we need to identify and explain the legal basis for the processing of your personal data. For the uses of your data described above we consider this to be:

  • For disclosure as part of NHS Test and Trace and wider public health measures, necessary for the performance of a public task: the public task of the NHS and public health authorities in controlling the spread of Covid-19;
  • Necessary for the performance of our public task as a university, which includes providing a safe learning and teaching environment and supporting you in your studies;
  • Necessary for compliance with legal obligations on BU, i.e. where there is a legal requirement under the Covid-19 legislation to record staff and/or service-user data for Test and Trace purposes;
  • Necessary for legitimate interests, i.e. ensuring health and safety within the university environment. We consider that the scope of data being processed and the way in which we will process it means that our approach is proportionate and the legitimate interests are not outweighed by damage to the rights of the individuals.

Where you tell us that you are experiencing Covid-19 symptoms or that you have tested positive for Covid-19, this is “special category data” which requires an additional legal basis. This is that it is necessary for carrying out BU’s health and safety obligations as an employer and social protection in respect of both staff and students (Article 9(2)(b) GDPR and paragraph 1 of Schedule 1 to the Data Protection Act 2018); and safeguarding of individuals at risk (Article 9(2)(g) GDPR and paragraph 18 of Schedule 1 to the Data Protection Act 2018).  When we process information about your Covid vaccinations or medical exemption from Covid vaccination requirements, the additional legal bases of “necessary for reasons of public interest in the area of public health” (Article 9(2)(i) GDPR) and “necessary for the purposes of preventive or occupational medicine…or the management of health or social care systems and services on the basis of [UK] law” are also relevant.