Local Tracing Partnership (LTP) - Privacy Notice


  • Date of issue - 26 November 2020
  • Date of current version - 8 April 2022
  • Review date - 30 June 2022


The reasons why we use your personal data

This privacy notice describes how we may use your information during the COVID-19 outbreak. It supplements our COVID-19 Privacy Notice.

Surrey County Council is working with Public Health England, the Districts and Boroughs and third-party organisations in a Local Tracing Partnership (LTP) to deliver the Contact Tracing Service.

Read Public Health England's privacy notice on how they are handling your information for Test and Trace.

Contact tracing is an important way of controlling the spread of infectious diseases. It involves identifying and tracing all the people who have been in contact with a person who has been infected. Depending on the nature and duration of the contact, these contacts may require advice or treatment to prevent the disease spreading further.

What processing of personal data is undertaken by the service?

To trace the contacts of people with COVID-19 and support the LTP, Surrey County Council needs to collect personally identifiable information. To ensure that you have confidence in providing your personal information over the telephone, all call handlers will be calling on behalf of the LTP and will state this at the start of each call.

Surrey Contact Tracing Service

Local contact tracers use the following telephone number:

  • 01483 404939

You can use this number to check the call is genuine.

How we are allowed to use your personal data

The use of your information is covered by the General Data Protection Regulations (GDPR).

The section of the GDPR that applies is:

  • Article 6(1)(e) 'processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller'

As information about health is a special category of personal information, a further section of the GDPR applies:

  • Article 9(2)(i) 'processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare'

What information do we collect?

Personal information will come from different sources:

  • Public Health England
  • The individual cases and contacts
  • Third party organisations/settings (e.g. workplaces, schools, care homes, other local authorities)

The data will include some of the listed information. It will be kept to a minimum and only processed where it is appropriate to do so.

For an individual who has tested positive for COVID-19 (Case) the following information will be collected:

  • Unique Record ID
  • Full name
  • Date of birth
  • Gender
  • Ethnicity
  • NHS number
  • Home postcode and house number
  • Telephone number and email address
  • Occupation/key worker type
  • COVID-19 symptoms, including when they started and their nature
  • Vulnerability group
  • Shielded status
  • Details of people they have been in close contact with

For those who have been in close contact with someone who tests positive (contact):

  • Full name
  • Date of birth
  • Contact details
  • Ethnicity
  • NHS number
  • Home postcode and house number
  • Telephone number and email address
  • Occupation/key worker type
  • Details of any COVID-19 symptoms they may have had
  • Vulnerability group
  • Shielded status

How do we use your personal information?

This information is used to provide advice on self-isolation and how to protect yourself and others from COVID-19. It will also help identify outbreaks which require support.

Surrey County Council is working with Public Health England to provide the local contact tracing service in response to the coronavirus pandemic. Complex cases will be referred by Public Health England to the LTP. The personal information will be shared with the LTP for the following reasons:

  • Enable contact tracers to call people who have tested positive with COVID-19 to offer advice and gather information about the people they may have come into close contact with and who may have been infected with the coronavirus
  • Enable contact tracers to manage the process of tracing these Contacts to find out if they have any COVID-19 symptoms and if so, to provide advice on how to seek help
  • Enable the necessary sharing of personal information to third party organisations using minimum data
  • Enable the planning, management and containment of local outbreaks
  • Enable the Districts and Boroughs to assist with tracking delivery of their statutory Environmental Health/Food Safety obligations

Who we share your personal data with

Your information will be treated with strict confidence and only disclosed where it is necessary to prevent a COVID-19 outbreak by investigating an establishment for potential Contacts. Where necessary, the minimum amount of personal information will be shared with:

  • Other Local Authorities to enable Environmental Health Officers to assist the establishment and provide advice to contacts
  • Sub-contractors to deliver support/advice in key sectors (e.g. care homes, education, prisons, housing)
  • We may need to disclose your name and the fact that you have tested positive to your employer or the operator of an institution where you have spent significant time if this is necessary to avoid or limit a COVID-19 outbreak in the workplace.

Your information used for other purposes

Your information may also be used for different purposes that are not directly related to your health and care. These include:

  • Research into COVID-19
  • Planning of services or actions in response to COVID-19
  • Monitoring the progress and development of COVID-19

Whenever possible, information that does not directly identify you will be used for these purposes, but there may be times when it is necessary for your personal information to be used. Any releases of information that identify you will be lawful and the minimum necessary for that purpose.

Retention of data

The personal information will only be held as long as directed by the Department of Health and Social Care (DHSC), unless this is superseded by a stop notice in relation to the COVID-19 public inquiry.

Read GOV.UK's Coronavirus COVID-19 Notice for more information.

Local Tracing Partnership daily case data will be retained for 6 months.

Please see our Retention Schedule and Information Asset Register for information on how long we keep specific data.

Other information

Please note that all outgoing and incoming tracing calls are recorded for training and monitoring purposes. Recorded calls are retained for 62 days before being destroyed. Please see our data protection statement on recorded calls for further details.

For further information on our privacy notices, please see information and privacy.