SERC puts the care and welfare of students, staff and visitors at the centre of everything that it does. With such a large and diverse student and staff population safeguarding health & well-being is a continuous challenge. The increasing prevalence of “at-risk” or clinically vulnerable students/staff as well factors such as the current worldwide pandemic has made this task even more difficult.

SERC is continuously monitoring its own procedures to safeguard health & well-being and as such has recently introduced a suite of protective measures/processes to provide individuals with reassurance that they are entering an area where their health is a priority. Measures include ‘one-way traffic’ around the buildings, awareness videos, blended learning and working from home arrangements for staff.

Where a process requires the processing of personal data, the data will be processed in compliance with the General Data Protection Regulations (GDPR) and the Data Protection Act (2018).

The Data Protection Officer for the College is Sian Harvey.

Purpose of Processing

The processes which will involve us processing personal data are:

Temperature screening

A temperature of 37.8 degrees or above can be an indicator of illness and/or infection. Everyone entering SERC buildings will be screened for a temperature.

Administration

Administrative records will be processed to support the College effort to monitor and contain any potential spread of illness/infection. The College will also undertake processes to assess any concerns or potential risks which may be raised by individuals.
Non-identifiable records will also be processed as part of on-going academic research project looking at the relationship between temperature and illness in an indoor public space.

Contact Tracing

The College must share details of positive Covid-19 cases with the Public Health Agency to enable contact tracing to notify those who may have been exposed to the virus.

Department of Health and Social Care (“DHSC”) National Testing Programme

The College is participating in the Department of Health and Social Care (“DHSC”) National Testing Programme. The target for this service is asymptomatic testing with the use of lateral flow technology. The College for the purpose of this programme is a Participating Organisation who will participate in the Workplace Collect Testing workstream. This will involve the running of a Covid-19 self-testing programme, in which LFD self-test kits are provided to:
Staff
Students
Consideration to members of public who may access close contact services such as Hair & Beauty services.
The College is the Data Controller for the purpose of collecting information of individuals who present themselves to collect a test kit and with your results which you must report us. The categories of information collected are based on DHSC requirement.
DHSC assume the responsibility for the processing of your data once you upload your results to the NHS Test & Trace self-report website: https://www.gov.uk/report-covid19-result
Please see DHSC Privacy Notice ‘Lateral Flow Testing’

The above processing activities have been introduced for reasons of ‘substantial public interest’ and where this helps to meet our broader social obligations such as where it is necessary for us to fulfil our legal obligations and regulatory requirements. The activities will further provide reassurance to staff, students and visitors that the College is taking various measures to safeguard their health and that of others.

What information will we collect?

In compliance with the ‘data limitation’ Principle of GDPR, the College will only collect data which is necessary to fulfil the purpose of protecting everyone from exposure to illness/infection and take action where appropriate.

Temperature  
Name  
Student ID (if applicable)  
Date of birth  
Contact number  
Course tutor  
Purpose of visit
Health information
Personal circumstances
Contacts (i.e. those who the individual has been in close proximity to)
Number of testing kits issued to the individual
Date issued
Test LOT number

Lawful Basis

The College is permitted to process personal data where there is a lawful basis to do so. The lawful basis for the above mentioned processing are as follows:

GDPR Article 6.1(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes. (The College will provide privacy information regarding Lateral Flow Testing. If an individual subsequently presents themselves to collect a test kit, it will be accepted that informed consent applies)

GDPR Article 6.1(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

Our lawful basis for processing ‘Special Category’ data is:

GDPR Article 9.2(b) - processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.

Data Protection Act (2018) Schedule -

Data Protection Act (2018) Schedule 1 (Part 1 (1)) - Employment, social security and social protection.
Data Protection Act (2018) Schedule 1 (Part 2 (6)) - Statutory etc and government purposes

Who will have access to my information, or who will you share it with?

The College has a contract with a third party company to operate the temperature screening equipment.

College Management Team
Campus Manager/Duty Manager
First Aider
Head of Health and Safety
Pastoral Care Team
HR/Line Manager (Staff only)
Appropriate curriculum staff (Students only)
Public Health Agency (Details on how the PHA will process your data can be found here)
DHSC

We may rely on a number of exemptions, which allow us to share information without needing to comply with all the rights and obligations under the Data Protection Act (2018).

For full details on our Privacy Notice and your Rights, please visit our website on  https://www.serc.ac.uk/customer-privacy