Government of Jersey coronavirus (COVID-19) privacy notice

What is covered under this privacy notice

This privacy notice covers the following from the Public Health directorate:

• PCR Testing
• LFT testing
• Management of confirmed COVID-19 cases
• Jersey COVID App
• reporting statistics
• Government of Jersey Co-Funding Scheme

Strategic Policy, Planning and Performance (SPPP) is registered as a 'Controller' under the Data Protection (Jersey) Law 2018 (the “Data Protection Law”), as we determine the purpose and means of the processing of the personal information collected about you for this service.

SPPP process and hold your information in order to provide public services and meet our statutory obligations. This notice explains in more detail how we use and share your information in order to provide the service described above.

For information on how SPPP uses your personal data for other services, see the Government’s webpage States of Jersey privacy policies.

For other privacy policies for COVID-19, see the webpage Coronavirus privacy policies. 

We will continually review and update this privacy notice to reflect changes in our services and feedback from service users, as well as to comply with changes in the law.

How we collect information about you

Information about you will, in most cases, be collected directly from you. This may be done in any of the following ways:

• data is collected either in person, online or via telephoning directly 
• by you completing an online booking via the Book A Test portal (PCR)
• by you registering for home testing via the LFT Portal Registration Form
• by you uploading any positive results to Keeping Jersey COVID-19 Safe
• by you telephoning, mailing or emailing us directly

In some cases, we may collect information about you from another Government of Jersey department or from the following third parties we interact with in order to deliver our duties.

If you make a claim for Short Term Incapacity Allowance, Customer and Local Service may check the information you provide in respect of yourself, and where applicable anyone you are caring for against their existing records. 

The legal basis for the Government processing this personal information (including special category data) as described above is that it necessary for reasons of public health (Schedule 2, Art.16).

For further information on how Customer and Local Services processes your data, see their privacy notice. 

PCR Testing

We will process your information if you are tested for COVID-19 (PCR swab tests). Under these circumstances, we are processing your information so that we can:

• record your test results and associated data, such as genomic sequence
• contact you to advise you of your test result (positive or negative)
• contact you to advise that a re-swab is required (usually due to an inadequate amount of sample collected)
• provide you with information about available help and support which may be on offer

If you are tested for COVID-19 with a PCR swab test, we will provide you with your result via an email or a text message.

The contact details used to provide you with your test results may be those you provide when you book your test or, in certain circumstances, they may be the contact details you have previously provided to the Government of Jersey (see the section 'how we will use the information about you' below for further details).

Lateral Flow Testing (LFT)

LFTs are available to all Islanders to use at home. You are recommended to take an LFT before visiting an elderly or vulnerable friend or relative. Islanders of any age can register to receive LFTs at home by signing up to the Home Testing Programme. 

We process your information so that we can: 

• register you on the lateral flow testing programme relevant to you 
• provide you with a unique registration number  
• delivery your test packs to your address 
• enable the submission of test results and maintain a record of your submissions 
• contact you if deemed necessary

Your information, once collected, is retained within the Lateral Flow Testing Portal. The test result is shared with the Integrated Public Health Record (IPHR).

Management of confirmed COVID-19 cases

If you have a positive test result and are recommended to stay at home, we will process your information in order to:

• confirm the guidance in writing 
• provide information about support available

You may also be eligible to claim Short Term Incapacity Allowance from Customer and Local Services for the period you self-isolate. You can find more information at COVID-19 sickness benefit claims. 

Jersey Covid App

If you are using the Jersey Covid App and have opted to provide your mobile phone number, we will process your mobile phone number and date of last exposure if you receive an Exposure Notification Alert on the App. 

Under these circumstances, we are processing your information so that we can:

• contact you if you receive an alert
• trace your contacts 
• provide information about available help and support which may be on offer

For further information relating to the App please see the Jersey Covid App privacy notice.

Reporting Statistics

Existing information held about you by the Government of Jersey and information collected as part of the response to COVID-19 will be used to provide a range of statistical reporting.

Statistical information will be made available to relevant Government Health Officials, Senior Officers and Ministers to enable them to make informed decisions in the response to COVID-19.

Anonymised statistical information will also be shared with the World Health Organization (WHO).

Anonymised statistical information will be published on the Government of Jersey website and via other media, where relevant.

The use of your personal data for statistical reporting is aimed at:

• ensuring that Government's decision makers have the right information at the right time to determine the most appropriate public health response
• providing members of the public with insightful information about the Government of Jersey's response to the COVID-19 pandemic
• informing future planning and policy development

Government of Jersey Co-funding scheme

We will process your personal information if you applied for the Government of Jersey Co-Funding Scheme or submitted an appeal to the scheme.

Under these circumstances we are processing your personal data so that we can:

• assess your eligibility for the scheme
• respond effectively to your enquiries
• process your appeal

If during the COVID-19 period you made an application to the Co-Funding payment scheme, some of your details may be published alongside other businesses that have applied. 

Data for this Scheme will be retained according to the retention schedule stated in the Public Finances Manual. For further information see the Social Security Privacy Policy. 

Types of information we collect

The types of personal data collected will vary depending on what information you volunteer and the information we need in each circumstance. We have listed below the most common categories of information we may collect about you:

Contact details

We collect your:

• contact information, including your full name, mobile telephone number, email address and current residential address 
• demographic information such as your date of birth  
• employment status, workplace and role

Publicly available information

Information collated from public reports and data feeds, which may include information on individuals.

Voluntary Information

Unsolicited information you may provide to us when you engage with us.

How we will use the information about you

We need to collect and hold information about you in order to carry out the public functions of the Public Health department. Our legal basis for processing personal data in most cases is that it is necessary for the exercise of the Public Health function of the States or any public authority (Schedule 2 para 4(c) of the Data Protection Law).

The Government will continue to comply with the principles of the Law and will act transparently and only collect the minimum amount of information that is needed to respond to COVID-19.

We have set out in further detail below why we use your personal data in each instance.

The legal basis for the Government processing your personal information (including special category data) as described below is that it is necessary for public health (Schedule 2, Art.16). We remain committed to the ongoing protection of your information and compliance with your data subject rights.

Data collected:

• contact details
• demographic information
• workplace and employment  

Used to answer your query or investigate your complaint or manage our relationship with you.

Legal basis

The processing by public health is necessary for reasons of public interest in the area of public health, including (but not limited to):

• protecting against cross border threats to health
• ensuring a high standard of quality and safety of health care or social care, where they are provided for by law
  

Who we may share your personal information with

Other Data Controllers

We may need to pass your information to other Government of Jersey Departments or the following organisations for the purposes stated above.

Health and Community Services use the data for a range of medical and clinical purposes and may share the test samples with a third-party pathology laboratory (Micropathology) for genomic sequencing.

Information may be shared with Social Security for the purpose of establishing eligibility to claim benefits.

Personal and special category data is shared with Jersey's General Practitioners (GPs) to provide them with COVID-19 test results for their patients, and to ensure that individuals continue to receive the most appropriate medical care.

Limited personal information is shared with Statistics Jersey who use the data for a range of statistical and analytical purposes. Personal data is anonymised or pseudonymised where possible before it is shared and used for statistical purposes. Statistical information will be published on the Government of Jersey website, or other media such as the press, to keep members of the public informed. All statistical information is strictly anonymised.

Your information is retained within the Lateral Flow Testing Portal. The test result is shared with the Integrated Public Health Record (IPHR).

We may also disclose information to other public authorities where it is necessary, either to comply with a legal obligation, or where required under other legislation. Examples of this include, but are not limited to:

• the prevention or detection of crime
• national security purposes
• the purposes of meeting statutory obligations 
• to prevent risk of harm to an individual

In some instances, this data sharing may require us to transfer your personal data outside Jersey and the European Economic Area (EEA). We shall only do this with the necessary safeguards in place and where it is lawful, because it is necessary and proportionate for the proper discharge of our statutory functions.

At no time will your information be passed to organisations for marketing or sales purposes or for any commercial use without your prior explicit consent.

Service providers

Your personal data may be processed on our behalf by certain third parties who provide services for us. We have strict contracts in place with these service providers to ensure they process your data only on our instructions and with appropriate security in place. The categories of third parties who may receive your personal data in order to provide us with a service are:

• C5 Alliance for the purposes of IT support and system development
• Prosperity 24/7 for the purposes of IT support and system development
  

How long we store the information about you

We will keep your information accurate and up to date and not keep it for longer than is necessary in order to track COVID-19 cases and related information. You can see our retention schedule for more detail about how long we retain your information.

Unless indicated otherwise in this notice, the information you provide to us will be retained for the length of time necessary for the purpose it was collected. Currently, we cannot specify how long this will be, as it will depend on the duration of the current outbreak and whether the information may be required if the virus remerges.

The ongoing retention of your information is to be reviewed every 6 months.

Telephone calls

Unless we inform you otherwise, telephone calls made by the Government of Jersey are not recorded. If you leave a message on our voicemail systems, your message will be kept until we are able to return your call or make a note of your message. File notes of when and why you called may be taken for record keeping purposes. We will not pass on the content of your telephone calls unless is it necessary for us to do so. Either to fulfil your request for a service, to comply with a legal obligation, or if permitted under other legislation.

Emails

If you email us, we may keep a record of your email address and a copy of the email for record keeping purposes. For security reasons we will not include any confidential information about you in any email we send to you. We would also suggest that you keep the amount of confidential information you send to us via email to a minimum, or to use our secure online services where possible. Alternatively, you can also correspond with us by post. We will not share your email address or your email contents unless is it necessary for us to do so, either to fulfil your request for a service, to comply with a legal obligation, or if permitted under other legislation.

Where do we store the information about you

Government of Jersey systems store data in Jersey, the UK and the EU. The UK has been granted adequacy status by the European Commission and personal data stored there will be protected to the same standards as personal data held in Jersey and the EU.

Cookies and the gov.je website

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. See the States of Jersey privacy policies for details of the cookies used on gov.je websites.

Statutory or contractual obligations to provide personal data

You are not obliged by any law or contract to provide us with your personal data. However, if you choose not to provide certain information when requested, we may not be able to perform the service you have requested, or we may be prevented from complying with our legal obligation.

Your rights

See your personal data rights for details of your rights under the Data Protection Law and how to exercise them.

Withdrawal of consent

Where we rely on your consent to process personal data (see section 3 above), you can withdraw your consent by contacting the COVID-19 helpdesk or by deleting the Jersey COVID App from your phone.

Where the collection and processing of your information is carried out based on your consent, you have the right to withdraw your consent to prevent further processing of your personal data. However, information collected and processed in response to COVID-19 diagnoses is carried out for public health protection purposes.

Complaints

If you have an enquiry or concern regarding processing your personal data, you can email the Data Governance Officer at r.young3@gov.je. 

If you wish to make a complaint about how your personal data is processed, you can email the Government’s Data Protection Officer.

If you believe that SPPP has contravened the Data Protection Law and the contravention affects your data protection rights, you have the right to make a complaint at any time to the Jersey Office of the Information Commissioner (JOIC). 

We would prefer to deal with your concerns before you approach the JOIC, so contact us in the first instance.

Changes to this notice

We may, from time to time, revise this privacy to ensure it remains up to date. It is advisable to check it regularly to keep aware of any changes.

This version was last updated on 3 January 2023.