The UK and devolved governments have announced a number of additional measures to help stop the spread of COVID-19. Some organisations are now required by law to collect customer information to support contact tracing schemes, and there are government apps you can download so people can trace the spread of the virus.
The ICO has been supporting businesses and government to ensure that data protection and privacy is built into these new measures from the start.
Whenever an organisation uses your information, it’s important for you to be aware of your personal data rights. We’ve put together some tips on things you should expect:
Your personal data should be kept secure
Businesses collecting your information for contact tracing should do so in a secure way. This means they shouldn’t use open log books or ask you to add your name to a list. If you’re concerned an organisation isn’t keeping your data secure you should raise your concern with them first. If you’re still dissatisfied, you can complain to the ICO.
Your personal data should only be used for contact tracing
Businesses shouldn’t misuse your personal information. Organisations and their staff members have an obligation to look after your personal information. For example, businesses shouldn’t use your contact details to send you further marketing or sell it on for others to target you. And staff members shouldn’t use your phone number or other contact details to get in touch with you for personal reasons.
If you’re worried about how an organisation is handling your personal information, you have the right to raise your concerns. However, if you feel uncomfortable speaking directly to the organisation, the ico can help help. You can call our helpline and our team will be able to advise on what to do, how you can make a complaint to us and what will happen next.
You should understand how your personal data will be used
Whenever you give an organisation your personal data they should tell you how your information will be used. If you download either the NHS COVID-19 app, the Protect Scotland app or the StopCOVID NI app, it should be clear what personal data is being collected, why it is being collected and how long it will keep this information.
Organisations collecting information for contact tracing should be transparent that they are only collecting the information for the purposes of contact tracing. If they want to collect information to send you updates or offers, this should be done separately and should be made clear to you.
You have the right to access your personal information
You have the right to ask an organisation for copies of the personal information it holds about you. The ico have detailed guidance on how you can ask an organisation for copies of your information.
What if I don’t experience this?
If you’re unhappy with how an organisation has been looking after your personal information you have the right to raise a concern. We have advice on the steps you can take here.